emilsoftware-utilities 2.0.0-dev.6 → 2.0.0-dev.61

package/dist/accessi-module/Controllers/AuthController.js

@@ -1,43 +1,10 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
@@ -57,27 +24,29 @@ var AuthController_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthController = void 0;
 const common_1 = require("@nestjs/common");
+const TwoFactorDtos_1 = require("../Dtos/TwoFactorDtos");
 const swagger_1 = require("@nestjs/swagger");
-const jwt = __importStar(require("jsonwebtoken"));
+const Logger_1 = require("../../Logger");
 const Utilities_1 = require("../../Utilities");
-const AuthService_1 = require("../Services/AuthService/AuthService");
 const Dtos_1 = require("../Dtos");
-const Logger_1 = require("../../Logger");
+const AuthService_1 = require("../Services/AuthService/AuthService");
+const AdminBootstrapService_1 = require("../Services/AdminBootstrapService/AdminBootstrapService");
 const publicAuthRateLimit_1 = require("../security/publicAuthRateLimit");
 let AuthController = AuthController_1 = class AuthController {
-    constructor(authService, options) {
+    constructor(authService, adminBootstrapService, options) {
         this.authService = authService;
+        this.adminBootstrapService = adminBootstrapService;
         this.options = options;
         this.logger = new Logger_1.Logger(AuthController_1.name);
     }
-    resetPassword(request, res, token, newPassword) {
+    resetPassword(request, res, token, body) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
                 const rateLimitDecision = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'passwordResetConfirm', request);
                 if (!rateLimitDecision.allowed) {
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
                 }
-                yield this.authService.confirmResetPassword(token, newPassword);
+                yield this.authService.confirmResetPassword(token, body.newPassword);
                 return Utilities_1.RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');
             }
             catch (error) {
@@ -85,18 +54,24 @@ let AuthController = AuthController_1 = class AuthController {
             }
         });
     }
-    getUserByToken(request, token, res) {
+    getUserByToken(request, body, res) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
                 const rateLimitDecision = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'getUserByToken', request);
                 if (!rateLimitDecision.allowed) {
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
                 }
-                if (!token) {
+                if (!(body === null || body === void 0 ? void 0 : body.token)) {
                     return Utilities_1.RestUtilities.sendErrorMessage(res, 'Token non fornito', AuthController_1.name, common_1.HttpStatus.BAD_REQUEST);
                 }
-                const authenticatedPayload = yield this.authService.getAuthenticatedTokenPayload(token);
-                return Utilities_1.RestUtilities.sendBaseResponse(res, { userData: authenticatedPayload });
+                const authenticatedPayload = yield this.authService.getAuthenticatedTokenPayload(body.token);
+                const userData = authenticatedPayload === null || authenticatedPayload === void 0 ? void 0 : authenticatedPayload.utente;
+                if (!userData) {
+                    throw new Error('Il token non contiene un utente Accessi valido.');
+                }
+                // Keep the runtime response aligned with GetUserByTokenResponse and Orval:
+                // Result.userData contains the authenticated user directly, not a nested JWT payload.
+                return Utilities_1.RestUtilities.sendBaseResponse(res, { userData });
             }
             catch (error) {
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, common_1.HttpStatus.UNAUTHORIZED);
@@ -114,63 +89,131 @@ let AuthController = AuthController_1 = class AuthController {
                 if (!userData) {
                     return Utilities_1.RestUtilities.sendInvalidCredentials(res);
                 }
-                // Generazione del token JWT
-                const tokenData = {
-                    utente: userData === null || userData === void 0 ? void 0 : userData.utente,
-                };
-                userData.token = {
-                    expiresIn: this.options.jwtOptions.expiresIn,
-                    value: jwt.sign(tokenData, this.options.jwtOptions.secret, {
-                        expiresIn: this.options.jwtOptions.expiresIn,
-                    }),
-                    type: 'Bearer',
-                };
+                if (!userData.challenge && !userData.passwordRequired)
+                    userData.token = this.authService.createAccessiToken(userData.utente, ['password']);
                 return Utilities_1.RestUtilities.sendBaseResponse(res, userData);
             }
             catch (error) {
-                if (error.message === 'PASSWORD_EXPIRED') {
+                if ((error === null || error === void 0 ? void 0 : error.message) === 'PASSWORD_EXPIRED') {
                     this.logger.warning('Password scaduta, cambiare password ', error);
                     return Utilities_1.RestUtilities.sendPasswordExpired(res);
                 }
+                if (error instanceof common_1.HttpException) {
+                    return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error.getStatus());
+                }
+                if ((error === null || error === void 0 ? void 0 : error.message) === AuthService_1.PASSWORD_LOGIN_DISABLED) {
+                    return res.status(common_1.HttpStatus.FORBIDDEN).json({
+                        severity: 'error', status: common_1.HttpStatus.FORBIDDEN, statusCode: 2,
+                        code: AuthService_1.PASSWORD_LOGIN_DISABLED,
+                        error: AuthService_1.PASSWORD_LOGIN_DISABLED,
+                        message: 'Questo utente e abilitato solo tramite SSO. Accedi con un provider collegato.',
+                    });
+                }
                 this.logger.error('Errore durante il login', error);
