emilsoftware-utilities 2.0.0-dev.6 → 2.0.0-dev.61

package/dist/accessi-module/security/loginAs.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOGIN_AS_QUERY_PARAM = void 0;
+exports.buildLoginAsUrl = buildLoginAsUrl;
+const common_1 = require("@nestjs/common");
+/** Nome del query parameter usato dalle applicazioni per consumare il token. */
+exports.LOGIN_AS_QUERY_PARAM = 'loginAsToken';
+/**
+ * Combina l'URL dell'applicazione con il token di accesso temporaneo.
+ * Accetta solo URL assoluti http/https: evita schemi come javascript: o data:
+ * che verrebbero restituiti alla console come link cliccabile.
+ */
+function buildLoginAsUrl(targetUrl, token) {
+    if (typeof targetUrl !== 'string' || targetUrl.trim() === '') {
+        throw new common_1.BadRequestException({
+            code: 'ACCESSI_LOGIN_AS_INVALID_URL',
+            message: 'Indica l URL dell applicazione a cui accedere.',
+        });
+    }
+    if (typeof token !== 'string' || token.trim() === '') {
+        throw new common_1.BadRequestException({
+            code: 'ACCESSI_LOGIN_AS_INVALID_TOKEN',
+            message: 'Token di accesso temporaneo non valido.',
+        });
+    }
+    let parsed;
+    try {
+        parsed = new URL(targetUrl.trim());
+    }
+    catch (_a) {
+        throw new common_1.BadRequestException({
+            code: 'ACCESSI_LOGIN_AS_INVALID_URL',
+            message: 'L URL deve essere assoluto e valido, per esempio https://app.example.com.',
+        });
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new common_1.BadRequestException({
+            code: 'ACCESSI_LOGIN_AS_INVALID_URL',
+            message: 'L URL deve usare http o https.',
+        });
+    }
+    parsed.searchParams.set(exports.LOGIN_AS_QUERY_PARAM, token);
+    return parsed.toString();
+}
+//# sourceMappingURL=loginAs.js.map

package/dist/accessi-module/security/loginAs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginAs.js","sourceRoot":"","sources":["../../../src/accessi-module/security/loginAs.ts"],"names":[],"mappings":";;;AAUA,0CAiCC;AA3CD,2CAAqD;AAErD,gFAAgF;AACnE,QAAA,oBAAoB,GAAG,cAAc,CAAC;AAEnD;;;;GAIG;AACH,SAAgB,eAAe,CAAC,SAAiB,EAAE,KAAa;IAC9D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,4BAAmB,CAAC;YAC5B,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,4BAAmB,CAAC;YAC5B,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,4BAAmB,CAAC;YAC5B,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,2EAA2E;SACrF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,4BAAmB,CAAC;YAC5B,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,4BAAoB,EAAE,KAAK,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import { BadRequestException } from '@nestjs/common';\n\n/** Nome del query parameter usato dalle applicazioni per consumare il token. */\nexport const LOGIN_AS_QUERY_PARAM = 'loginAsToken';\n\n/**\n * Combina l'URL dell'applicazione con il token di accesso temporaneo.\n * Accetta solo URL assoluti http/https: evita schemi come javascript: o data:\n * che verrebbero restituiti alla console come link cliccabile.\n */\nexport function buildLoginAsUrl(targetUrl: string, token: string): string {\n  if (typeof targetUrl !== 'string' || targetUrl.trim() === '') {\n    throw new BadRequestException({\n      code: 'ACCESSI_LOGIN_AS_INVALID_URL',\n      message: 'Indica l URL dell applicazione a cui accedere.',\n    });\n  }\n  if (typeof token !== 'string' || token.trim() === '') {\n    throw new BadRequestException({\n      code: 'ACCESSI_LOGIN_AS_INVALID_TOKEN',\n      message: 'Token di accesso temporaneo non valido.',\n    });\n  }\n\n  let parsed: URL;\n  try {\n    parsed = new URL(targetUrl.trim());\n  } catch {\n    throw new BadRequestException({\n      code: 'ACCESSI_LOGIN_AS_INVALID_URL',\n      message: 'L URL deve essere assoluto e valido, per esempio https://app.example.com.',\n    });\n  }\n\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    throw new BadRequestException({\n      code: 'ACCESSI_LOGIN_AS_INVALID_URL',\n      message: 'L URL deve usare http o https.',\n    });\n  }\n\n  parsed.searchParams.set(LOGIN_AS_QUERY_PARAM, token);\n  return parsed.toString();\n}\n"]}

package/dist/accessi-module/security/passwordPolicy.d.ts

@@ -0,0 +1,21 @@
+/** Lunghezze canoniche della password Accessi. */
+export declare const PASSWORD_MIN_LENGTH = 8;
+export declare const PASSWORD_MAX_LENGTH = 100;
+/** Codice errore stabile restituito quando la password non rispetta la policy. */
+export declare const WEAK_PASSWORD_CODE = "ACCESSI_WEAK_PASSWORD";
+export interface PasswordPolicyOptions {
+    minLength?: number;
+    maxLength?: number;
+}
+/**
+ * Restituisce l'elenco leggibile delle violazioni della policy password.
+ * Policy: lunghezza, maiuscola, minuscola, cifra, carattere speciale, nessuno
+ * spazio, non comune.
+ */
+export declare function collectPasswordPolicyViolations(password: unknown, options?: PasswordPolicyOptions): string[];
+/**
+ * Valida la password secondo la policy moderna e, se non conforme, solleva un
+ * `BadRequestException` con codice `ACCESSI_WEAK_PASSWORD` e l'elenco dei
+ * requisiti mancanti. Da usare solo quando si IMPOSTA una password, mai al login.
+ */
+export declare function assertStrongPassword(password: unknown, options?: PasswordPolicyOptions): void;

