emilsoftware-utilities 2.0.0-dev.66 → 2.0.0-dev.68

package/dist/accessi/resource-server/introspection.js

@@ -0,0 +1,115 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiIntrospectionClient = createAccessiIntrospectionClient;
+const crypto_1 = require("crypto");
+const errors_1 = require("./errors");
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function unwrapResult(payload) {
+    if (isRecord(payload) && isRecord(payload.Result))
+        return payload.Result;
+    if (isRecord(payload))
+        return payload;
+    return {};
+}
+function parseResult(payload) {
+    var _a;
+    const result = unwrapResult(payload);
+    const active = result.active === true;
+    const user = isRecord(result.user) ? result.user : undefined;
+    const grants = isRecord(result.grants) ? result.grants : undefined;
+    const rawCode = (_a = user === null || user === void 0 ? void 0 : user.codiceUtente) !== null && _a !== void 0 ? _a : result.codiceUtente;
+    const codiceUtente = Number(rawCode);
+    return Object.assign(Object.assign(Object.assign({ active }, (user ? { user } : {})), (Number.isSafeInteger(codiceUtente) && codiceUtente > 0 ? { codiceUtente } : {})), (grants ? { grants } : {}));
+}
+/**
+ * Crea il client di introspection.
+ *
+ * Il service token deve avere scope `accessi:introspect`. I risultati attivi
+ * sono memorizzati per `cacheTtlMs` (default 30s); i risultati inattivi non
+ * vengono cachati per permettere un retry immediato dopo un login.
+ */
+function createAccessiIntrospectionClient(options) {
+    var _a, _b, _c;
+    if (!(options === null || options === void 0 ? void 0 : options.url) || !(options === null || options === void 0 ? void 0 : options.serviceToken)) {
+        throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "introspection.url e introspection.serviceToken sono obbligatori.");
+    }
+    const fetchImpl = (_a = options.fetch) !== null && _a !== void 0 ? _a : globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+        throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "fetch non disponibile per l'introspection.");
+    }
+    const cacheTtlMs = Math.max(1000, (_b = options.cacheTtlMs) !== null && _b !== void 0 ? _b : 30000);
+    const timeoutMs = Math.max(500, (_c = options.timeoutMs) !== null && _c !== void 0 ? _c : 3000);
+    const cache = new Map();
+    const clearCache = () => {
+        cache.clear();
+    };
+    const introspect = (token_1, ...args_1) => __awaiter(this, [token_1, ...args_1], void 0, function* (token, callOptions = {}) {
+        if (typeof token !== "string" || token.trim() === "") {
+            return { active: false };
+        }
+        const cacheKey = (0, crypto_1.createHash)("sha256").update(token).digest("hex");
+        const cached = cache.get(cacheKey);
+        if (!callOptions.forceRefresh && cached && cached.expiresAt > Date.now()) {
+            return cached.result;
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
+        let response;
+        try {
+            response = yield fetchImpl(options.url, {
+                method: "POST",
+                headers: {
+                    Accept: "application/json",
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${options.serviceToken}`,
+                },
+                body: JSON.stringify({ token }),
+                signal: controller.signal,
+            });
+        }
+        catch (_a) {
+            cache.delete(cacheKey);
+            throw (0, errors_1.accessiAuthError)(503, "AUTH_INTROSPECTION_UNAVAILABLE", "Accessi Service non raggiungibile per l'introspection.");
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+        if (response.status === 401 || response.status === 403) {
+            throw (0, errors_1.accessiAuthError)(503, "AUTH_INTROSPECTION_UNAUTHORIZED", "Service token non valido o privo dello scope accessi:introspect.");
+        }
+        if (response.status >= 500) {
+            throw (0, errors_1.accessiAuthError)(503, "AUTH_INTROSPECTION_UNAVAILABLE", `Accessi Service ha risposto ${response.status} all'introspection.`);
+        }
+        if (response.status === 400 || response.status === 404) {
+            return { active: false };
+        }
+        let payload;
+        try {
+            payload = yield response.json();
+        }
+        catch (_b) {
+            throw (0, errors_1.accessiAuthError)(503, "AUTH_INTROSPECTION_UNAVAILABLE", "Risposta introspection non JSON.");
+        }
+        const result = parseResult(payload);
+        if (result.active) {
+            cache.set(cacheKey, { result, expiresAt: Date.now() + cacheTtlMs });
+        }
+        else {
+            cache.delete(cacheKey);
+        }
+        return result;
+    });
+    return { introspect, clearCache };
+}
+//# sourceMappingURL=introspection.js.map