+                if (Utilities_1.RestUtilities.isDatabaseSchemaError(error)) {
+                    return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+                }
                 return Utilities_1.RestUtilities.sendInvalidCredentials(res);
             }
         });
     }
+    verifyTwoFactor(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const limit = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'twoFactorVerify', request, [body.challengeId]);
+                if (!limit.allowed)
+                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.authService.verifyTwoFactor(body.challengeId, body.code));
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
+            }
+        });
+    }
+    resendTwoFactor(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const limit = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'twoFactorResend', request, [body.challengeId]);
+                if (!limit.allowed)
+                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.authService.resendTwoFactor(body.challengeId));
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
+            }
+        });
+    }
+    bootstrapAdmin(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const limit = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'adminBootstrap', request);
+                if (!limit.allowed)
+                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.adminBootstrapService.bootstrap(body));
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
+            }
+        });
+    }
+    adminBootstrapStatus(res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return Utilities_1.RestUtilities.sendBaseResponse(res, { enabled: this.adminBootstrapService.isEnabled() });
+        });
+    }
 };
 exports.AuthController = AuthController;
 __decorate([
-    (0, swagger_1.ApiOperation)({ summary: 'Conferma il reset della password', operationId: "resetPassword" }),
+    (0, swagger_1.ApiOperation)({ summary: 'Conferma il reset della password', operationId: 'resetPassword' }),
     (0, swagger_1.ApiParam)({ name: 'token', description: 'Token per il reset della password', required: true }),
-    (0, swagger_1.ApiBody)({ schema: { properties: { newPassword: { type: 'string', description: 'Nuova password da impostare' } } } }),
-    (0, swagger_1.ApiResponse)({ status: 200, description: 'Password aggiornata con successo' }),
-    (0, swagger_1.ApiResponse)({ status: 400, description: 'Errore nella richiesta o token non valido' }),
+    (0, swagger_1.ApiBody)({ type: Dtos_1.ConfirmResetPasswordRequest }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Password aggiornata con successo',
+        type: Dtos_1.ActionResponse,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 400,
+        description: 'Errore nella richiesta o token non valido',
+        type: Dtos_1.ErrorResponse,
+    }),
     (0, common_1.Post)('confirm-reset-password/:token'),
     __param(0, (0, common_1.Req)()),
     __param(1, (0, common_1.Res)()),
     __param(2, (0, common_1.Param)('token')),
-    __param(3, (0, common_1.Body)("newPassword")),
+    __param(3, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Object, String, String]),
+    __metadata("design:paramtypes", [Object, Object, String, Dtos_1.ConfirmResetPasswordRequest]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "resetPassword", null);
 __decorate([
-    (0, swagger_1.ApiOperation)({ summary: 'Recupera le informazioni utente dal token JWT', operationId: "getUserByToken" }),
-    (0, swagger_1.ApiBody)({ schema: { properties: { token: { type: 'string', description: 'JWT dell\'utente' } } } }),
-    (0, swagger_1.ApiResponse)({ status: 200, description: 'Informazioni utente recuperate con successo' }),
-    (0, swagger_1.ApiResponse)({ status: 401, description: 'Token non valido o scaduto' }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Recupera le informazioni utente dal token JWT',
+        operationId: 'getUserByToken',
+    }),
+    (0, swagger_1.ApiBody)({ type: Dtos_1.GetUserByTokenRequest }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Informazioni utente recuperate con successo',
+        type: Dtos_1.GetUserByTokenResponse,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Token non valido o scaduto',
+        type: Dtos_1.ErrorResponse,
+    }),
     (0, common_1.Post)('get-user-by-token'),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Body)('token')),
+    __param(1, (0, common_1.Body)()),
     __param(2, (0, common_1.Res)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:paramtypes", [Object, Dtos_1.GetUserByTokenRequest, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "getUserByToken", null);
 __decorate([
     (0, swagger_1.ApiOperation)({
         summary: 'Effettua il login utente',
-        description: 'Autentica l\'utente con email e password. Restituisce un token JWT e i dati dell\'utente se le credenziali sono corrette.',
+        description: "Con sola email restituisce passwordRequired oppure avvia il codice per utenti passwordless. Con password valida restituisce il login completo o challenge se la 2FA e attiva. Nessun JWT viene emesso prima della verifica del codice.",
         operationId: 'login',
     }),
     (0, swagger_1.ApiBody)({ type: Dtos_1.LoginRequest }),
@@ -182,21 +225,14 @@ __decorate([
     (0, swagger_1.ApiResponse)({
         status: 401,
         description: 'Credenziali non valide',
+        type: Dtos_1.ErrorResponse,
     }),
     (0, swagger_1.ApiResponse)({
         status: 403,
-        description: "Password scaduta, è necessatio aggiornarla. ",
-        schema: {
-            example: {
-                message: {
-                    severity: 'warning',
-                    statusCode: 2, // o il valore di StatusCode.Warning
-                    code: 'PASSWORD_EXPIRED',
-                    message: 'Password scaduta. È necessario aggiornarla.',
-                }
-            }
-        }
+        description: 'Password scaduta, e necessario aggiornarla.',
+        type: Dtos_1.PasswordExpiredResponse,
     }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: 'Utente abilitato solo a SSO.', type: Dtos_1.ErrorResponse }),
     (0, common_1.Post)('login'),