package/dist/accessi-module/security/passwordPolicy.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WEAK_PASSWORD_CODE = exports.PASSWORD_MAX_LENGTH = exports.PASSWORD_MIN_LENGTH = void 0;
+exports.collectPasswordPolicyViolations = collectPasswordPolicyViolations;
+exports.assertStrongPassword = assertStrongPassword;
+const common_1 = require("@nestjs/common");
+/** Lunghezze canoniche della password Accessi. */
+exports.PASSWORD_MIN_LENGTH = 8;
+exports.PASSWORD_MAX_LENGTH = 100;
+/** Codice errore stabile restituito quando la password non rispetta la policy. */
+exports.WEAK_PASSWORD_CODE = 'ACCESSI_WEAK_PASSWORD';
+/**
+ * Password comuni o banalmente prevedibili rifiutate anche se rispettano la
+ * complessita. Confronto case-insensitive; elenco volutamente piccolo e senza
+ * dipendenze esterne.
+ */
+const COMMON_PASSWORDS = new Set([
+    'password', 'password1', 'password123', 'passw0rd', 'p@ssw0rd', 'p@ssword',
+    '12345678', '123456789', '1234567890', 'qwerty', 'qwerty123', 'qwertyuiop',
+    'admin', 'admin123', 'administrator', 'letmein', 'welcome', 'welcome1',
+    'iloveyou', 'abc12345', 'a1b2c3d4', 'monkey123', 'dragon123', 'changeme',
+    'accessi', 'emilsoftware',
+]);
+/**
+ * Restituisce l'elenco leggibile delle violazioni della policy password.
+ * Policy: lunghezza, maiuscola, minuscola, cifra, carattere speciale, nessuno
+ * spazio, non comune.
+ */
+function collectPasswordPolicyViolations(password, options = {}) {
+    var _a, _b;
+    if (typeof password !== 'string' || password.length === 0) {
+        return ['La password e obbligatoria.'];
+    }
+    const minLength = (_a = options.minLength) !== null && _a !== void 0 ? _a : exports.PASSWORD_MIN_LENGTH;
+    const maxLength = (_b = options.maxLength) !== null && _b !== void 0 ? _b : exports.PASSWORD_MAX_LENGTH;
+    const violations = [];
+    if (password.length < minLength)
+        violations.push(`almeno ${minLength} caratteri`);
+    if (password.length > maxLength)
+        violations.push(`al massimo ${maxLength} caratteri`);
+    if (/\s/.test(password))
+        violations.push('nessuno spazio');
+    if (!/[A-Z]/.test(password))
+        violations.push('almeno una lettera maiuscola');
+    if (!/[a-z]/.test(password))
+        violations.push('almeno una lettera minuscola');
+    if (!/\d/.test(password))
+        violations.push('almeno una cifra');
+    if (!/[^A-Za-z0-9]/.test(password))
+        violations.push('almeno un carattere speciale');
+    if (COMMON_PASSWORDS.has(password.toLowerCase()))
+        violations.push('una password non comune');
+    return violations;
+}
+/**
+ * Valida la password secondo la policy moderna e, se non conforme, solleva un
+ * `BadRequestException` con codice `ACCESSI_WEAK_PASSWORD` e l'elenco dei
+ * requisiti mancanti. Da usare solo quando si IMPOSTA una password, mai al login.
+ */
+function assertStrongPassword(password, options) {
+    const violations = collectPasswordPolicyViolations(password, options);
+    if (violations.length === 0) {
+        return;
+    }
+    throw new common_1.BadRequestException({
+        code: exports.WEAK_PASSWORD_CODE,
+        message: `La password non rispetta i requisiti di sicurezza: richiede ${violations.join(', ')}.`,
+        details: violations,
+    });
+}
+//# sourceMappingURL=passwordPolicy.js.map

package/dist/accessi-module/security/passwordPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordPolicy.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordPolicy.ts"],"names":[],"mappings":";;;AAgCA,0EAsBC;AAOD,oDAWC;AAxED,2CAAqD;AAErD,kDAAkD;AACrC,QAAA,mBAAmB,GAAG,CAAC,CAAC;AACxB,QAAA,mBAAmB,GAAG,GAAG,CAAC;AAEvC,kFAAkF;AACrE,QAAA,kBAAkB,GAAG,uBAAuB,CAAC;AAO1D;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC1E,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY;IAC1E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU;IACxE,SAAS,EAAE,cAAc;CAC1B,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAgB,+BAA+B,CAC7C,QAAiB,EACjB,UAAiC,EAAE;;IAEnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,SAAS,mCAAI,2BAAmB,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,SAAS,mCAAI,2BAAmB,CAAC;IAC3D,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,SAAS,YAAY,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,SAAS,YAAY,CAAC,CAAC;IACtF,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC7E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC9D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACpF,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAE7F,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,QAAiB,EAAE,OAA+B;IACrF,MAAM,UAAU,GAAG,+BAA+B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,4BAAmB,CAAC;QAC5B,IAAI,EAAE,0BAAkB;QACxB,OAAO,EAAE,+DAA+D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAChG,OAAO,EAAE,UAAU;KACpB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { BadRequestException } from '@nestjs/common';\n\n/** Lunghezze canoniche della password Accessi. */\nexport const PASSWORD_MIN_LENGTH = 8;\nexport const PASSWORD_MAX_LENGTH = 100;\n\n/** Codice errore stabile restituito quando la password non rispetta la policy. */\nexport const WEAK_PASSWORD_CODE = 'ACCESSI_WEAK_PASSWORD';\n\nexport interface PasswordPolicyOptions {\n  minLength?: number;\n  maxLength?: number;\n}\n\n/**\n * Password comuni o banalmente prevedibili rifiutate anche se rispettano la\n * complessita. Confronto case-insensitive; elenco volutamente piccolo e senza\n * dipendenze esterne.\n */\nconst COMMON_PASSWORDS = new Set([\n  'password', 'password1', 'password123', 'passw0rd', 'p@ssw0rd', 'p@ssword',\n  '12345678', '123456789', '1234567890', 'qwerty', 'qwerty123', 'qwertyuiop',\n  'admin', 'admin123', 'administrator', 'letmein', 'welcome', 'welcome1',\n  'iloveyou', 'abc12345', 'a1b2c3d4', 'monkey123', 'dragon123', 'changeme',\n  'accessi', 'emilsoftware',\n]);\n\n/**\n * Restituisce l'elenco leggibile delle violazioni della policy password.\n * Policy: lunghezza, maiuscola, minuscola, cifra, carattere speciale, nessuno\n * spazio, non comune.\n */\nexport function collectPasswordPolicyViolations(\n  password: unknown,\n  options: PasswordPolicyOptions = {},\n): string[] {\n  if (typeof password !== 'string' || password.length === 0) {\n    return ['La password e obbligatoria.'];\n  }\n\n  const minLength = options.minLength ?? PASSWORD_MIN_LENGTH;\n  const maxLength = options.maxLength ?? PASSWORD_MAX_LENGTH;\n  const violations: string[] = [];\n\n  if (password.length < minLength) violations.push(`almeno ${minLength} caratteri`);\n  if (password.length > maxLength) violations.push(`al massimo ${maxLength} caratteri`);\n  if (/\\s/.test(password)) violations.push('nessuno spazio');\n  if (!/[A-Z]/.test(password)) violations.push('almeno una lettera maiuscola');\n  if (!/[a-z]/.test(password)) violations.push('almeno una lettera minuscola');\n  if (!/\\d/.test(password)) violations.push('almeno una cifra');\n  if (!/[^A-Za-z0-9]/.test(password)) violations.push('almeno un carattere speciale');\n  if (COMMON_PASSWORDS.has(password.toLowerCase())) violations.push('una password non comune');\n\n  return violations;\n}\n\n/**\n * Valida la password secondo la policy moderna e, se non conforme, solleva un\n * `BadRequestException` con codice `ACCESSI_WEAK_PASSWORD` e l'elenco dei\n * requisiti mancanti. Da usare solo quando si IMPOSTA una password, mai al login.\n */\nexport function assertStrongPassword(password: unknown, options?: PasswordPolicyOptions): void {\n  const violations = collectPasswordPolicyViolations(password, options);\n  if (violations.length === 0) {\n    return;\n  }\n\n  throw new BadRequestException({\n    code: WEAK_PASSWORD_CODE,\n    message: `La password non rispetta i requisiti di sicurezza: richiede ${violations.join(', ')}.`,\n    details: violations,\n  });\n}\n"]}