package/dist/accessi/resource-server/introspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/introspection.ts"],"names":[],"mappings":";;;;;;;;;;;AAgDA,4EAsGC;AAtJD,mCAAoC;AACpC,qCAA4C;AAc5C,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACpC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACzE,IAAI,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACtC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;;IACnC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,MAAM,OAAO,GAAG,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,mCAAI,MAAM,CAAC,YAAY,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAErC,mDACE,MAAM,IACH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACtB,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChF,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC7B;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gCAAgC,CAC9C,OAAoC;;IAEpC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAA,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,CAAA,EAAE,CAAC;QAC5C,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,UAAU,CAAC,KAAK,CAAC;IACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,UAAU,mCAAI,KAAM,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAA,OAAO,CAAC,SAAS,mCAAI,IAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,qBAGoB,EAAE,0DAFvC,KAAa,EACb,cAA0C,EAAE;QAE5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACzE,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;iBAChD;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;gBAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,gCAAgC,EAChC,wDAAwD,CACzD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,iCAAiC,EACjC,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,gCAAgC,EAChC,+BAA+B,QAAQ,CAAC,MAAM,qBAAqB,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,gCAAgC,EAChC,kCAAkC,CACnC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAA,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import { createHash } from \"crypto\";\nimport { accessiAuthError } from \"./errors\";\nimport type { AccessiIntrospectionOptions, AccessiIntrospectionResult } from \"./types\";\n\ninterface CacheEntry {\n  result: AccessiIntrospectionResult;\n  expiresAt: number;\n}\n\n/** Client di introspection verso Accessi Service, con cache locale dei risultati attivi. */\nexport interface AccessiIntrospectionClient {\n  introspect(token: string, options?: { forceRefresh?: boolean }): Promise<AccessiIntrospectionResult>;\n  clearCache(): void;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction unwrapResult(payload: unknown): Record<string, unknown> {\n  if (isRecord(payload) && isRecord(payload.Result)) return payload.Result;\n  if (isRecord(payload)) return payload;\n  return {};\n}\n\nfunction parseResult(payload: unknown): AccessiIntrospectionResult {\n  const result = unwrapResult(payload);\n  const active = result.active === true;\n  const user = isRecord(result.user) ? result.user : undefined;\n  const grants = isRecord(result.grants) ? result.grants : undefined;\n  const rawCode = user?.codiceUtente ?? result.codiceUtente;\n  const codiceUtente = Number(rawCode);\n\n  return {\n    active,\n    ...(user ? { user } : {}),\n    ...(Number.isSafeInteger(codiceUtente) && codiceUtente > 0 ? { codiceUtente } : {}),\n    ...(grants ? { grants } : {}),\n  };\n}\n\n/**\n * Crea il client di introspection.\n *\n * Il service token deve avere scope `accessi:introspect`. I risultati attivi\n * sono memorizzati per `cacheTtlMs` (default 30s); i risultati inattivi non\n * vengono cachati per permettere un retry immediato dopo un login.\n */\nexport function createAccessiIntrospectionClient(\n  options: AccessiIntrospectionOptions,\n): AccessiIntrospectionClient {\n  if (!options?.url || !options?.serviceToken) {\n    throw accessiAuthError(\n      500,\n      \"AUTH_CONFIG_INVALID\",\n      \"introspection.url e introspection.serviceToken sono obbligatori.\",\n    );\n  }\n\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"fetch non disponibile per l'introspection.\");\n  }\n\n  const cacheTtlMs = Math.max(1_000, options.cacheTtlMs ?? 30_000);\n  const timeoutMs = Math.max(500, options.timeoutMs ?? 3_000);\n  const cache = new Map<string, CacheEntry>();\n\n  const clearCache = (): void => {\n    cache.clear();\n  };\n\n  const introspect = async (\n    token: string,\n    callOptions: { forceRefresh?: boolean } = {},\n  ): Promise<AccessiIntrospectionResult> => {\n    if (typeof token !== \"string\" || token.trim() === \"\") {\n      return { active: false };\n    }\n\n    const cacheKey = createHash(\"sha256\").update(token).digest(\"hex\");\n    const cached = cache.get(cacheKey);\n    if (!callOptions.forceRefresh && cached && cached.expiresAt > Date.now()) {\n      return cached.result;\n    }\n\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), timeoutMs);\n    let response: Response;\n    try {\n      response = await fetchImpl(options.url, {\n        method: \"POST\",\n        headers: {\n          Accept: \"application/json\",\n          \"Content-Type\": \"application/json\",\n          Authorization: `Bearer ${options.serviceToken}`,\n        },\n        body: JSON.stringify({ token }),\n        signal: controller.signal,\n      });\n    } catch {\n      cache.delete(cacheKey);\n      throw accessiAuthError(\n        503,\n        \"AUTH_INTROSPECTION_UNAVAILABLE\",\n        \"Accessi Service non raggiungibile per l'introspection.\",\n      );\n    } finally {\n      clearTimeout(timeout);\n    }\n\n    if (response.status === 401 || response.status === 403) {\n      throw accessiAuthError(\n        503,\n        \"AUTH_INTROSPECTION_UNAUTHORIZED\",\n        \"Service token non valido o privo dello scope accessi:introspect.\",\n      );\n    }\n    if (response.status >= 500) {\n      throw accessiAuthError(\n        503,\n        \"AUTH_INTROSPECTION_UNAVAILABLE\",\n        `Accessi Service ha risposto ${response.status} all'introspection.`,\n      );\n    }\n    if (response.status === 400 || response.status === 404) {\n      return { active: false };\n    }\n\n    let payload: unknown;\n    try {\n      payload = await response.json();\n    } catch {\n      throw accessiAuthError(\n        503,\n        \"AUTH_INTROSPECTION_UNAVAILABLE\",\n        \"Risposta introspection non JSON.\",\n      );\n    }\n\n    const result = parseResult(payload);\n    if (result.active) {\n      cache.set(cacheKey, { result, expiresAt: Date.now() + cacheTtlMs });\n    } else {\n      cache.delete(cacheKey);\n    }\n    return result;\n  };\n\n  return { introspect, clearCache };\n}\n"]}