     __param(0, (0, common_1.Req)()),
     __param(1, (0, common_1.Body)()),
@@ -205,10 +241,77 @@ __decorate([
     __metadata("design:paramtypes", [Object, Dtos_1.LoginRequest, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "login", null);
+__decorate([
+    (0, common_1.Post)('two-factor/verify'),
+    (0, swagger_1.ApiOperation)({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' }),
+    (0, swagger_1.ApiBody)({ type: TwoFactorDtos_1.VerifyTwoFactorRequest }),
+    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.LoginResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 429, type: Dtos_1.ErrorResponse }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, TwoFactorDtos_1.VerifyTwoFactorRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "verifyTwoFactor", null);
+__decorate([
+    (0, common_1.Post)('two-factor/resend'),
+    (0, swagger_1.ApiOperation)({ summary: 'Reinvia il codice, invalidando il precedente', operationId: 'resendTwoFactor' }),
+    (0, swagger_1.ApiBody)({ type: TwoFactorDtos_1.ResendTwoFactorRequest }),
+    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.LoginResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 429, type: Dtos_1.ErrorResponse }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, TwoFactorDtos_1.ResendTwoFactorRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "resendTwoFactor", null);
+__decorate([
+    (0, common_1.Post)('bootstrap-admin'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Crea il primo utente admin (bootstrap)',
+        operationId: 'bootstrapAdmin',
+        description: 'Endpoint pubblico ma protetto dal token di avvio: attivo solo con adminBootstrap.enabled. ' +
+            'Crea un utente in stato confermato senza email, con flag admin (e super opzionale) e password fornita o generata.',
+    }),
+    (0, swagger_1.ApiBody)({ type: Dtos_1.BootstrapAdminRequest }),
+    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.BootstrapAdminResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, description: 'Token di bootstrap non valido', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: 'Bootstrap admin non abilitato', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 429, description: 'Troppi tentativi', type: Dtos_1.ErrorResponse }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Dtos_1.BootstrapAdminRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "bootstrapAdmin", null);
+__decorate([
+    (0, common_1.Get)('bootstrap-admin/status'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Indica se il bootstrap admin e abilitato',
+        operationId: 'getAdminBootstrapStatus',
+        description: 'Endpoint pubblico: la console mostra la sezione "Crea utente admin" solo quando enabled e true.',
+    }),
+    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.AdminBootstrapStatusResponse }),
+    __param(0, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "adminBootstrapStatus", null);
 exports.AuthController = AuthController = AuthController_1 = __decorate([
     (0, swagger_1.ApiTags)('Auth'),
-    (0, common_1.Controller)('accessi/auth'),
-    __param(1, (0, common_1.Inject)('ACCESSI_OPTIONS')),
-    __metadata("design:paramtypes", [AuthService_1.AuthService, Object])
+    (0, common_1.Controller)('accessi/auth')
+    /**
+     * Endpoint pubblici di autenticazione locale e verifica sessione.
+     * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.
+     */
+    ,
+    __param(2, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [AuthService_1.AuthService,
+        AdminBootstrapService_1.AdminBootstrapService, Object])
 ], AuthController);
 //# sourceMappingURL=AuthController.js.map

package/dist/accessi-module/Controllers/AuthController.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6F;AAC7F,6CAAwF;AAExF,kDAAoC;AACpC,+CAAgD;AAEhD,qEAAkE;AAClE,kCAAsD;AACtD,yCAAsC;AACtC,yEAGyC;AAIlC,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YACmB,WAAwB,EACd,OAAwC;QADlD,gBAAW,GAAX,WAAW,CAAa;QACG,YAAO,GAAP,OAAO,CAAgB;QAHrE,WAAM,GAAW,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAI7C,CAAC;IAQC,aAAa,CACV,OAAgB,EAChB,GAAa,EACJ,KAAa,EACR,WAAmB;;YAExC,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,sBAAsB,EACtB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;gBAChE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CACX,OAAgB,EACR,KAAa,EACrB,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,gBAAgB,EAChB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,mBAAmB,EACnB,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC;gBACxF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;KAAA;IAgCK,KAAK,CAAQ,OAAgB,EAAU,YAA0B,EAAS,GAAa;;YAC3F,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,OAAO,EACP,CAAC,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,CAAC,CACtB,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;gBAED,4BAA4B;gBAC5B,MAAM,SAAS,GAAG;oBAChB,MAAM,EAAE,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM;iBACzB,CAAA;gBAED,QAAQ,CAAC,KAAK,GAAG;oBACf,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS;oBAC5C,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE;wBACzD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAgB;qBACpD,CAAC;oBACF,IAAI,EAAE,QAAQ;iBACf,CAAC;gBAEF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAEf,IAAI,KAAK,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;oBAClE,OAAO,yBAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBACpD,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;QAEH,CAAC;KAAA;CACF,CAAA;AAlJY,wCAAc;AAcnB;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,iBAAO,EAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE,EAAE,EAAE,EAAE,CAAC;IACpH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAC7E,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;IACtF,IAAA,aAAI,EAAC,+BAA+B,CAAC;IAEnC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,aAAI,EAAC,aAAa,CAAC,CAAA;;;;mDAiBrB;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IACzG,IAAA,iBAAO,EAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;IACvE,IAAA,aAAI,EAAC,mBAAmB,CAAC;IAEvB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,EAAC,OAAO,CAAC,CAAA;IACb,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDA0BP;AAgCK;IA9BL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,2HAA2H;QACxI,WAAW,EAAE,OAAO;KACrB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,mBAAY,EAAE,CAAC;IAC/B,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,wBAAwB;KACtC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,8CAA8C;QAC3D,MAAM,EAAE;YACN,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,QAAQ,EAAE,SAAS;oBACnB,UAAU,EAAE,CAAC,EAAE,oCAAoC;oBACnD,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,6CAA6C;iBACvD;aACF;SACF;KACF,CAAC;IACD,IAAA,aAAI,EAAC,OAAO,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAApB,mBAAY;;2CA0CtE;yBAjJU,cAAc;IAF1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAMtB,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCADI,yBAAW;GAJhC,cAAc,CAkJ1B","sourcesContent":["import { Body, Controller, HttpStatus, Inject, Param, Post, Req, Res } from '@nestjs/common';\r\nimport { ApiOperation, ApiTags, ApiResponse, ApiParam, ApiBody } from '@nestjs/swagger';\r\nimport { Request, Response } from 'express';\r\nimport * as jwt from 'jsonwebtoken';\r\nimport { RestUtilities } from '../../Utilities';\r\nimport { AccessiOptions } from '../AccessiModule';\r\nimport { AuthService } from '../Services/AuthService/AuthService';\r\nimport { LoginRequest, LoginResponse } from '../Dtos';\r\nimport { Logger } from '../../Logger';\r\nimport {\r\n  checkPublicAuthRateLimit,\r\n  sendPublicAuthRateLimitExceeded,\r\n} from '../security/publicAuthRateLimit';\r\n\r\n@ApiTags('Auth')\r\n@Controller('accessi/auth')\r\nexport class AuthController {\r\n\r\n  logger: Logger = new Logger(AuthController.name);\r\n  constructor(\r\n    private readonly authService: AuthService,\r\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions\r\n  ) { }\r\n\r\n  @ApiOperation({ summary: 'Conferma il reset della password', operationId: \"resetPassword\" })\r\n  @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\r\n  @ApiBody({ schema: { properties: { newPassword: { type: 'string', description: 'Nuova password da impostare' } } } })\r\n  @ApiResponse({ status: 200, description: 'Password aggiornata con successo' })\r\n  @ApiResponse({ status: 400, description: 'Errore nella richiesta o token non valido' })\r\n  @Post('confirm-reset-password/:token')\r\n  async resetPassword(\r\n    @Req() request: Request,\r\n    @Res() res: Response,\r\n    @Param('token') token: string,\r\n    @Body(\"newPassword\") newPassword: string,\r\n  ) {\r\n    try {\r\n      const rateLimitDecision = checkPublicAuthRateLimit(\r\n        this.options,\r\n        'passwordResetConfirm',\r\n        request,\r\n      );\r\n      if (!rateLimitDecision.allowed) {\r\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\r\n      }\r\n\r\n      await this.authService.confirmResetPassword(token, newPassword);\r\n      return RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');\r\n    } catch (error) {\r\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.BAD_REQUEST);\r\n    }\r\n  }\r\n\r\n  @ApiOperation({ summary: 'Recupera le informazioni utente dal token JWT', operationId: \"getUserByToken\" })\r\n  @ApiBody({ schema: { properties: { token: { type: 'string', description: 'JWT dell\\'utente' } } } })\r\n  @ApiResponse({ status: 200, description: 'Informazioni utente recuperate con successo' })\r\n  @ApiResponse({ status: 401, description: 'Token non valido o scaduto' })\r\n  @Post('get-user-by-token')\r\n  async getUserByToken(\r\n    @Req() request: Request,\r\n    @Body('token') token: string,\r\n    @Res() res: Response,\r\n  ) {\r\n    try {\r\n      const rateLimitDecision = checkPublicAuthRateLimit(\r\n        this.options,\r\n        'getUserByToken',\r\n        request,\r\n      );\r\n      if (!rateLimitDecision.allowed) {\r\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\r\n      }\r\n\r\n      if (!token) {\r\n        return RestUtilities.sendErrorMessage(\r\n          res,\r\n          'Token non fornito',\r\n          AuthController.name,\r\n          HttpStatus.BAD_REQUEST,\r\n        );\r\n      }\r\n\r\n      const authenticatedPayload = await this.authService.getAuthenticatedTokenPayload(token);\r\n      return RestUtilities.sendBaseResponse(res, { userData: authenticatedPayload });\r\n    } catch (error) {\r\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.UNAUTHORIZED);\r\n    }\r\n  }\r\n\r\n  @ApiOperation({\r\n    summary: 'Effettua il login utente',\r\n    description: 'Autentica l\\'utente con email e password. Restituisce un token JWT e i dati dell\\'utente se le credenziali sono corrette.',\r\n    operationId: 'login',\r\n  })\r\n  @ApiBody({ type: LoginRequest })\r\n  @ApiResponse({\r\n    status: 200,\r\n    description: 'Login effettuato con successo',\r\n    type: LoginResponse,\r\n  })\r\n  @ApiResponse({\r\n    status: 401,\r\n    description: 'Credenziali non valide',\r\n  })\r\n  @ApiResponse({\r\n    status: 403,\r\n    description: \"Password scaduta, è necessatio aggiornarla. \",\r\n    schema: {\r\n      example: {\r\n        message: {\r\n          severity: 'warning',\r\n          statusCode: 2, // o il valore di StatusCode.Warning\r\n          code: 'PASSWORD_EXPIRED',\r\n          message: 'Password scaduta. È necessario aggiornarla.',\r\n        }\r\n      }\r\n    }\r\n  })\r\n  @Post('login')\r\n  async login(@Req() request: Request, @Body() loginRequest: LoginRequest, @Res() res: Response) {\r\n    try {\r\n      const rateLimitDecision = checkPublicAuthRateLimit(\r\n        this.options,\r\n        'login',\r\n        request,\r\n        [loginRequest?.email],\r\n      );\r\n      if (!rateLimitDecision.allowed) {\r\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\r\n      }\r\n\r\n      const userData = await this.authService.login(loginRequest);\r\n      if (!userData) {\r\n        return RestUtilities.sendInvalidCredentials(res);\r\n      }\r\n\r\n      // Generazione del token JWT\r\n      const tokenData = {\r\n        utente: userData?.utente,\r\n      }\r\n\r\n      userData.token = {\r\n        expiresIn: this.options.jwtOptions.expiresIn,\r\n        value: jwt.sign(tokenData, this.options.jwtOptions.secret, {\r\n          expiresIn: this.options.jwtOptions.expiresIn as any,\r\n        }),\r\n        type: 'Bearer',\r\n      };\r\n\r\n      return RestUtilities.sendBaseResponse(res, userData);\r\n    } catch (error) {\r\n\r\n      if (error.message === 'PASSWORD_EXPIRED') {\r\n        this.logger.warning('Password scaduta, cambiare password ', error)\r\n        return RestUtilities.sendPasswordExpired(res)\r\n      }\r\n\r\n      this.logger.error('Errore durante il login', error);\r\n      return RestUtilities.sendInvalidCredentials(res);\r\n    }\r\n    \r\n  }\r\n}\r\n\r\n"]}