package/dist/accessi-module/security/passwordResetToken.d.ts

@@ -1,7 +1,17 @@
-import { AccessiOptions } from '../AccessiModule';
+import * as jwt from 'jsonwebtoken';
+import type { AccessiOptions } from '../AccessiModule';
+/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */
 export declare const DEFAULT_PASSWORD_RESET_EXPIRES_IN = "1h";
-export declare function getAccessiJwtSecret(options: AccessiOptions): string;
-export declare function createPasswordResetToken(codiceUtente: number, nonce: string, secret: string, expiresIn?: string): string;
+/** Scopo della chiave derivata: separa le chiavi di access token, reset password e 2FA. */
+export type AccessiJwtPurpose = 'access' | 'reset' | '2fa';
+/**
+ * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).
+ * Un leak della chiave di reset non compromette gli access token e viceversa.
+ */
+export declare function getAccessiJwtSecret(options: AccessiOptions, purpose?: AccessiJwtPurpose): string;
+/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */
+export declare function createPasswordResetToken(codiceUtente: number, nonce: string, secret: string, expiresIn?: jwt.SignOptions['expiresIn']): string;
+/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */
 export declare function verifyPasswordResetToken(token: string, secret: string): {
     codiceUtente: number;
     nonce: string;

package/dist/accessi-module/security/passwordResetToken.js

@@ -38,15 +38,22 @@ exports.getAccessiJwtSecret = getAccessiJwtSecret;
 exports.createPasswordResetToken = createPasswordResetToken;
 exports.verifyPasswordResetToken = verifyPasswordResetToken;
 const jwt = __importStar(require("jsonwebtoken"));
+const crypto_1 = require("crypto");
+/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */
 exports.DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';
-function getAccessiJwtSecret(options) {
+/**
+ * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).
+ * Un leak della chiave di reset non compromette gli access token e viceversa.
+ */
+function getAccessiJwtSecret(options, purpose = 'access') {
     var _a;
     const secret = ((_a = options === null || options === void 0 ? void 0 : options.jwtOptions) === null || _a === void 0 ? void 0 : _a.secret) || process.env.ACC_JWT_SECRET;
     if (!secret) {
         throw new Error('JWT secret non configurato.');
     }
-    return secret;
+    return (0, crypto_1.createHmac)('sha256', secret).update(`accessi:jwt:${purpose}:v1`).digest('hex');
 }
+/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */
 function createPasswordResetToken(codiceUtente, nonce, secret, expiresIn = exports.DEFAULT_PASSWORD_RESET_EXPIRES_IN) {
     if (!codiceUtente || !nonce) {
         throw new Error('Dati insufficienti per generare il reset token.');
@@ -56,13 +63,14 @@ function createPasswordResetToken(codiceUtente, nonce, secret, expiresIn = expor
         typ: 'password-reset',
     }, secret, {
         subject: `${codiceUtente}`,
-        expiresIn: expiresIn,
+        expiresIn,
     });
 }
+/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */
 function verifyPasswordResetToken(token, secret) {
-    const decoded = jwt.verify(token, secret);
+    const decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
     const codiceUtente = Number(decoded === null || decoded === void 0 ? void 0 : decoded.sub);
-    if ((decoded === null || decoded === void 0 ? void 0 : decoded.typ) !== 'password-reset' || !codiceUtente || typeof (decoded === null || decoded === void 0 ? void 0 : decoded.nonce) !== 'string') {
+    if ((decoded === null || decoded === void 0 ? void 0 : decoded.typ) !== 'password-reset' || !Number.isSafeInteger(codiceUtente) || codiceUtente <= 0 || typeof (decoded === null || decoded === void 0 ? void 0 : decoded.nonce) !== 'string' || !decoded.nonce) {
         throw new Error('Token di reset non valido.');
     }
     return {