package/dist/accessi/resource-server/keys.d.ts

@@ -0,0 +1,11 @@
+/** Derivazione usata dal server Accessi per separare le chiavi JWT per scopo. */
+export declare const ACCESSI_JWT_ACCESS_PURPOSE = "accessi:jwt:access:v1";
+/**
+ * Deriva la chiave HMAC degli access token dal segreto configurato in
+ * `ACCESSI_JWT_SECRET`.
+ *
+ * Serve ai resource server che condividono il segreto grezzo con Accessi ma non
+ * vogliono replicare la KDF: passare il risultato come `jwt.secret`, oppure
+ * usare direttamente `jwt.serverSecret`.
+ */
+export declare function deriveAccessiAccessSecret(serverSecret: string): string;

package/dist/accessi/resource-server/keys.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCESSI_JWT_ACCESS_PURPOSE = void 0;
+exports.deriveAccessiAccessSecret = deriveAccessiAccessSecret;
+const crypto_1 = require("crypto");
+/** Derivazione usata dal server Accessi per separare le chiavi JWT per scopo. */
+exports.ACCESSI_JWT_ACCESS_PURPOSE = "accessi:jwt:access:v1";
+/**
+ * Deriva la chiave HMAC degli access token dal segreto configurato in
+ * `ACCESSI_JWT_SECRET`.
+ *
+ * Serve ai resource server che condividono il segreto grezzo con Accessi ma non
+ * vogliono replicare la KDF: passare il risultato come `jwt.secret`, oppure
+ * usare direttamente `jwt.serverSecret`.
+ */
+function deriveAccessiAccessSecret(serverSecret) {
+    if (typeof serverSecret !== "string" || serverSecret.length === 0) {
+        throw new Error("serverSecret Accessi non configurato.");
+    }
+    return (0, crypto_1.createHmac)("sha256", serverSecret).update(exports.ACCESSI_JWT_ACCESS_PURPOSE).digest("hex");
+}
+//# sourceMappingURL=keys.js.map

package/dist/accessi/resource-server/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/keys.ts"],"names":[],"mappings":";;;AAaA,8DAKC;AAlBD,mCAAoC;AAEpC,iFAAiF;AACpE,QAAA,0BAA0B,GAAG,uBAAuB,CAAC;AAElE;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,YAAoB;IAC5D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,kCAA0B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC","sourcesContent":["import { createHmac } from \"crypto\";\n\n/** Derivazione usata dal server Accessi per separare le chiavi JWT per scopo. */\nexport const ACCESSI_JWT_ACCESS_PURPOSE = \"accessi:jwt:access:v1\";\n\n/**\n * Deriva la chiave HMAC degli access token dal segreto configurato in\n * `ACCESSI_JWT_SECRET`.\n *\n * Serve ai resource server che condividono il segreto grezzo con Accessi ma non\n * vogliono replicare la KDF: passare il risultato come `jwt.secret`, oppure\n * usare direttamente `jwt.serverSecret`.\n */\nexport function deriveAccessiAccessSecret(serverSecret: string): string {\n  if (typeof serverSecret !== \"string\" || serverSecret.length === 0) {\n    throw new Error(\"serverSecret Accessi non configurato.\");\n  }\n  return createHmac(\"sha256\", serverSecret).update(ACCESSI_JWT_ACCESS_PURPOSE).digest(\"hex\");\n}\n"]}