+{"version":3,"file":"AuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAiH;AACjH,yDAAuF;AACvF,6CAAwF;AAExF,yCAAsC;AACtC,+CAAgD;AAEhD,kCAYiB;AACjB,qEAA2F;AAC3F,mGAAgG;AAChG,yEAGyC;AAQlC,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YACmB,WAAwB,EACxB,qBAA4C,EAClC,OAAwC;QAFlD,gBAAW,GAAX,WAAW,CAAa;QACxB,0BAAqB,GAArB,qBAAqB,CAAuB;QACjB,YAAO,GAAP,OAAO,CAAgB;QALrE,WAAM,GAAW,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAM9C,CAAC;IAgBE,aAAa,CACV,OAAgB,EAChB,GAAa,EACJ,KAAa,EACrB,IAAiC;;YAEzC,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,sBAAsB,EACtB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;KAAA;IAkBK,cAAc,CACX,OAAgB,EACf,IAA2B,EAC5B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,gBAAgB,EAChB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,EAAE,CAAC;oBACjB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,mBAAmB,EACnB,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7F,MAAM,QAAQ,GAAI,oBAA6C,aAA7C,oBAAoB,uBAApB,oBAAoB,CAA2B,MAAM,CAAC;gBACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;gBAED,2EAA2E;gBAC3E,sFAAsF;gBACtF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;KAAA;IA0BK,KAAK,CAAQ,OAAgB,EAAU,YAA0B,EAAS,GAAa;;YAC3F,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,OAAO,EACP,CAAC,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,CAAC,CACtB,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,gBAAgB;oBAAE,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAE3I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,kBAAkB,EAAE,CAAC;oBACrD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACnE,OAAO,yBAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,KAAK,YAAY,sBAAa,EAAE,CAAC;oBACnC,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5F,CAAC;gBAED,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,qCAAuB,EAAE,CAAC;oBAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;wBAC3C,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;wBAC9D,IAAI,EAAE,qCAAuB;wBAC7B,KAAK,EAAE,qCAAuB;wBAC9B,OAAO,EAAE,+EAA+E;qBACzF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBACpD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;gBACJ,CAAC;gBACD,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBACrG,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAClH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBACrG,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAeK,cAAc,CAAQ,OAAgB,EAAU,IAA2B,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBAChF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAUK,oBAAoB,CAAQ,GAAa;;YAC7C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAClG,CAAC;KAAA;CACF,CAAA;AAlPY,wCAAc;AAuBnB;IAdL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kCAA2B,EAAE,CAAC;IAC9C,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kCAAkC;QAC/C,IAAI,EAAE,qBAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,+BAA+B,CAAC;IAEnC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,aAAI,GAAE,CAAA;;6DAAO,kCAA2B;;mDAiB1C;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,gBAAgB;KAC9B,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAsB;KAC7B,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,4BAA4B;QACzC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IAEvB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,4BAAqB;;oDAkCpC;AA0BK;IAxBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,wOAAwO;QAC1O,WAAW,EAAE,OAAO;KACrB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,mBAAY,EAAE,CAAC;IAC/B,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,wBAAwB;QACrC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,8BAAuB;KAC9B,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC9F,IAAA,aAAI,EAAC,OAAO,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAApB,mBAAY;;2CAkDtE;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACnG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACzG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAeK;IAbL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,gBAAgB;QAC7B,WAAW,EACT,4FAA4F;YAC5F,mHAAmH;KACtH,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,6BAAsB,EAAE,CAAC;IAC1D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC7D,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA+B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA7B,4BAAqB;;oDAQhF;AAUK;IARL,IAAA,YAAG,EAAC,wBAAwB,CAAC;IAC7B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,yBAAyB;QACtC,WAAW,EACT,iGAAiG;KACpG,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mCAA4B,EAAE,CAAC;IACrC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;0DAEhC;yBAjPU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAOE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFI,yBAAW;QACD,6CAAqB;GALpD,cAAc,CAkP1B","sourcesContent":["import { Body, Controller, Get, HttpException, HttpStatus, Inject, Param, Post, Req, Res } from '@nestjs/common';\nimport { ResendTwoFactorRequest, VerifyTwoFactorRequest } from '../Dtos/TwoFactorDtos';\nimport { ApiBody, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n  ActionResponse,\n  AdminBootstrapStatusResponse,\n  BootstrapAdminRequest,\n  BootstrapAdminResponse,\n  ConfirmResetPasswordRequest,\n  ErrorResponse,\n  GetUserByTokenRequest,\n  GetUserByTokenResponse,\n  LoginRequest,\n  LoginResponse,\n  PasswordExpiredResponse,\n} from '../Dtos';\nimport { AuthService, PASSWORD_LOGIN_DISABLED } from '../Services/AuthService/AuthService';\nimport { AdminBootstrapService } from '../Services/AdminBootstrapService/AdminBootstrapService';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n@ApiTags('Auth')\n@Controller('accessi/auth')\n/**\n * Endpoint pubblici di autenticazione locale e verifica sessione.