package/dist/accessi-module/security/passwordResetToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"passwordResetToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,kDAOC;AAED,4DAqBC;AAED,4DAeC;AAzDD,kDAAoC;AAGvB,QAAA,iCAAiC,GAAG,IAAI,CAAC;AAOtD,SAAgB,mBAAmB,CAAC,OAAuB;;IACzD,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,KAAa,EACb,MAAc,EACd,YAAoB,yCAAiC;IAErD,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CACb;QACE,KAAK;QACL,GAAG,EAAE,gBAAgB;KACtB,EACD,MAAM,EACN;QACE,OAAO,EAAE,GAAG,YAAY,EAAE;QAC1B,SAAS,EAAE,SAAgB;KAC5B,CACF,CAAC;AACJ,CAAC;AAED,SAAgB,wBAAwB,CACtC,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAA8B,CAAC;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,MAAK,gBAAgB,IAAI,CAAC,YAAY,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import * as jwt from 'jsonwebtoken';\r\nimport { AccessiOptions } from '../AccessiModule';\r\n\r\nexport const DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';\r\n\r\ninterface PasswordResetTokenPayload extends jwt.JwtPayload {\r\n  nonce: string;\r\n  typ: 'password-reset';\r\n}\r\n\r\nexport function getAccessiJwtSecret(options: AccessiOptions): string {\r\n  const secret = options?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\r\n  if (!secret) {\r\n    throw new Error('JWT secret non configurato.');\r\n  }\r\n\r\n  return secret;\r\n}\r\n\r\nexport function createPasswordResetToken(\r\n  codiceUtente: number,\r\n  nonce: string,\r\n  secret: string,\r\n  expiresIn: string = DEFAULT_PASSWORD_RESET_EXPIRES_IN,\r\n): string {\r\n  if (!codiceUtente || !nonce) {\r\n    throw new Error('Dati insufficienti per generare il reset token.');\r\n  }\r\n\r\n  return jwt.sign(\r\n    {\r\n      nonce,\r\n      typ: 'password-reset',\r\n    },\r\n    secret,\r\n    {\r\n      subject: `${codiceUtente}`,\r\n      expiresIn: expiresIn as any,\r\n    },\r\n  );\r\n}\r\n\r\nexport function verifyPasswordResetToken(\r\n  token: string,\r\n  secret: string,\r\n): { codiceUtente: number; nonce: string } {\r\n  const decoded = jwt.verify(token, secret) as PasswordResetTokenPayload;\r\n  const codiceUtente = Number(decoded?.sub);\r\n\r\n  if (decoded?.typ !== 'password-reset' || !codiceUtente || typeof decoded?.nonce !== 'string') {\r\n    throw new Error('Token di reset non valido.');\r\n  }\r\n\r\n  return {\r\n    codiceUtente,\r\n    nonce: decoded.nonce,\r\n  };\r\n}\r\n"]}
+{"version":3,"file":"passwordResetToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,kDAOC;AAGD,4DAqBC;AAGD,4DAeC;AApED,kDAAoC;AACpC,mCAAoC;AAGpC,mHAAmH;AACtG,QAAA,iCAAiC,GAAG,IAAI,CAAC;AAUtD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAuB,EAAE,UAA6B,QAAQ;;IAChG,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,oHAAoH;AACpH,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,KAAa,EACb,MAAc,EACd,YAA0C,yCAAiC;IAE3E,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CACb;QACE,KAAK;QACL,GAAG,EAAE,gBAAgB;KACtB,EACD,MAAM,EACN;QACE,OAAO,EAAE,GAAG,YAAY,EAAE;QAC1B,SAAS;KACV,CACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,wBAAwB,CACtC,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAA8B,CAAC;IAClG,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,MAAK,gBAAgB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1J,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import * as jwt from 'jsonwebtoken';\nimport { createHmac } from 'crypto';\nimport type { AccessiOptions } from '../AccessiModule';\n\n/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */\nexport const DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';\n\ninterface PasswordResetTokenPayload extends jwt.JwtPayload {\n  nonce: string;\n  typ: 'password-reset';\n}\n\n/** Scopo della chiave derivata: separa le chiavi di access token, reset password e 2FA. */\nexport type AccessiJwtPurpose = 'access' | 'reset' | '2fa';\n\n/**\n * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).\n * Un leak della chiave di reset non compromette gli access token e viceversa.\n */\nexport function getAccessiJwtSecret(options: AccessiOptions, purpose: AccessiJwtPurpose = 'access'): string {\n  const secret = options?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\n  if (!secret) {\n    throw new Error('JWT secret non configurato.');\n  }\n\n  return createHmac('sha256', secret).update(`accessi:jwt:${purpose}:v1`).digest('hex');\n}\n\n/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */\nexport function createPasswordResetToken(\n  codiceUtente: number,\n  nonce: string,\n  secret: string,\n  expiresIn: jwt.SignOptions['expiresIn'] = DEFAULT_PASSWORD_RESET_EXPIRES_IN,\n): string {\n  if (!codiceUtente || !nonce) {\n    throw new Error('Dati insufficienti per generare il reset token.');\n  }\n\n  return jwt.sign(\n    {\n      nonce,\n      typ: 'password-reset',\n    },\n    secret,\n    {\n      subject: `${codiceUtente}`,\n      expiresIn,\n    },\n  );\n}\n\n/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */\nexport function verifyPasswordResetToken(\n  token: string,\n  secret: string,\n): { codiceUtente: number; nonce: string } {\n  const decoded = jwt.verify(token, secret, { algorithms: ['HS256'] }) as PasswordResetTokenPayload;\n  const codiceUtente = Number(decoded?.sub);\n\n  if (decoded?.typ !== 'password-reset' || !Number.isSafeInteger(codiceUtente) || codiceUtente <= 0 || typeof decoded?.nonce !== 'string' || !decoded.nonce) {\n    throw new Error('Token di reset non valido.');\n  }\n\n  return {\n    codiceUtente,\n    nonce: decoded.nonce,\n  };\n}\n"]}

package/dist/accessi-module/security/publicAuthRateLimit.d.ts

@@ -1,9 +1,9 @@
 import { Request, Response } from 'express';
-import { AccessiOptions } from '../AccessiModule';
-export type PublicAuthRateLimitScope = 'login' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken';
+import type { AccessiOptions } from '../AccessiModule';
+export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken' | 'adminBootstrap' | 'consoleEntry';
 type RateLimitDecision = {
     allowed: boolean;
-    retryAfterSeconds?: number;
+    retryAfterSeconds: number;
 };
 export declare function checkPublicAuthRateLimit(options: AccessiOptions, scope: PublicAuthRateLimitScope, req: Request, identifiers?: string[]): RateLimitDecision;
 export declare function sendPublicAuthRateLimitExceeded(res: Response, retryAfterSeconds: number): Response;