package/dist/accessi/resource-server/nest.d.ts

@@ -0,0 +1,9 @@
+import { CanActivate, Type } from "@nestjs/common";
+import type { AccessiResourceServerOptions } from "./types";
+/**
+ * Crea un guard Nest configurato con le opzioni del resource server.
+ *
+ * Uso:
+ * `@UseGuards(createAccessiAuthGuard(options))`
+ */
+export declare function createAccessiAuthGuard(options: AccessiResourceServerOptions): Type<CanActivate>;

package/dist/accessi/resource-server/nest.js

@@ -0,0 +1,62 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiAuthGuard = createAccessiAuthGuard;
+const common_1 = require("@nestjs/common");
+const errors_1 = require("./errors");
+const runtime_1 = require("./runtime");
+function toNestException(error) {
+    const normalized = error instanceof errors_1.AccessiResourceServerError
+        ? error
+        : new errors_1.AccessiResourceServerError(500, "AUTH_INTERNAL_ERROR", "Errore interno durante l'autenticazione.");
+    const payload = { code: normalized.code, message: normalized.message };
+    if (normalized.status === 401)
+        return new common_1.UnauthorizedException(payload);
+    if (normalized.status === 403)
+        return new common_1.ForbiddenException(payload);
+    if (normalized.status === 503)
+        return new common_1.ServiceUnavailableException(payload);
+    return new common_1.InternalServerErrorException(payload);
+}
+/**
+ * Crea un guard Nest configurato con le opzioni del resource server.
+ *
+ * Uso:
+ * `@UseGuards(createAccessiAuthGuard(options))`
+ */
+function createAccessiAuthGuard(options) {
+    const runtime = (0, runtime_1.createAccessiResourceServer)(options);
+    let ConfiguredAccessiAuthGuard = class ConfiguredAccessiAuthGuard {
+        canActivate(context) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const request = context.switchToHttp().getRequest();
+                try {
+                    yield (0, runtime_1.authenticateAccessiRequest)(request, runtime);
+                    return true;
+                }
+                catch (error) {
+                    throw toNestException(error);
+                }
+            });
+        }
+    };
+    ConfiguredAccessiAuthGuard = __decorate([
+        (0, common_1.Injectable)()
+    ], ConfiguredAccessiAuthGuard);
+    return ConfiguredAccessiAuthGuard;
+}
+//# sourceMappingURL=nest.js.map

package/dist/accessi/resource-server/nest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nest.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/nest.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAiCA,wDAmBC;AApDD,2CASwB;AAExB,qCAAsD;AACtD,uCAAoF;AAGpF,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,UAAU,GAAG,KAAK,YAAY,mCAA0B;QAC5D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,mCAA0B,CAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;IAEvE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,8BAAqB,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,oCAA2B,CAAC,OAAO,CAAC,CAAC;IAC/E,OAAO,IAAI,qCAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAGrD,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;QACxB,WAAW,CAAC,OAAyB;;gBACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,IAAA,oCAA0B,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;SAAA;KACF,CAAA;IAVK,0BAA0B;QAD/B,IAAA,mBAAU,GAAE;OACP,0BAA0B,CAU/B;IAED,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Injectable,\n  InternalServerErrorException,\n  ServiceUnavailableException,\n  Type,\n  UnauthorizedException,\n} from \"@nestjs/common\";\nimport type { Request } from \"express\";\nimport { AccessiResourceServerError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\nfunction toNestException(error: unknown): Error {\n  const normalized = error instanceof AccessiResourceServerError\n    ? error\n    : new AccessiResourceServerError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n  const payload = { code: normalized.code, message: normalized.message };\n\n  if (normalized.status === 401) return new UnauthorizedException(payload);\n  if (normalized.status === 403) return new ForbiddenException(payload);\n  if (normalized.status === 503) return new ServiceUnavailableException(payload);\n  return new InternalServerErrorException(payload);\n}\n\n/**\n * Crea un guard Nest configurato con le opzioni del resource server.\n *\n * Uso:\n * `@UseGuards(createAccessiAuthGuard(options))`\n */\nexport function createAccessiAuthGuard(\n  options: AccessiResourceServerOptions,\n): Type<CanActivate> {\n  const runtime = createAccessiResourceServer(options);\n\n  @Injectable()\n  class ConfiguredAccessiAuthGuard implements CanActivate {\n    async canActivate(context: ExecutionContext): Promise<boolean> {\n      const request = context.switchToHttp().getRequest<Request>();\n      try {\n        await authenticateAccessiRequest(request, runtime);\n        return true;\n      } catch (error) {\n        throw toNestException(error);\n      }\n    }\n  }\n\n  return ConfiguredAccessiAuthGuard;\n}\n"]}

