emilsoftware-utilities 2.0.0-dev.67 → 2.0.0-dev.68

package/dist/accessi-module/Controllers/ConsoleEntryController.d.ts

@@ -9,6 +9,8 @@ import { ConsoleEntryExchangeRequest } from '../Dtos/ConsoleEntryDtos';
 export declare class ConsoleEntryController {
     private readonly options;
     constructor(options: AccessiOptions);
+    private get store();
+    private get ttlMs();
     createEntryTicket(request: Request, res: Response): Promise<Response<any, Record<string, any>>>;
     exchangeEntryTicket(request: Request, body: ConsoleEntryExchangeRequest, res: Response): Promise<Response<any, Record<string, any>>>;
 }

package/dist/accessi-module/Controllers/ConsoleEntryController.js

@@ -42,6 +42,14 @@ let ConsoleEntryController = ConsoleEntryController_1 = class ConsoleEntryContro
     constructor(options) {
         this.options = options;
     }
+    get store() {
+        var _a, _b;
+        return (_b = (_a = this.options.consoleEntry) === null || _a === void 0 ? void 0 : _a.store) !== null && _b !== void 0 ? _b : (0, consoleEntry_1.getDefaultConsoleEntryStore)();
+    }
+    get ttlMs() {
+        var _a, _b;
+        return (_b = (_a = this.options.consoleEntry) === null || _a === void 0 ? void 0 : _a.ttlMs) !== null && _b !== void 0 ? _b : 60000;
+    }
     createEntryTicket(request, res) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
@@ -51,7 +59,7 @@ let ConsoleEntryController = ConsoleEntryController_1 = class ConsoleEntryContro
                 if (!tokenValue) {
                     throw new common_1.UnauthorizedException({ code: 'ACCESSI_CONSOLE_ENTRY_TOKEN_MISSING', message: 'Token Accessi mancante.' });
                 }
-                const issued = (0, consoleEntry_1.issueConsoleEntryTicket)({ token: tokenValue, codiceUtente: user.codiceUtente });
+                const issued = yield this.store.issue({ token: tokenValue, codiceUtente: user.codiceUtente }, this.ttlMs);
                 return Utilities_1.RestUtilities.sendBaseResponse(res, issued);
             }
             catch (error) {
@@ -63,11 +71,11 @@ let ConsoleEntryController = ConsoleEntryController_1 = class ConsoleEntryContro
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             try {
-                const decision = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'consoleEntry', request, [(_a = body === null || body === void 0 ? void 0 : body.ticket) !== null && _a !== void 0 ? _a : '']);
+                const decision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'consoleEntry', request, [(_a = body === null || body === void 0 ? void 0 : body.ticket) !== null && _a !== void 0 ? _a : '']);
                 if (!decision.allowed) {
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, decision.retryAfterSeconds);
                 }
-                const entry = (0, consoleEntry_1.consumeConsoleEntryTicket)(body === null || body === void 0 ? void 0 : body.ticket);
+                const entry = yield this.store.consume(body === null || body === void 0 ? void 0 : body.ticket);
                 if (!entry) {
                     throw new common_1.UnauthorizedException({
                         code: 'ACCESSI_CONSOLE_ENTRY_INVALID',

package/dist/accessi-module/Controllers/ConsoleEntryController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConsoleEntryController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/ConsoleEntryController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAOyB;AAEzB,+CAAgD;AAEhD,+DAAgI;AAChI,uDAAqD;AACrD,sDAAqD;AACrD,6DAA6F;AAC7F,uEAA2E;AAC3E,2DAA8F;AAC9F,yEAGyC;AAEzC;;;;GAIG;AAII,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,YAAwD,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAY7E,iBAAiB,CAAQ,OAAgB,EAAS,GAAa;;YACnE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAA,mCAAmB,EAAC,IAAI,CAAC,CAAC;gBAE1B,MAAM,UAAU,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBACvH,CAAC;gBAED,MAAM,MAAM,GAAG,IAAA,sCAAuB,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;gBAC/F,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAYK,mBAAmB,CAChB,OAAgB,EACf,IAAiC,EAClC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,EAAE,CAAC,CAAC,CAAC;gBACvG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,KAAK,GAAG,IAAA,wCAAyB,EAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,CAAC,CAAC;gBACtD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,8BAAqB,CAAC;wBAC9B,IAAI,EAAE,+BAA+B;wBACrC,OAAO,EAAE,kFAAkF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA1EY,wDAAsB;AAa3B;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,0IAA0I;KACxJ,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6CAA0B,EAAE,CAAC;IACnD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IACpG,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,OAAO,CAAC;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;+DAoBtD;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,2HAA2H;KACzI,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IAC9C,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IACpD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC9F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnF,IAAA,aAAI,EAAC,gBAAgB,CAAC;IAEpB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,8CAA2B;;iEA0B1C;iCAzEU,sBAAsB;IAHlC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAEf,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,sBAAsB,CA0ElC","sourcesContent":["import {\n  Body,\n  Controller,\n  HttpException,\n  HttpStatus,\n  Inject,\n  Post,\n  Req,\n  Res,\n  UnauthorizedException,\n  UseGuards,\n} from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ConsoleEntryExchangeRequest, ConsoleEntrySessionResponse, ConsoleEntryTicketResponse } from '../Dtos/ConsoleEntryDtos';\nimport { ErrorResponse } from '../Dtos/BaseResponse';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureConsoleAccess, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { extractAccessiBearerToken } from '../security/authenticatedToken';\nimport { consumeConsoleEntryTicket, issueConsoleEntryTicket } from '../security/consoleEntry';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n/**\n * Auto-ingresso alla console amministrativa da un frontend gia autenticato.\n * Il frontend scambia la propria sessione Accessi con un ticket monouso, poi apre\n * `/api/accessi/console#entry=<ticket>`: il JWT non passa mai nell'URL.\n */\n@ApiTags('Console')\n@ApiBearerAuth()\n@Controller('accessi/console')\nexport class ConsoleEntryController {\n  constructor(@Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions) {}\n\n  @ApiOperation({\n    summary: 'Emetti un ticket di ingresso alla console',\n    operationId: 'createConsoleEntryTicket',\n    description: 'Riservato agli utenti abilitati alla console (FLGSUPER/FLGADMIN). Restituisce un ticket monouso legato all utente, valido pochi secondi.',\n  })\n  @ApiOkResponse({ type: ConsoleEntryTicketResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n  @ApiResponse({ status: 403, type: ErrorResponse, description: 'Utente non abilitato alla console.' })\n  @UseGuards(JwtSimpleGuard)\n  @Post('entry')\n  async createEntryTicket(@Req() request: Request, @Res() res: Response) {\n    try {\n      const user = getAuthenticatedAccessiUser(request);\n      ensureConsoleAccess(user);\n\n      const tokenValue = extractAccessiBearerToken(request.headers['authorization']);\n      if (!tokenValue) {\n        throw new UnauthorizedException({ code: 'ACCESSI_CONSOLE_ENTRY_TOKEN_MISSING', message: 'Token Accessi mancante.' });\n      }\n\n      const issued = issueConsoleEntryTicket({ token: tokenValue, codiceUtente: user.codiceUtente });\n      return RestUtilities.sendBaseResponse(res, issued);\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        ConsoleEntryController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n      );\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Scambia il ticket con la sessione Accessi',\n    operationId: 'exchangeConsoleEntryTicket',\n    description: 'Endpoint pubblico (il ticket e l unica credenziale) protetto da rate limit; il ticket e monouso e scade in pochi secondi.',\n  })\n  @ApiBody({ type: ConsoleEntryExchangeRequest })\n  @ApiOkResponse({ type: ConsoleEntrySessionResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Ticket non valido o scaduto.' })\n  @ApiResponse({ status: 429, type: ErrorResponse, description: 'Troppi tentativi.' })\n  @Post('entry/exchange')\n  async exchangeEntryTicket(\n    @Req() request: Request,\n    @Body() body: ConsoleEntryExchangeRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const decision = checkPublicAuthRateLimit(this.options, 'consoleEntry', request, [body?.ticket ?? '']);\n      if (!decision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, decision.retryAfterSeconds);\n      }\n\n      const entry = consumeConsoleEntryTicket(body?.ticket);\n      if (!entry) {\n        throw new UnauthorizedException({\n          code: 'ACCESSI_CONSOLE_ENTRY_INVALID',\n          message: 'Ticket di ingresso console non valido o scaduto. Riapri la console dal frontend.',\n        });\n      }\n\n      return RestUtilities.sendBaseResponse(res, { token: { value: entry.token, type: 'Bearer' } });\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        ConsoleEntryController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n      );\n    }\n  }\n}\n"]}