\n * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.\n */\nexport class AuthController {\n  logger: Logger = new Logger(AuthController.name);\n\n  constructor(\n    private readonly authService: AuthService,\n    private readonly adminBootstrapService: AdminBootstrapService,\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n  ) {}\n\n  @ApiOperation({ summary: 'Conferma il reset della password', operationId: 'resetPassword' })\n  @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\n  @ApiBody({ type: ConfirmResetPasswordRequest })\n  @ApiResponse({\n    status: 200,\n    description: 'Password aggiornata con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nella richiesta o token non valido',\n    type: ErrorResponse,\n  })\n  @Post('confirm-reset-password/:token')\n  async resetPassword(\n    @Req() request: Request,\n    @Res() res: Response,\n    @Param('token') token: string,\n    @Body() body: ConfirmResetPasswordRequest,\n  ) {\n    try {\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.options,\n        'passwordResetConfirm',\n        request,\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      await this.authService.confirmResetPassword(token, body.newPassword);\n      return RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.BAD_REQUEST);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Recupera le informazioni utente dal token JWT',\n    operationId: 'getUserByToken',\n  })\n  @ApiBody({ type: GetUserByTokenRequest })\n  @ApiResponse({\n    status: 200,\n    description: 'Informazioni utente recuperate con successo',\n    type: GetUserByTokenResponse,\n  })\n  @ApiResponse({\n    status: 401,\n    description: 'Token non valido o scaduto',\n    type: ErrorResponse,\n  })\n  @Post('get-user-by-token')\n  async getUserByToken(\n    @Req() request: Request,\n    @Body() body: GetUserByTokenRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.options,\n        'getUserByToken',\n        request,\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      if (!body?.token) {\n        return RestUtilities.sendErrorMessage(\n          res,\n          'Token non fornito',\n          AuthController.name,\n          HttpStatus.BAD_REQUEST,\n        );\n      }\n\n      const authenticatedPayload = await this.authService.getAuthenticatedTokenPayload(body.token);\n      const userData = (authenticatedPayload as { utente?: unknown })?.utente;\n      if (!userData) {\n        throw new Error('Il token non contiene un utente Accessi valido.');\n      }\n\n      // Keep the runtime response aligned with GetUserByTokenResponse and Orval:\n      // Result.userData contains the authenticated user directly, not a nested JWT payload.\n      return RestUtilities.sendBaseResponse(res, { userData });\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.UNAUTHORIZED);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Effettua il login utente',\n    description:\n      \"Con sola email restituisce passwordRequired oppure avvia il codice per utenti passwordless. Con password valida restituisce il login completo o challenge se la 2FA e attiva. Nessun JWT viene emesso prima della verifica del codice.\",\n    operationId: 'login',\n  })\n  @ApiBody({ type: LoginRequest })\n  @ApiResponse({\n    status: 200,\n    description: 'Login effettuato con successo',\n    type: LoginResponse,\n  })\n  @ApiResponse({\n    status: 401,\n    description: 'Credenziali non valide',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: 403,\n    description: 'Password scaduta, e necessario aggiornarla.',\n    type: PasswordExpiredResponse,\n  })\n  @ApiResponse({ status: 403, description: 'Utente abilitato solo a SSO.', type: ErrorResponse })\n  @Post('login')\n  async login(@Req() request: Request, @Body() loginRequest: LoginRequest, @Res() res: Response) {\n    try {\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.options,\n        'login',\n        request,\n        [loginRequest?.email],\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      const userData = await this.authService.login(loginRequest);\n      if (!userData) {\n        return RestUtilities.sendInvalidCredentials(res);\n      }\n\n      if (!userData.challenge && !userData.passwordRequired) userData.token = this.authService.createAccessiToken(userData.utente, ['password']);\n\n      return RestUtilities.sendBaseResponse(res, userData);\n    } catch (error) {\n      if ((error as Error)?.message === 'PASSWORD_EXPIRED') {\n        this.logger.warning('Password scaduta, cambiare password ', error);\n        return RestUtilities.sendPasswordExpired(res);\n      }\n\n      if (error instanceof HttpException) {\n        return RestUtilities.sendErrorMessage(res, error, AuthController.name, error.getStatus());\n      }\n\n      if ((error as Error)?.message === PASSWORD_LOGIN_DISABLED) {\n        return res.status(HttpStatus.FORBIDDEN).json({\n          severity: 'error', status: HttpStatus.FORBIDDEN, statusCode: 2,\n          code: PASSWORD_LOGIN_DISABLED,\n          error: PASSWORD_LOGIN_DISABLED,\n          message: 'Questo utente e abilitato solo tramite SSO. Accedi con un provider collegato.',\n        });\n      }\n\n      this.logger.error('Errore durante il login', error);\n      if (RestUtilities.isDatabaseSchemaError(error)) {\n        return RestUtilities.sendErrorMessage(\n          res,\n          error,\n          AuthController.name,\n          HttpStatus.SERVICE_UNAVAILABLE,\n        );\n      }\n      return RestUtilities.sendInvalidCredentials(res);\n    }\n  }\n\n  @Post('two-factor/verify')\n  @ApiOperation({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' })\n  @ApiBody({ type: VerifyTwoFactorRequest })\n  @ApiResponse({ status: 200, type: LoginResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse })\n  @ApiResponse({ status: 429, type: ErrorResponse })\n  async verifyTwoFactor(@Req() request: Request, @Body() body: VerifyTwoFactorRequest, @Res() res: Response) {\n    try {\n      const limit = checkPublicAuthRateLimit(this.options, 'twoFactorVerify', request, [body.challengeId]);\n      if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n      return RestUtilities.sendBaseResponse(res, await