package/dist/accessi-module/security/publicAuthRateLimit.js

@@ -6,10 +6,14 @@ const common_1 = require("@nestjs/common");
 const Utilities_1 = require("../../Utilities");
 const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
+    twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },
+    twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },
     register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
     getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
+    adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
+    consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
 };
 const RATE_LIMIT_BUCKETS = new Map();
 const MAX_TRACKED_BUCKETS = 20000;
@@ -49,9 +53,27 @@ function pruneRateLimitBuckets(now) {
         }
     }
 }
+/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */
+function enforceBucketCap() {
+    while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {
+        let oldestKey;
+        let oldestSeen = Number.POSITIVE_INFINITY;
+        for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {
+            if (bucket.lastSeenAt < oldestSeen) {
+                oldestSeen = bucket.lastSeenAt;
+                oldestKey = key;
+            }
+        }
+        if (oldestKey === undefined) {
+            return;
+        }
+        RATE_LIMIT_BUCKETS.delete(oldestKey);
+    }
+}
 function consumeBucket(bucketKey, rule, now) {
     const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);
     if (!existingBucket || existingBucket.resetAt <= now) {
+        enforceBucketCap();
         RATE_LIMIT_BUCKETS.set(bucketKey, {
             count: 1,
             resetAt: now + rule.windowMs,
@@ -69,23 +91,25 @@ function consumeBucket(bucketKey, rule, now) {
 function checkPublicAuthRateLimit(options, scope, req, identifiers = []) {
     var _a, _b, _c, _d, _e;
     if (((_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.enabled) === false) {
-        return { allowed: true };
+        return { allowed: true, retryAfterSeconds: 0 };
     }
     const rule = getRule(options, scope);
     const now = Date.now();
     pruneRateLimitBuckets(now);
     const ipAddress = (_e = normalizeIdentifier((_d = (_b = req.ip) !== null && _b !== void 0 ? _b : (_c = req.socket) === null || _c === void 0 ? void 0 : _c.remoteAddress) !== null && _d !== void 0 ? _d : 'unknown')) !== null && _e !== void 0 ? _e : 'unknown';
-    const bucketKeys = new Set([`${scope}|ip|${ipAddress}`]);
+    // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,
+    // evitando crescita di memoria con identificatori sempre diversi.
+    const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);
+    if (ipRetryAfterSeconds) {
+        return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };
+    }
+    let retryAfterSeconds = 0;
     for (const identifier of identifiers) {
         const normalizedIdentifier = normalizeIdentifier(identifier);
         if (!normalizedIdentifier) {
             continue;
         }
-        bucketKeys.add(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`);
-    }
-    let retryAfterSeconds = 0;
-    for (const bucketKey of bucketKeys) {
-        const bucketRetryAfterSeconds = consumeBucket(bucketKey, rule, now);
+        const bucketRetryAfterSeconds = consumeBucket(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`, rule, now);
         if (bucketRetryAfterSeconds) {
             retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);
         }
@@ -96,7 +120,7 @@ function checkPublicAuthRateLimit(options, scope, req, identifiers = []) {
             retryAfterSeconds,
         };
     }
-    return { allowed: true };
+    return { allowed: true, retryAfterSeconds: 0 };
 }
 function sendPublicAuthRateLimitExceeded(res, retryAfterSeconds) {
     res.setHeader('Retry-After', String(retryAfterSeconds));