package/dist/accessi/resource-server/runtime.d.ts

@@ -0,0 +1,27 @@
+import type { Request } from "express";
+import type { GrantsResult } from "../contracts";
+import type { AccessiIntrospectionClient } from "./introspection";
+import type { AccessiTokenVerifier } from "./token";
+import type { AccessiRequestContext, AccessiResourceServerOptions } from "./types";
+/** Request Express arricchita dal resource server. */
+export interface AccessiAuthenticatedRequest extends Request {
+    user?: Record<string, unknown>;
+    data?: Record<string, unknown>;
+    userGrants?: GrantsResult;
+    accessi?: AccessiRequestContext;
+}
+/** Runtime creato una volta al bootstrap e riutilizzato a ogni richiesta. */
+export interface AccessiResourceServerRuntime {
+    options: AccessiResourceServerOptions;
+    verifier?: AccessiTokenVerifier;
+    introspectionClient?: AccessiIntrospectionClient;
+}
+/** Valida la configurazione e prepara verificatore e client di introspection. */
+export declare function createAccessiResourceServer(options: AccessiResourceServerOptions): AccessiResourceServerRuntime;
+/**
+ * Autentica la request e applica l'eventuale policy di autorizzazione.
+ *
+ * Non accede mai al database Accessi: la verifica e locale oppure delegata
+ * all'introspection di Accessi Service.
+ */
+export declare function authenticateAccessiRequest(request: Request, runtime: AccessiResourceServerRuntime): Promise<AccessiRequestContext>;

package/dist/accessi/resource-server/runtime.js

@@ -0,0 +1,128 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiResourceServer = createAccessiResourceServer;
+exports.authenticateAccessiRequest = authenticateAccessiRequest;
+const contracts_1 = require("../contracts");
+const errors_1 = require("./errors");
+const introspection_1 = require("./introspection");
+const token_1 = require("./token");
+function resolveMode(options) {
+    if (options.mode)
+        return options.mode;
+    if (options.jwt)
+        return "local";
+    if (options.introspection)
+        return "introspection";
+    throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "Configurare jwt o introspection nel resource server Accessi.");
+}
+/** Valida la configurazione e prepara verificatore e client di introspection. */
+function createAccessiResourceServer(options) {
+    const mode = resolveMode(options);
+    if (mode === "local" && !options.jwt) {
+        throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "mode local richiede jwt.");
+    }
+    if (mode === "introspection" && !options.introspection) {
+        throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "mode introspection richiede introspection.");
+    }
+    return Object.assign(Object.assign({ options: Object.assign(Object.assign({}, options), { mode }) }, (options.jwt ? { verifier: (0, token_1.createAccessiTokenVerifier)(options.jwt) } : {})), (options.introspection
+        ? { introspectionClient: (0, introspection_1.createAccessiIntrospectionClient)(options.introspection) }
+        : {}));
+}
+function mergeIntrospectionUser(payload, user) {
+    return Object.assign(Object.assign(Object.assign({}, (payload !== null && payload !== void 0 ? payload : { typ: "access" })), user), { typ: "access", utente: user });
+}
+/**
+ * Autentica la request e applica l'eventuale policy di autorizzazione.
+ *
+ * Non accede mai al database Accessi: la verifica e locale oppure delegata
+ * all'introspection di Accessi Service.
+ */
+function authenticateAccessiRequest(request, runtime) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const token = (0, contracts_1.extractAccessiBearerToken)(request.headers.authorization);
+        if (!token) {
+            throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_MISSING", "Token Bearer mancante o malformato.");
+        }
+        const mode = (_a = runtime.options.mode) !== null && _a !== void 0 ? _a : "local";
+        let payload;
+        let user = {};
+        let codiceUtente;
+        let grants;
+        if (mode === "local") {
+            if (!runtime.verifier) {
+                throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "Verificatore JWT non configurato.");
+            }
+            const verification = yield runtime.verifier.verify(token);
+            payload = verification.payload;
+            user = verification.user;
+            codiceUtente = verification.codiceUtente;
+        }
+        else {
+            if (!runtime.introspectionClient) {
+                throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "Client introspection non configurato.");
+            }
+            const introspection = yield runtime.introspectionClient.introspect(token);
+            if (!introspection.active) {
+                throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_INVALID", "Token non valido, scaduto o revocato.");
+            }
+            user = (_b = introspection.user) !== null && _b !== void 0 ? _b : {};
+            codiceUtente = introspection.codiceUtente;
+            grants = introspection.grants;
+            payload = mergeIntrospectionUser(undefined, user);
+        }
+        if (!codiceUtente) {
+            throw (0, errors_1.accessiAuthError)(401, "AUTH_USER_CODE_MISSING", "Token privo di un utente valido.");
+        }
+        const requirementTree = (0, contracts_1.buildRequirementTree)(runtime.options.authorization);
+        if (requirementTree) {
+            if (!grants) {
+                if (!runtime.introspectionClient) {
+                    throw (0, errors_1.accessiAuthError)(500, "AUTH_GRANTS_SOURCE_MISSING", "La policy richiede grant ma introspection non e configurata.");
+                }
+                const introspection = yield runtime.introspectionClient.introspect(token);
+                if (!introspection.active) {
+                    throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_INVALID", "Token non valido, scaduto o revocato.");
+                }
+                grants = introspection.grants;
+                if (introspection.user) {
+                    user = introspection.user;
+                    payload = mergeIntrospectionUser(payload, user);
+                }
+            }
+            const hasPermissions = yield (0, contracts_1.evaluateRequirement)(requirementTree, {
+                req: request,
+                decodedToken: payload,
+                userCode: codiceUtente,
+                getGrantsResult: () => __awaiter(this, void 0, void 0, function* () { return grants !== null && grants !== void 0 ? grants : {}; }),
+            }, runtime.options.authorization);
+            if (!hasPermissions) {
+                throw (0, errors_1.accessiAuthError)(403, "AUTH_INSUFFICIENT_PERMISSIONS", "Permessi insufficienti per questa operazione.");
+            }
+        }
+        const authenticatedRequest = request;
+        const authPayload = payload !== null && payload !== void 0 ? payload : {
+            typ: "access",
+            codiceUtente,
+            utente: user,
+        };
+        authenticatedRequest.user = authPayload;
+        authenticatedRequest.data = authPayload;
+        if (grants)
+            authenticatedRequest.userGrants = grants;
+        authenticatedRequest.accessi = Object.assign(Object.assign({ token,
+            user,
+            codiceUtente }, (grants ? { grants } : {})), { payload: authPayload });
+        return authenticatedRequest.accessi;
+    });
+}
+//# sourceMappingURL=runtime.js.map