this.authService.verifyTwoFactor(body.challengeId, body.code));\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n    }\n  }\n\n  @Post('two-factor/resend')\n  @ApiOperation({ summary: 'Reinvia il codice, invalidando il precedente', operationId: 'resendTwoFactor' })\n  @ApiBody({ type: ResendTwoFactorRequest })\n  @ApiResponse({ status: 200, type: LoginResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse })\n  @ApiResponse({ status: 429, type: ErrorResponse })\n  async resendTwoFactor(@Req() request: Request, @Body() body: ResendTwoFactorRequest, @Res() res: Response) {\n    try {\n      const limit = checkPublicAuthRateLimit(this.options, 'twoFactorResend', request, [body.challengeId]);\n      if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n      return RestUtilities.sendBaseResponse(res, await this.authService.resendTwoFactor(body.challengeId));\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n    }\n  }\n\n  @Post('bootstrap-admin')\n  @ApiOperation({\n    summary: 'Crea il primo utente admin (bootstrap)',\n    operationId: 'bootstrapAdmin',\n    description:\n      'Endpoint pubblico ma protetto dal token di avvio: attivo solo con adminBootstrap.enabled. ' +\n      'Crea un utente in stato confermato senza email, con flag admin (e super opzionale) e password fornita o generata.',\n  })\n  @ApiBody({ type: BootstrapAdminRequest })\n  @ApiResponse({ status: 200, type: BootstrapAdminResponse })\n  @ApiResponse({ status: 401, description: 'Token di bootstrap non valido', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Bootstrap admin non abilitato', type: ErrorResponse })\n  @ApiResponse({ status: 429, description: 'Troppi tentativi', type: ErrorResponse })\n  async bootstrapAdmin(@Req() request: Request, @Body() body: BootstrapAdminRequest, @Res() res: Response) {\n    try {\n      const limit = checkPublicAuthRateLimit(this.options, 'adminBootstrap', request);\n      if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n      return RestUtilities.sendBaseResponse(res, await this.adminBootstrapService.bootstrap(body));\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n    }\n  }\n\n  @Get('bootstrap-admin/status')\n  @ApiOperation({\n    summary: 'Indica se il bootstrap admin e abilitato',\n    operationId: 'getAdminBootstrapStatus',\n    description:\n      'Endpoint pubblico: la console mostra la sezione \"Crea utente admin\" solo quando enabled e true.',\n  })\n  @ApiResponse({ status: 200, type: AdminBootstrapStatusResponse })\n  async adminBootstrapStatus(@Res() res: Response) {\n    return RestUtilities.sendBaseResponse(res, { enabled: this.adminBootstrapService.isEnabled() });\n  }\n}\n"]}

package/dist/accessi-module/Controllers/ConfiguratorController.d.ts

@@ -1,13 +1,9 @@
 import { Request, Response } from 'express';
-import { AccessiOptions } from '../AccessiModule';
 import { UpdateEnabledStatusRequest } from '../Dtos';
 import { ConfiguratorService } from '../Services/ConfiguratorService/ConfiguratorService';
-import { UserService } from '../Services/UserService/UserService';
 export declare class ConfiguratorController {
-    private readonly options;
-    private userService;
     private configuratorService;
-    constructor(options: AccessiOptions, userService: UserService, configuratorService: ConfiguratorService);
+    constructor(configuratorService: ConfiguratorService);
     setMenuEnabled(codiceMenu: string, body: UpdateEnabledStatusRequest, req: Request, res: Response): Promise<Response<any, Record<string, any>>>;
     setGroupEnabled(codiceGruppo: string, body: UpdateEnabledStatusRequest, req: Request, res: Response): Promise<Response<any, Record<string, any>>>;
 }

package/dist/accessi-module/Controllers/ConfiguratorController.js

@@ -28,35 +28,24 @@ const swagger_1 = require("@nestjs/swagger");
 const Utilities_1 = require("../../Utilities");
 const Dtos_1 = require("../Dtos");
 const ConfiguratorService_1 = require("../Services/ConfiguratorService/ConfiguratorService");
-const UserService_1 = require("../Services/UserService/UserService");
 const jwt_strategy_1 = require("../jwt/jwt.strategy");
+const accessControl_1 = require("../security/accessControl");
 let ConfiguratorController = ConfiguratorController_1 = class ConfiguratorController {
-    constructor(options, userService, configuratorService) {
-        this.options = options;
-        this.userService = userService;
+    constructor(configuratorService) {
         this.configuratorService = configuratorService;
     }
     setMenuEnabled(codiceMenu, body, req, res) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
             try {
                 if (!codiceMenu)
-                    throw new Error('Il codice del menu � obbligatorio.');
+                    throw new common_1.BadRequestException('Il codice del menu e obbligatorio.');
                 if ((body === null || body === void 0 ? void 0 : body.enabled) === undefined)
-                    throw new Error('Lo stato di abilitazione � obbligatorio.');
-                const user = req === null || req === void 0 ? void 0 : req.user;
-                const codiceUtente = (_a = user === null || user === void 0 ? void 0 : user.utente) === null || _a === void 0 ? void 0 : _a.codiceUtente;
-                if (!codiceUtente) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Utente non riconosciuto dal token.', ConfiguratorController_1.name, 401);
-                }
-                const canConfigure = ((_b = user === null || user === void 0 ? void 0 : user.utente) === null || _b === void 0 ? void 0 : _b.flagAdminConfigurator) ||
-                    (yield this.userService.isAdminConfigurator(codiceUtente));
-                if (!canConfigure) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Utente non autorizzato ad aggiornare i menu.', ConfiguratorController_1.name, 403);
-                }
+                    throw new common_1.BadRequestException('Lo stato di abilitazione e obbligatorio.');
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(req);
+                (0, accessControl_1.ensureAdmin)(authenticatedUser, 'Utente non autorizzato ad aggiornare i menu.');