package/dist/accessi-module/security/publicAuthRateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA+GA,4DA2CC;AAED,0EAWC;AAvKD,2CAA4C;AAE5C,+CAAgD;AAqBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC7D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IACrF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC;IAEjE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,uBAAuB,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\r\nimport { Request, Response } from 'express';\r\nimport { RestUtilities } from '../../Utilities';\r\nimport { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\r\n\r\nexport type PublicAuthRateLimitScope =\r\n  | 'login'\r\n  | 'register'\r\n  | 'passwordResetEmail'\r\n  | 'passwordResetConfirm'\r\n  | 'getUserByToken';\r\n\r\ntype RateLimitBucket = {\r\n  count: number;\r\n  resetAt: number;\r\n  lastSeenAt: number;\r\n};\r\n\r\ntype RateLimitDecision = {\r\n  allowed: boolean;\r\n  retryAfterSeconds?: number;\r\n};\r\n\r\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\r\n  PublicAuthRateLimitScope,\r\n  PublicAuthRateLimitRuleOptions\r\n> = {\r\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\r\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\r\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\r\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\r\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\r\n};\r\n\r\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\r\nconst MAX_TRACKED_BUCKETS = 20000;\r\nconst MAX_WINDOW_MS = Math.max(\r\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\r\n);\r\n\r\nfunction getRule(\r\n  options: AccessiOptions,\r\n  scope: PublicAuthRateLimitScope,\r\n): PublicAuthRateLimitRuleOptions {\r\n  const configuredRule = options.publicAuthRateLimit?.[scope];\r\n\r\n  if (\r\n    configuredRule &&\r\n    Number.isFinite(configuredRule.windowMs) &&\r\n    configuredRule.windowMs > 0 &&\r\n    Number.isFinite(configuredRule.maxAttempts) &&\r\n    configuredRule.maxAttempts > 0\r\n  ) {\r\n    return {\r\n      windowMs: Math.trunc(configuredRule.windowMs),\r\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\r\n    };\r\n  }\r\n\r\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\r\n}\r\n\r\nfunction normalizeIdentifier(identifier: string): string | null {\r\n  if (typeof identifier !== 'string') {\r\n    return null;\r\n  }\r\n\r\n  const normalized = identifier.trim().toLowerCase();\r\n  return normalized === '' ? null : normalized;\r\n}\r\n\r\nfunction pruneRateLimitBuckets(now: number): void {\r\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\r\n    return;\r\n  }\r\n\r\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\r\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\r\n      RATE_LIMIT_BUCKETS.delete(key);\r\n    }\r\n\r\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\r\n      return;\r\n    }\r\n  }\r\n}\r\n\r\nfunction consumeBucket(\r\n  bucketKey: string,\r\n  rule: PublicAuthRateLimitRuleOptions,\r\n  now: number,\r\n): number | null {\r\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\r\n  if (!existingBucket || existingBucket.resetAt <= now) {\r\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\r\n      count: 1,\r\n      resetAt: now + rule.windowMs,\r\n      lastSeenAt: now,\r\n    });\r\n    return null;\r\n  }\r\n\r\n  existingBucket.lastSeenAt = now;\r\n  if (existingBucket.count >= rule.maxAttempts) {\r\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\r\n  }\r\n\r\n  existingBucket.count += 1;\r\n  return null;\r\n}\r\n\r\nexport function checkPublicAuthRateLimit(\r\n  options: AccessiOptions,\r\n  scope: PublicAuthRateLimitScope,\r\n  req: Request,\r\n  identifiers: string[] = [],\r\n): RateLimitDecision {\r\n  if (options.publicAuthRateLimit?.enabled === false) {\r\n    return { allowed: true };\r\n  }\r\n\r\n  const rule = getRule(options, scope);\r\n  const now = Date.now();\r\n  pruneRateLimitBuckets(now);\r\n\r\n  const ipAddress =\r\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\r\n  const bucketKeys = new Set<string>([`${scope}|ip|${ipAddress}`]);\r\n\r\n  for (const identifier of identifiers) {\r\n    const normalizedIdentifier = normalizeIdentifier(identifier);\r\n    if (!normalizedIdentifier) {\r\n      continue;\r\n    }\r\n\r\n    bucketKeys.add(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`);\r\n  }\r\n\r\n  let retryAfterSeconds = 0;\r\n  for (const bucketKey of bucketKeys) {\r\n    const bucketRetryAfterSeconds = consumeBucket(bucketKey, rule, now);\r\n    if (bucketRetryAfterSeconds) {\r\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\r\n    }\r\n  }\r\n\r\n  if (retryAfterSeconds > 0) {\r\n    return {\r\n      allowed: false,\r\n      retryAfterSeconds,\r\n    };\r\n  }\r\n\r\n  return { allowed: true };\r\n}\r\n\r\nexport function sendPublicAuthRateLimitExceeded(\r\n  res: Response,\r\n  retryAfterSeconds: number,\r\n): Response {\r\n  res.setHeader('Retry-After', String(retryAfterSeconds));\r\n  return RestUtilities.sendErrorMessage(\r\n    res,\r\n    'Troppi tentativi. Riprova piu tardi.',\r\n    'PublicAuthRateLimit',\r\n    HttpStatus.TOO_MANY_REQUESTS,\r\n  );\r\n}\r\n"]}
+{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA6IA,4DAiDC;AAED,0EAWC;AA3MD,2CAA4C;AAE5C,+CAAgD;AAyBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC7D,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC3D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IAErF,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,aAAa,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,uBAAuB,GAAG,aAAa,CAC3C,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,EACJ,GAAG,CACJ,CAAC;QACF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\n\nexport type PublicAuthRateLimitScope =\n  | 'login'\n  | 'twoFactorVerify'\n  | 'twoFactorResend'\n  | 'register'\n  | 'passwordResetEmail'\n  | 'passwordResetConfirm'\n  | 'getUserByToken'\n  | 'adminBootstrap'\n  | 'consoleEntry';\n\ntype RateLimitBucket = {\n  count: number;\n  resetAt: number;\n  lastSeenAt: number;\n};\n\ntype RateLimitDecision = {\n  allowed: boolean;\n  retryAfterSeconds: number;\n};\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n  PublicAuthRateLimitScope,\n  PublicAuthRateLimitRuleOptions\n> = {\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n  twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n  adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n};\n\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\nconst MAX_TRACKED_BUCKETS = 20000;\nconst MAX_WINDOW_MS = Math.max(\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\n);\n\nfunction getRule(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n  const configuredRule = options.publicAuthRateLimit?.[scope];\n\n  if (\n    configuredRule &&\n    Number.isFinite(configuredRule.windowMs) &&\n    configuredRule.windowMs > 0 &&\n    Number.isFinite(configuredRule.maxAttempts) &&\n    configuredRule.maxAttempts > 0\n  ) {\n    return {\n      windowMs: Math.trunc(configuredRule.windowMs),\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\n    };\n  }\n\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nfunction normalizeIdentifier(identifier: string): string | null {\n  if (typeof identifier !== 'string') {\n    return null;\n  }\n\n  const normalized = identifier.trim().toLowerCase();\n  return normalized === '' ? null : normalized;\n}\n\nfunction pruneRateLimitBuckets(now: number): void {\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n    return;\n  }\n\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\n      RATE_LIMIT_BUCKETS.delete(key);\n    }\n\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n      return;\n    }\n  }\n}\n\n/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */\nfunction enforceBucketCap(): void {\n  while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {\n    let oldestKey: string | undefined;\n    let oldestSeen = Number.POSITIVE_INFINITY;\n\n    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n      if (bucket.lastSeenAt < oldestSeen) {\n        oldestSeen = bucket.lastSeenAt;\n        oldestKey = key;\n      }\n    }\n\n    if (oldestKey === undefined) {\n      return;\n    }\n\n    RATE_LIMIT_BUCKETS.delete(oldestKey);\n  }\n}\n\nfunction consumeBucket(\n  bucketKey: string,\n  rule: PublicAuthRateLimitRuleOptions,\n  now: number,\n): number | null {\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\n  if (!existingBucket || existingBucket.resetAt <= now) {\n    enforceBucketCap();\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\n      count: 1,\n      resetAt: now + rule.windowMs,\n      lastSeenAt: now,\n    });\n    return null;\n  }\n\n  existingBucket.lastSeenAt = now;\n  if (existingBucket.count >= rule.maxAttempts) {\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\n  }\n\n  existingBucket.count += 1;\n  return null;\n}\n\nexport function checkPublicAuthRateLimit(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n  req: Request,\n  identifiers: string[] = [],\n): RateLimitDecision {\n  if (options.publicAuthRateLimit?.enabled === false) {\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  const rule = getRule(options, scope);\n  const now = Date.now();\n  pruneRateLimitBuckets(now);\n\n  const ipAddress =\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n  // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n  // evitando crescita di memoria con identificatori sempre diversi.\n  const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);\n  if (ipRetryAfterSeconds) {\n    return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };\n  }\n\n  let retryAfterSeconds = 0;\n  for (const identifier of identifiers) {\n    const normalizedIdentifier = normalizeIdentifier(identifier);\n    if (!normalizedIdentifier) {\n      continue;\n    }\n\n    const bucketRetryAfterSeconds = consumeBucket(\n      `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`,\n      rule,\n      now,\n    );\n    if (bucketRetryAfterSeconds) {\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\n    }\n  }\n\n  if (retryAfterSeconds > 0) {\n    return {\n      allowed: false,\n      retryAfterSeconds,\n    };\n  }\n\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n  res: Response,\n  retryAfterSeconds: number,\n): Response {\n  res.setHeader('Retry-After', String(retryAfterSeconds));\n  return RestUtilities.sendErrorMessage(\n    res,\n    'Troppi tentativi. Riprova piu tardi.',\n    'PublicAuthRateLimit',\n    HttpStatus.TOO_MANY_REQUESTS,\n  );\n}\n"]}