+{"version":3,"file":"ConsoleEntryController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/ConsoleEntryController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAOyB;AAEzB,+CAAgD;AAEhD,+DAAgI;AAChI,uDAAqD;AACrD,sDAAqD;AACrD,6DAA6F;AAC7F,uEAA2E;AAC3E,2DAAuE;AAEvE,yEAGyC;AAEzC;;;;GAIG;AAII,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,YAAwD,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAEnF,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,IAAA,0CAA2B,GAAE,CAAC;IAC3E,CAAC;IAED,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,KAAM,CAAC;IACpD,CAAC;IAYK,iBAAiB,CAAQ,OAAgB,EAAS,GAAa;;YACnE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAA,mCAAmB,EAAC,IAAI,CAAC,CAAC;gBAE1B,MAAM,UAAU,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBACvH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EACtD,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAYK,mBAAmB,CAChB,OAAgB,EACf,IAAiC,EAClC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,EAAE,CAAC,CAAC,CAAC;gBAC7G,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,CAAC,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,8BAAqB,CAAC;wBAC9B,IAAI,EAAE,+BAA+B;wBACrC,OAAO,EAAE,kFAAkF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AArFY,wDAAsB;AAqB3B;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,0IAA0I;KACxJ,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6CAA0B,EAAE,CAAC;IACnD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IACpG,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,OAAO,CAAC;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;+DAuBtD;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,2HAA2H;KACzI,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IAC9C,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IACpD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC9F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnF,IAAA,aAAI,EAAC,gBAAgB,CAAC;IAEpB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,8CAA2B;;iEA0B1C;iCApFU,sBAAsB;IAHlC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAEf,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,sBAAsB,CAqFlC","sourcesContent":["import {\n  Body,\n  Controller,\n  HttpException,\n  HttpStatus,\n  Inject,\n  Post,\n  Req,\n  Res,\n  UnauthorizedException,\n  UseGuards,\n} from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ConsoleEntryExchangeRequest, ConsoleEntrySessionResponse, ConsoleEntryTicketResponse } from '../Dtos/ConsoleEntryDtos';\nimport { ErrorResponse } from '../Dtos/BaseResponse';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureConsoleAccess, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { extractAccessiBearerToken } from '../security/authenticatedToken';\nimport { getDefaultConsoleEntryStore } from '../security/consoleEntry';\nimport type { ConsoleEntryStore } from '../security/consoleEntry';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n/**\n * Auto-ingresso alla console amministrativa da un frontend gia autenticato.\n * Il frontend scambia la propria sessione Accessi con un ticket monouso, poi apre\n * `/api/accessi/console#entry=<ticket>`: il JWT non passa mai nell'URL.\n */\n@ApiTags('Console')\n@ApiBearerAuth()\n@Controller('accessi/console')\nexport class ConsoleEntryController {\n  constructor(@Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions) {}\n\n  private get store(): ConsoleEntryStore {\n    return this.options.consoleEntry?.store ?? getDefaultConsoleEntryStore();\n  }\n\n  private get ttlMs(): number {\n    return this.options.consoleEntry?.ttlMs ?? 60_000;\n  }\n\n  @ApiOperation({\n    summary: 'Emetti un ticket di ingresso alla console',\n    operationId: 'createConsoleEntryTicket',\n    description: 'Riservato agli utenti abilitati alla console (FLGSUPER/FLGADMIN). Restituisce un ticket monouso legato all utente, valido pochi secondi.',\n  })\n  @ApiOkResponse({ type: ConsoleEntryTicketResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n  @ApiResponse({ status: 403, type: ErrorResponse, description: 'Utente non abilitato alla console.' })\n  @UseGuards(JwtSimpleGuard)\n  @Post('entry')\n  async createEntryTicket(@Req() request: Request, @Res() res: Response) {\n    try {\n      const user = getAuthenticatedAccessiUser(request);\n      ensureConsoleAccess(user);\n\n      const tokenValue = extractAccessiBearerToken(request.headers['authorization']);\n      if (!tokenValue) {\n        throw new UnauthorizedException({ code: 'ACCESSI_CONSOLE_ENTRY_TOKEN_MISSING', message: 'Token Accessi mancante.' });\n      }\n\n      const issued = await this.store.issue(\n        { token: tokenValue, codiceUtente: user.codiceUtente },\n        this.ttlMs,\n      );\n      return RestUtilities.sendBaseResponse(res, issued);\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        ConsoleEntryController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n      );\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Scambia