package/dist/accessi/resource-server/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/runtime.ts"],"names":[],"mappings":";;;;;;;;;;;AA+CA,kEAkBC;AAoBD,gEAkGC;AAtLD,4CAIsB;AAKtB,qCAA4C;AAC5C,mDAAmE;AAEnE,mCAAqD;AAsBrD,SAAS,WAAW,CAAC,OAAqC;IACxD,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC;IAClD,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,8DAA8D,CAC/D,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,2BAA2B,CACzC,OAAqC;IAErC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACnG,CAAC;IAED,qCACE,OAAO,kCAAO,OAAO,KAAE,IAAI,OACxB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAA,kCAA0B,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC1E,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAA,gDAAgC,EAAC,OAAO,CAAC,aAAa,CAAC,EAAE;QAClF,CAAC,CAAC,EAAE,CAAC,EACP;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA8C,EAC9C,IAA6B;IAE7B,qDACK,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,GAC9B,IAAI,KACP,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,IAAI,IACZ;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAsB,0BAA0B,CAC9C,OAAgB,EAChB,OAAqC;;;QAErC,MAAM,KAAK,GAAG,IAAA,qCAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,qCAAqC,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,IAAI,mCAAI,OAAO,CAAC;QAC7C,IAAI,OAA8C,CAAC;QACnD,IAAI,IAAI,GAA4B,EAAE,CAAC;QACvC,IAAI,YAAgC,CAAC;QACrC,IAAI,MAAgC,CAAC;QAErC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,mCAAmC,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;YAC/B,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;YACzB,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBACjC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,GAAG,MAAA,aAAa,CAAC,IAAI,mCAAI,EAAE,CAAC;YAChC,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;YAC1C,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;YAC9B,OAAO,GAAG,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,eAAe,GAAG,IAAA,gCAAoB,EAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5E,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;oBACjC,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,4BAA4B,EAC5B,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;gBACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC1E,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;oBAC1B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;gBAC7F,CAAC;gBACD,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;gBAC9B,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;oBACvB,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;oBAC1B,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAmB,EAC9C,eAAe,EACf;gBACE,GAAG,EAAE,OAAO;gBACZ,YAAY,EAAE,OAAO;gBACrB,QAAQ,EAAE,YAAY;gBACtB,eAAe,EAAE,GAAS,EAAE,gDAAC,OAAA,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAA,GAAA;aAC1C,EACD,OAAO,CAAC,OAAO,CAAC,aAAa,CAC9B,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,+BAA+B,EAC/B,+CAA+C,CAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAG,OAAsC,CAAC;QACpE,MAAM,WAAW,GAA4B,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI;YACtD,GAAG,EAAE,QAAQ;YACb,YAAY;YACZ,MAAM,EAAE,IAAI;SACb,CAAC;QACF,oBAAoB,CAAC,IAAI,GAAG,WAAW,CAAC;QACxC,oBAAoB,CAAC,IAAI,GAAG,WAAW,CAAC;QACxC,IAAI,MAAM;YAAE,oBAAoB,CAAC,UAAU,GAAG,MAAM,CAAC;QACrD,oBAAoB,CAAC,OAAO,iCAC1B,KAAK;YACL,IAAI;YACJ,YAAY,IACT,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7B,OAAO,EAAE,WAAW,GACrB,CAAC;QACF,OAAO,oBAAoB,CAAC,OAAO,CAAC;IACtC,CAAC;CAAA","sourcesContent":["import type { Request } from \"express\";\nimport {\n  buildRequirementTree,\n  evaluateRequirement,\n  extractAccessiBearerToken,\n} from \"../contracts\";\nimport type {\n  AccessiAccessTokenPayload,\n  GrantsResult,\n} from \"../contracts\";\nimport { accessiAuthError } from \"./errors\";\nimport { createAccessiIntrospectionClient } from \"./introspection\";\nimport type { AccessiIntrospectionClient } from \"./introspection\";\nimport { createAccessiTokenVerifier } from \"./token\";\nimport type { AccessiTokenVerifier } from \"./token\";\nimport type {\n  AccessiRequestContext,\n  AccessiResourceServerOptions,\n} from \"./types\";\n\n/** Request Express arricchita dal resource server. */\nexport interface AccessiAuthenticatedRequest extends Request {\n  user?: Record<string, unknown>;\n  data?: Record<string, unknown>;\n  userGrants?: GrantsResult;\n  accessi?: AccessiRequestContext;\n}\n\n/** Runtime creato una volta al bootstrap e riutilizzato a ogni richiesta. */\nexport interface AccessiResourceServerRuntime {\n  options: AccessiResourceServerOptions;\n  verifier?: AccessiTokenVerifier;\n  introspectionClient?: AccessiIntrospectionClient;\n}\n\nfunction resolveMode(options: AccessiResourceServerOptions): \"local\" | \"introspection\" {\n  if (options.mode) return options.mode;\n  if (options.jwt) return \"local\";\n  if (options.introspection) return \"introspection\";\n  throw accessiAuthError(\n    500,\n    \"AUTH_CONFIG_INVALID\",\n    \"Configurare jwt o introspection nel resource server Accessi.