package/dist/accessi-module/security/serviceTokenGuard.d.ts

@@ -0,0 +1,25 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { Request } from 'express';
+import { ServiceTokenService, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';
+/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */
+export declare const SERVICE_TOKEN_SCOPES_METADATA = "accessi:service-token-scopes";
+/** Richiede che il token di servizio presenti tutti gli scope indicati. */
+export declare const RequireServiceTokenScopes: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<string>;
+export type AccessiServiceTokenRequest = Request & {
+    accessiServiceToken?: VerifiedServiceToken;
+};
+/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */
+export declare function getAccessiServiceToken(req: Request): VerifiedServiceToken;
+/**
+ * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.
+ *
+ * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano
+ * con `@RequireServiceTokenScopes('ia')`.
+ */
+export declare class ServiceTokenGuard implements CanActivate {
+    private readonly serviceTokenService;
+    private readonly reflector;
+    constructor(serviceTokenService: ServiceTokenService, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/accessi-module/security/serviceTokenGuard.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceTokenGuard = exports.RequireServiceTokenScopes = exports.SERVICE_TOKEN_SCOPES_METADATA = void 0;
+exports.getAccessiServiceToken = getAccessiServiceToken;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const ServiceTokenService_1 = require("../Services/ServiceTokenService/ServiceTokenService");
+const authenticatedToken_1 = require("./authenticatedToken");
+const serviceTokenRateLimit_1 = require("./serviceTokenRateLimit");
+/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */
+exports.SERVICE_TOKEN_SCOPES_METADATA = 'accessi:service-token-scopes';
+/** Richiede che il token di servizio presenti tutti gli scope indicati. */
+const RequireServiceTokenScopes = (...scopes) => (0, common_1.SetMetadata)(exports.SERVICE_TOKEN_SCOPES_METADATA, scopes);
+exports.RequireServiceTokenScopes = RequireServiceTokenScopes;
+/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */
+function getAccessiServiceToken(req) {
+    const verified = req.accessiServiceToken;
+    if (!verified) {
+        throw new common_1.UnauthorizedException('Token di servizio non verificato.');
+    }
+    return verified;
+}
+/**
+ * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.
+ *
+ * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano
+ * con `@RequireServiceTokenScopes('ia')`.
+ */
+let ServiceTokenGuard = class ServiceTokenGuard {
+    constructor(serviceTokenService, reflector) {
+        this.serviceTokenService = serviceTokenService;
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            const request = context.switchToHttp().getRequest();
+            const ip = (_c = (_a = request.ip) !== null && _a !== void 0 ? _a : (_b = request.socket) === null || _b === void 0 ? void 0 : _b.remoteAddress) !== null && _c !== void 0 ? _c : 'unknown';
+            (0, serviceTokenRateLimit_1.assertServiceTokenRateLimit)(ip);
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(request.headers['authorization']);
+            if (!token) {
+                throw new common_1.UnauthorizedException('Token di servizio mancante.');
+            }
+            const verified = yield this.serviceTokenService.verify(token, { ip });
+            if (!verified) {
+                throw new common_1.UnauthorizedException('Token di servizio non valido, scaduto o revocato.');
+            }
+            request.accessiServiceToken = verified;
+            const requiredScopes = (_d = this.reflector.getAllAndOverride(exports.SERVICE_TOKEN_SCOPES_METADATA, [
+                context.getHandler(),
+                context.getClass(),
+            ])) !== null && _d !== void 0 ? _d : [];
+            const missingScope = requiredScopes.find((scope) => !(0, ServiceTokenService_1.serviceTokenHasScope)(verified.scopes, scope));
+            if (missingScope) {
+                throw new common_1.ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);
+            }
+            return true;
+        });
+    }
+};
+exports.ServiceTokenGuard = ServiceTokenGuard;
+exports.ServiceTokenGuard = ServiceTokenGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [ServiceTokenService_1.ServiceTokenService,
+        core_1.Reflector])
+], ServiceTokenGuard);
+//# sourceMappingURL=serviceTokenGuard.js.map

package/dist/accessi-module/security/serviceTokenGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTokenGuard.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenGuard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuBA,wDAMC;AA7BD,2CAOwB;AACxB,uCAAyC;AAEzC,6FAAsI;AACtI,6DAAiE;AACjE,mEAAsE;AAEtE,iEAAiE;AACpD,QAAA,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,2EAA2E;AACpE,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAgB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,qCAA6B,EAAE,MAAM,CAAC,CAAC;AAAxG,QAAA,yBAAyB,6BAA+E;AAIrH,iGAAiG;AACjG,SAAgB,sBAAsB,CAAC,GAAY;IACjD,MAAM,QAAQ,GAAI,GAAkC,CAAC,mBAAmB,CAAC;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,8BAAqB,CAAC,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,mBAAwC,EACxC,SAAoB;QADpB,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEE,WAAW,CAAC,OAAyB;;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;YAC7D,MAAM,EAAE,GAAG,MAAA,MAAA,OAAO,CAAC,EAAE,mCAAI,MAAA,OAAO,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC;YACpE,IAAA,mDAA2B,EAAC,EAAE,CAAC,CAAC;YAEhC,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,8BAAqB,CAAC,mDAAmD,CAAC,CAAC;YACvF,CAAC;YAEA,OAAsC,CAAC,mBAAmB,GAAG,QAAQ,CAAC;YAEvE,MAAM,cAAc,GAAG,MAAA,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,qCAA6B,EAAE;gBAC/F,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,mCAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAA,0CAAoB,EAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,2BAAkB,CAAC,UAAU,YAAY,qCAAqC,CAAC,CAAC;YAC5F,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;CACF,CAAA;AAlCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAG6B,yCAAmB;QAC7B,gBAAS;GAH5B,iBAAiB,CAkC7B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport type { Request } from 'express';\nimport { ServiceTokenService, serviceTokenHasScope, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';\nimport { extractAccessiBearerToken } from './authenticatedToken';\nimport { assertServiceTokenRateLimit } from './serviceTokenRateLimit';\n\n/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */\nexport const SERVICE_TOKEN_SCOPES_METADATA = 'accessi:service-token-scopes';\n\n/** Richiede che il token di servizio presenti tutti gli scope indicati. */\nexport const RequireServiceTokenScopes = (...scopes: string[]) => SetMetadata(SERVICE_TOKEN_SCOPES_METADATA, scopes);\n\nexport type AccessiServiceTokenRequest = Request & { accessiServiceToken?: VerifiedServiceToken };\n\n/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */\nexport function getAccessiServiceToken(req: Request): VerifiedServiceToken {\n  const verified = (req as AccessiServiceTokenRequest).accessiServiceToken;\n  if (!verified) {\n    throw new UnauthorizedException('Token di servizio non verificato.');\n  }\n  return verified;\n}\n\n/**\n * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.\n *\n * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano\n * con `@RequireServiceTokenScopes('ia')`.\n */\n@Injectable()\nexport class ServiceTokenGuard implements CanActivate {\n  constructor(\n    private readonly serviceTokenService: ServiceTokenService,\n    private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest<Request>();\n    const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';\n    assertServiceTokenRateLimit(ip);\n\n    const token = extractAccessiBearerToken(request.headers['authorization']);\n    if (!token) {\n      throw new UnauthorizedException('Token di servizio mancante.');\n    }\n\n    const verified = await this.serviceTokenService.verify(token, { ip });\n    if (!verified) {\n      throw new UnauthorizedException('Token di servizio non valido, scaduto o revocato.');\n    }\n\n    (request as AccessiServiceTokenRequest).accessiServiceToken = verified;\n\n    const requiredScopes = this.reflector.getAllAndOverride<string[]>(SERVICE_TOKEN_SCOPES_METADATA, [\n      context.getHandler(),\n      context.getClass(),\n    ]) ?? [];\n    const missingScope = requiredScopes.find((scope) => !serviceTokenHasScope(verified.scopes, scope));\n    if (missingScope) {\n      throw new ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);\n    }\n\n    return true;\n  }\n}\n"]}