                 yield this.configuratorService.setMenuEnabled(codiceMenu, body.enabled);
                 const action = body.enabled ? 'abilitato' : 'disabilitato';
-                return Utilities_1.RestUtilities.sendOKMessage(res, `Il menu ${codiceMenu} � stato ${action} con successo.`);
+                return Utilities_1.RestUtilities.sendOKMessage(res, `Il menu ${codiceMenu} e stato ${action} con successo.`);
             }
             catch (error) {
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, ConfiguratorController_1.name);
@@ -65,25 +54,16 @@ let ConfiguratorController = ConfiguratorController_1 = class ConfiguratorContro
     }
     setGroupEnabled(codiceGruppo, body, req, res) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
             try {
                 if (!codiceGruppo)
-                    throw new Error('Il codice del gruppo � obbligatorio.');
+                    throw new common_1.BadRequestException('Il codice del gruppo e obbligatorio.');
                 if ((body === null || body === void 0 ? void 0 : body.enabled) === undefined)
-                    throw new Error('Lo stato di abilitazione � obbligatorio.');
-                const user = req === null || req === void 0 ? void 0 : req.user;
-                const codiceUtente = (_a = user === null || user === void 0 ? void 0 : user.utente) === null || _a === void 0 ? void 0 : _a.codiceUtente;
-                if (!codiceUtente) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Utente non riconosciuto dal token.', ConfiguratorController_1.name, 401);
-                }
-                const canConfigure = ((_b = user === null || user === void 0 ? void 0 : user.utente) === null || _b === void 0 ? void 0 : _b.flagAdminConfigurator) ||
-                    (yield this.userService.isAdminConfigurator(codiceUtente));
-                if (!canConfigure) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Utente non autorizzato ad aggiornare i gruppi menu.', ConfiguratorController_1.name, 403);
-                }
+                    throw new common_1.BadRequestException('Lo stato di abilitazione e obbligatorio.');
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(req);
+                (0, accessControl_1.ensureAdmin)(authenticatedUser, 'Utente non autorizzato ad aggiornare i gruppi menu.');
                 yield this.configuratorService.setGroupEnabled(codiceGruppo, body.enabled);
                 const action = body.enabled ? 'abilitato' : 'disabilitato';
-                return Utilities_1.RestUtilities.sendOKMessage(res, `Il gruppo ${codiceGruppo} � stato ${action} con successo.`);
+                return Utilities_1.RestUtilities.sendOKMessage(res, `Il gruppo ${codiceGruppo} e stato ${action} con successo.`);
             }
             catch (error) {
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, ConfiguratorController_1.name);
@@ -104,10 +84,11 @@ __decorate([
         example: 'MNU001',
     }),
     (0, swagger_1.ApiBody)({ type: Dtos_1.UpdateEnabledStatusRequest }),
-    (0, swagger_1.ApiResponse)({ status: 200, description: 'Stato del menu aggiornato con successo' }),
-    (0, swagger_1.ApiResponse)({ status: 400, description: 'Errore di validazione nei dati inviati' }),
-    (0, swagger_1.ApiResponse)({ status: 403, description: "Utente non autorizzato ad eseguire l'operazione" }),
-    (0, swagger_1.ApiResponse)({ status: 500, description: 'Errore interno del server' }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'Stato del menu aggiornato con successo', type: Dtos_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'Errore di validazione nei dati inviati', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, description: 'Utente non autenticato o token non valido', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: "Utente non autorizzato ad eseguire l'operazione", type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 500, description: 'Errore interno del server', type: Dtos_1.ErrorResponse }),
     (0, common_1.Patch)('menus/:codiceMenu/enabled'),
     __param(0, (0, common_1.Param)('codiceMenu')),
     __param(1, (0, common_1.Body)()),
@@ -129,10 +110,11 @@ __decorate([
         example: 'GRP01',
     }),
     (0, swagger_1.ApiBody)({ type: Dtos_1.UpdateEnabledStatusRequest }),
-    (0, swagger_1.ApiResponse)({ status: 200, description: 'Stato del gruppo aggiornato con successo' }),
-    (0, swagger_1.ApiResponse)({ status: 400, description: 'Errore di validazione nei dati inviati' }),
-    (0, swagger_1.ApiResponse)({ status: 403, description: "Utente non autorizzato ad eseguire l'operazione" }),
-    (0, swagger_1.ApiResponse)({ status: 500, description: 'Errore interno del server' }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'Stato del gruppo aggiornato con successo', type: Dtos_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'Errore di validazione nei dati inviati', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, description: 'Utente non autenticato o token non valido', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: "Utente non autorizzato ad eseguire l'operazione", type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 500, description: 'Errore interno del server', type: Dtos_1.ErrorResponse }),
     (0, common_1.Patch)('groups/:codiceGruppo/enabled'),
     __param(0, (0, common_1.Param)('codiceGruppo')),
     __param(1, (0, common_1.Body)()),
@@ -146,9 +128,9 @@ exports.ConfiguratorController = ConfiguratorController = ConfiguratorController
     (0, swagger_1.ApiBearerAuth)(),
     (0, swagger_1.ApiTags)('Configurator'),
     (0, common_1.Controller)('accessi/configurator'),
-    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard),
-    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
-    __metadata("design:paramtypes", [Object, UserService_1.UserService,
-        ConfiguratorService_1.ConfiguratorService])
+    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard)
+    /** Endpoint amministrativi per abilitare o disabilitare cataloghi menu senza cancellarne lo storico. */
+    ,
+    __metadata("design:paramtypes", [ConfiguratorService_1.ConfiguratorService])
 ], ConfiguratorController);
 //# sourceMappingURL=ConfiguratorController.js.map