\",\n  );\n}\n\n/** Valida la configurazione e prepara verificatore e client di introspection. */\nexport function createAccessiResourceServer(\n  options: AccessiResourceServerOptions,\n): AccessiResourceServerRuntime {\n  const mode = resolveMode(options);\n  if (mode === \"local\" && !options.jwt) {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"mode local richiede jwt.\");\n  }\n  if (mode === \"introspection\" && !options.introspection) {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"mode introspection richiede introspection.\");\n  }\n\n  return {\n    options: { ...options, mode },\n    ...(options.jwt ? { verifier: createAccessiTokenVerifier(options.jwt) } : {}),\n    ...(options.introspection\n      ? { introspectionClient: createAccessiIntrospectionClient(options.introspection) }\n      : {}),\n  };\n}\n\nfunction mergeIntrospectionUser(\n  payload: AccessiAccessTokenPayload | undefined,\n  user: Record<string, unknown>,\n): AccessiAccessTokenPayload {\n  return {\n    ...(payload ?? { typ: \"access\" }),\n    ...user,\n    typ: \"access\",\n    utente: user,\n  };\n}\n\n/**\n * Autentica la request e applica l'eventuale policy di autorizzazione.\n *\n * Non accede mai al database Accessi: la verifica e locale oppure delegata\n * all'introspection di Accessi Service.\n */\nexport async function authenticateAccessiRequest(\n  request: Request,\n  runtime: AccessiResourceServerRuntime,\n): Promise<AccessiRequestContext> {\n  const token = extractAccessiBearerToken(request.headers.authorization);\n  if (!token) {\n    throw accessiAuthError(401, \"AUTH_TOKEN_MISSING\", \"Token Bearer mancante o malformato.\");\n  }\n\n  const mode = runtime.options.mode ?? \"local\";\n  let payload: AccessiAccessTokenPayload | undefined;\n  let user: Record<string, unknown> = {};\n  let codiceUtente: number | undefined;\n  let grants: GrantsResult | undefined;\n\n  if (mode === \"local\") {\n    if (!runtime.verifier) {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"Verificatore JWT non configurato.\");\n    }\n    const verification = await runtime.verifier.verify(token);\n    payload = verification.payload;\n    user = verification.user;\n    codiceUtente = verification.codiceUtente;\n  } else {\n    if (!runtime.introspectionClient) {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"Client introspection non configurato.\");\n    }\n    const introspection = await runtime.introspectionClient.introspect(token);\n    if (!introspection.active) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido, scaduto o revocato.\");\n    }\n    user = introspection.user ?? {};\n    codiceUtente = introspection.codiceUtente;\n    grants = introspection.grants;\n    payload = mergeIntrospectionUser(undefined, user);\n  }\n\n  if (!codiceUtente) {\n    throw accessiAuthError(401, \"AUTH_USER_CODE_MISSING\", \"Token privo di un utente valido.\");\n  }\n\n  const requirementTree = buildRequirementTree(runtime.options.authorization);\n  if (requirementTree) {\n    if (!grants) {\n      if (!runtime.introspectionClient) {\n        throw accessiAuthError(\n          500,\n          \"AUTH_GRANTS_SOURCE_MISSING\",\n          \"La policy richiede grant ma introspection non e configurata.\",\n        );\n      }\n      const introspection = await runtime.introspectionClient.introspect(token);\n      if (!introspection.active) {\n        throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido, scaduto o revocato.\");\n      }\n      grants = introspection.grants;\n      if (introspection.user) {\n        user = introspection.user;\n        payload = mergeIntrospectionUser(payload, user);\n      }\n    }\n\n    const hasPermissions = await evaluateRequirement(\n      requirementTree,\n      {\n        req: request,\n        decodedToken: payload,\n        userCode: codiceUtente,\n        getGrantsResult: async () => grants ?? {},\n      },\n      runtime.options.authorization,\n    );\n    if (!hasPermissions) {\n      throw accessiAuthError(\n        403,\n        \"AUTH_INSUFFICIENT_PERMISSIONS\",\n        \"Permessi insufficienti per questa operazione.\",\n      );\n    }\n  }\n\n  const authenticatedRequest = request as AccessiAuthenticatedRequest;\n  const authPayload: Record<string, unknown> = payload ?? {\n    typ: \"access\",\n    codiceUtente,\n    utente: user,\n  };\n  authenticatedRequest.user = authPayload;\n  authenticatedRequest.data = authPayload;\n  if (grants) authenticatedRequest.userGrants = grants;\n  authenticatedRequest.accessi = {\n    token,\n    user,\n    codiceUtente,\n    ...(grants ? { grants } : {}),\n    payload: authPayload,\n  };\n  return authenticatedRequest.accessi;\n}\n"]}