package/dist/accessi-module/security/serviceTokenRateLimit.d.ts

@@ -0,0 +1,8 @@
+export declare function checkServiceTokenRateLimit(identifier: string): {
+    allowed: boolean;
+    retryAfterSeconds: number;
+};
+/** Svuota i bucket (usato nei test). */
+export declare function resetServiceTokenRateLimit(): void;
+/** Lancia 429 con `Retry-After` quando il limite e superato. */
+export declare function assertServiceTokenRateLimit(identifier: string): void;

package/dist/accessi-module/security/serviceTokenRateLimit.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkServiceTokenRateLimit = checkServiceTokenRateLimit;
+exports.resetServiceTokenRateLimit = resetServiceTokenRateLimit;
+exports.assertServiceTokenRateLimit = assertServiceTokenRateLimit;
+const common_1 = require("@nestjs/common");
+/**
+ * Limite anti-abuso per la verifica dei token di servizio.
+ *
+ * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita
+ * che un client difettoso o malevolo martelli l'endpoint. In-memory: in cluster va
+ * aggiunto un limite anche al gateway.
+ */
+const WINDOW_MS = 60000;
+const MAX_ATTEMPTS = 120;
+const MAX_BUCKETS = 20000;
+const buckets = new Map();
+function checkServiceTokenRateLimit(identifier) {
+    const now = Date.now();
+    const key = identifier && identifier.trim() !== '' ? identifier : 'unknown';
+    const bucket = buckets.get(key);
+    if (!bucket || bucket.resetAt <= now) {
+        if (buckets.size >= MAX_BUCKETS) {
+            const oldestKey = buckets.keys().next().value;
+            if (oldestKey !== undefined) {
+                buckets.delete(oldestKey);
+            }
+        }
+        buckets.set(key, { count: 1, resetAt: now + WINDOW_MS });
+        return { allowed: true, retryAfterSeconds: 0 };
+    }
+    if (bucket.count >= MAX_ATTEMPTS) {
+        return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil((bucket.resetAt - now) / 1000)) };
+    }
+    bucket.count += 1;
+    return { allowed: true, retryAfterSeconds: 0 };
+}
+/** Svuota i bucket (usato nei test). */
+function resetServiceTokenRateLimit() {
+    buckets.clear();
+}
+/** Lancia 429 con `Retry-After` quando il limite e superato. */
+function assertServiceTokenRateLimit(identifier) {
+    const decision = checkServiceTokenRateLimit(identifier);
+    if (!decision.allowed) {
+        throw new common_1.HttpException({ code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' }, common_1.HttpStatus.TOO_MANY_REQUESTS);
+    }
+}
+//# sourceMappingURL=serviceTokenRateLimit.js.map

package/dist/accessi-module/security/serviceTokenRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTokenRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenRateLimit.ts"],"names":[],"mappings":";;AAgBA,gEAsBC;AAGD,gEAEC;AAGD,kEAQC;AAtDD,2CAA2D;AAI3D;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,KAAM,CAAC;AACzB,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,WAAW,GAAG,KAAM,CAAC;AAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEnD,SAAgB,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;IACtG,CAAC;IAED,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,wCAAwC;AACxC,SAAgB,0BAA0B;IACxC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,gEAAgE;AAChE,SAAgB,2BAA2B,CAAC,UAAkB;IAC5D,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,sBAAa,CACrB,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAC/F,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { HttpException, HttpStatus } from '@nestjs/common';\n\ntype RateLimitBucket = { count: number; resetAt: number };\n\n/**\n * Limite anti-abuso per la verifica dei token di servizio.\n *\n * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita\n * che un client difettoso o malevolo martelli l'endpoint. In-memory: in cluster va\n * aggiunto un limite anche al gateway.\n */\nconst WINDOW_MS = 60_000;\nconst MAX_ATTEMPTS = 120;\nconst MAX_BUCKETS = 20_000;\nconst buckets = new Map<string, RateLimitBucket>();\n\nexport function checkServiceTokenRateLimit(identifier: string): { allowed: boolean; retryAfterSeconds: number } {\n  const now = Date.now();\n  const key = identifier && identifier.trim() !== '' ? identifier : 'unknown';\n  const bucket = buckets.get(key);\n\n  if (!bucket || bucket.resetAt <= now) {\n    if (buckets.size >= MAX_BUCKETS) {\n      const oldestKey = buckets.keys().next().value;\n      if (oldestKey !== undefined) {\n        buckets.delete(oldestKey);\n      }\n    }\n    buckets.set(key, { count: 1, resetAt: now + WINDOW_MS });\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  if (bucket.count >= MAX_ATTEMPTS) {\n    return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil((bucket.resetAt - now) / 1000)) };\n  }\n\n  bucket.count += 1;\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\n/** Svuota i bucket (usato nei test). */\nexport function resetServiceTokenRateLimit(): void {\n  buckets.clear();\n}\n\n/** Lancia 429 con `Retry-After` quando il limite e superato. */\nexport function assertServiceTokenRateLimit(identifier: string): void {\n  const decision = checkServiceTokenRateLimit(identifier);\n  if (!decision.allowed) {\n    throw new HttpException(\n      { code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' },\n      HttpStatus.TOO_MANY_REQUESTS,\n    );\n  }\n}\n"]}

package/dist/accessi-module/startupLog.d.ts

@@ -0,0 +1,6 @@
+import type { AccessiOptions } from './AccessiModule';
+/**
+ * Logga gli indirizzi utili del modulo Accessi appena il bootstrap e completato, cosi che
+ * console, swagger e API siano visibili insieme nei log di avvio.
+ */
+export declare function logAccessiStartup(options: AccessiOptions): void;