package/dist/accessi/resource-server/token.d.ts

@@ -0,0 +1,23 @@
+import type { AccessiAccessTokenPayload } from "../contracts";
+import type { AccessiResourceServerJwtOptions } from "./types";
+/** Esito della verifica locale di un access token. */
+export interface AccessiTokenVerification {
+    token: string;
+    payload: AccessiAccessTokenPayload;
+    codiceUtente: number;
+    user: Record<string, unknown>;
+}
+/** Verificatore riutilizzabile: conserva la cache JWKS tra una richiesta e l'altra. */
+export interface AccessiTokenVerifier {
+    verify(token: string): Promise<AccessiTokenVerification>;
+    verifyAuthorizationHeader(header: unknown): Promise<AccessiTokenVerification>;
+}
+/**
+ * Crea un verificatore locale riutilizzabile.
+ *
+ * Supporta HMAC, chiavi pubbliche PEM (RS ed ES) e JWKS remoto. La cache
+ * JWKS e legata all'istanza del verificatore.
+ */
+export declare function createAccessiTokenVerifier(options: AccessiResourceServerJwtOptions): AccessiTokenVerifier;
+/** Converte un header `Authorization` in verifica del token, senza cache JWKS condivisa. */
+export declare function verifyAccessiAccessToken(header: unknown, options: AccessiResourceServerJwtOptions): Promise<AccessiTokenVerification>;