il ticket con la sessione Accessi',\n    operationId: 'exchangeConsoleEntryTicket',\n    description: 'Endpoint pubblico (il ticket e l unica credenziale) protetto da rate limit; il ticket e monouso e scade in pochi secondi.',\n  })\n  @ApiBody({ type: ConsoleEntryExchangeRequest })\n  @ApiOkResponse({ type: ConsoleEntrySessionResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Ticket non valido o scaduto.' })\n  @ApiResponse({ status: 429, type: ErrorResponse, description: 'Troppi tentativi.' })\n  @Post('entry/exchange')\n  async exchangeEntryTicket(\n    @Req() request: Request,\n    @Body() body: ConsoleEntryExchangeRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const decision = await checkPublicAuthRateLimit(this.options, 'consoleEntry', request, [body?.ticket ?? '']);\n      if (!decision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, decision.retryAfterSeconds);\n      }\n\n      const entry = await this.store.consume(body?.ticket);\n      if (!entry) {\n        throw new UnauthorizedException({\n          code: 'ACCESSI_CONSOLE_ENTRY_INVALID',\n          message: 'Ticket di ingresso console non valido o scaduto. Riapri la console dal frontend.',\n        });\n      }\n\n      return RestUtilities.sendBaseResponse(res, { token: { value: entry.token, type: 'Bearer' } });\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        ConsoleEntryController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n      );\n    }\n  }\n}\n"]}

package/dist/accessi-module/Controllers/EmailController.js

@@ -43,7 +43,7 @@ let EmailController = EmailController_1 = class EmailController {
     sendPasswordResetEmail(request, sendResetPasswordData, res) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const rateLimitDecision = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.accessiOptions, 'passwordResetEmail', request, [sendResetPasswordData === null || sendResetPasswordData === void 0 ? void 0 : sendResetPasswordData.email]);
+                const rateLimitDecision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.accessiOptions, 'passwordResetEmail', request, [sendResetPasswordData === null || sendResetPasswordData === void 0 ? void 0 : sendResetPasswordData.email]);
                 if (!rateLimitDecision.allowed) {
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
                 }

package/dist/accessi-module/Controllers/EmailController.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmailController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/EmailController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6F;AAC7F,6CAAkG;AAElG,+BAA4B;AAC5B,+CAAgD;AAEhD,kCAAuF;AACvF,wEAAqE;AACrE,yEAGyC;AAKlC,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,YAC8C,cAA8B,EACzD,YAA0B;QADC,mBAAc,GAAd,cAAc,CAAgB;QACzD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAcE,sBAAsB,CACnB,GAAa,EACJ,MAAc,EACV,UAAmB;;YAEvC,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAkBK,sBAAsB,CACnB,OAAgB,EACf,qBAAoD,EACrD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,OAAO,EACP,CAAC,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,KAAK,CAAC,CAC/B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAC5E,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,iBAAe,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAnEY,0CAAe;AAkBpB;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,wBAAwB;KACtC,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,6BAA6B;QAC1C,QAAQ,EAAE,KAAK;KAChB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IAC1F,IAAA,YAAG,EAAC,4BAA4B,CAAC;IAE/B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;;;;6DAGpB;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,wBAAwB;KACtC,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,oCAA6B,EAAE,CAAC;IAChD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,qBAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,2BAA2B,CAAC;IAE/B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADyB,oCAA6B;;6DAsB7D;0BAlEU,eAAe;IAH3B,IAAA,iBAAO,EAAC,OAAO,CAAC;IAChB,IAAA,mBAAU,EAAC,eAAe,CAAC;IAC5B,8FAA8F;;IAGzF,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,eAAe,CAmE3B","sourcesContent":["import { Body, Controller, Get, Inject, Param, Post, Query, Req, Res } from '@nestjs/common';\nimport { ApiBody, ApiOperation, ApiParam, ApiQuery, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { join } from 'path';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse, SendResetPasswordEmailRequest } from '../Dtos';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n@ApiTags('Email')\n@Controller('accessi/email')\n/** Endpoint pubblici del ciclo reset password; le risposte non rivelano se l'email esiste. */\nexport class EmailController {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly emailService: EmailService,\n  ) {}\n\n  @ApiOperation({\n    summary: 'Serve una pagina per il reset della password',\n    operationId: 'serveResetPasswordPage',\n  })\n  @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\n  @ApiQuery({\n    name: 'returnUrl',\n    description: 'Url di ritorno della pagina',\n    required: false,\n  })\n  @ApiResponse({ status: 200, description: 'Pagina di reset password servita con successo' })\n  @Get('reset-password-page/:token')\n  async serveResetPasswordPage(\n    @Res() res: Response,\n    @Param('token') _token: string,\n    @Query('returnUrl') _returnUrl?: string,\n  ) {\n    return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n  }\n\n  @ApiOperation({\n    summary: 'Invia una e-mail per il reset della password',\n    operationId: 'sendPasswordResetEmail',\n  })\n  @ApiBody({ type: SendResetPasswordEmailRequest })\n  @ApiResponse({\n    status: 200,\n    description: \"L'email di reset e stata gestita con successo\",\n    type: ActionResponse,\n  })\n  @ApiResponse({\n    status: 500,\n    description: \"Errore interno durante l'invio dell'email\",\n    type: ErrorResponse,\n  })\n  @Post('send-reset-password-email')\n  async sendPasswordResetEmail(\n    @Req() request: Request,\n    @Body() sendResetPasswordData: SendResetPasswordEmailRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.accessiOptions,\n        'passwordResetEmail',\n        request,\n        [sendResetPasswordData?.email],\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      await this.emailService.sendPasswordResetEmail(sendResetPasswordData.email);\n      return RestUtilities.sendOKMessage(\n        res,\n        \"Se l'account esiste, l'email di reset e stata inoltrata al destinatario.\",\n      );\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, EmailController.name);\n    }\n  }\n}\n"]}
+{"version":3,"file":"EmailController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/EmailController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6F;AAC7F,6CAAkG;AAElG,+BAA4B;AAC5B,+CAAgD;AAEhD,kCAAuF;AACvF,wEAAqE;AACrE,yEAGyC;AAKlC,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,YAC8C,cAA8B,EACzD,YAA0B;QADC,mBAAc,GAAd,cAAc,CAAgB;QACzD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAcE,sBAAsB,CACnB,GAAa,EACJ,MAAc,EACV,UAAmB;;YAEvC,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAkBK,sBAAsB,CACnB,OAAgB,EACf,qBAAoD,EACrD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,OAAO,EACP,CAAC,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,KAAK,CAAC,CAC/B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAC5E,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,iBAAe,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAnEY,0CAAe;AAkBpB;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,wBAAwB;KACtC,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,6BAA6B;QAC1C,QAAQ,EAAE,KAAK;KAChB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IAC1F,IAAA,YAAG,EAAC,4BAA4B,CAAC;IAE/B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;;;;6DAGpB;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,wBAAwB;KACtC,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,oCAA6B,EAAE,CAAC;IAChD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,qBAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,2BAA2B,CAAC;IAE/B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADyB,oCAA6B;;6DAsB7D;0BAlEU,eAAe;IAH3B,IAAA,iBAAO,EAAC,OAAO,CAAC;IAChB,IAAA,mBAAU,EAAC,eAAe,CAAC;IAC5B,8FAA8F;;IAGzF,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,eAAe,CAmE3B","sourcesContent":["import { Body, Controller, Get, Inject, Param, Post, Query, Req, Res } from '@nestjs/common';\nimport { ApiBody, ApiOperation, ApiParam, ApiQuery, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { join } from 'path';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse, SendResetPasswordEmailRequest } from '../Dtos';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n@ApiTags('Email')\n@Controller('accessi/email')\n/** Endpoint pubblici del ciclo reset password; le risposte non rivelano se l'email esiste. */\nexport class EmailController {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly emailService: EmailService,\n  ) {}\n\n  @ApiOperation({\n    summary: 'Serve una pagina per il reset della password',\n    operationId: 'serveResetPasswordPage',\n  })\n  @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\n  @ApiQuery({\n    name: 'returnUrl',\n    description: 'Url di ritorno della pagina',\n    required: false,\n  })\n  @ApiResponse({ status: 200, description: 'Pagina di reset password servita con successo' })\n  @Get('reset-password-page/:token')\n  async serveResetPasswordPage(\n    @Res() res: Response,\n    @Param('token') _token: string,\n    @Query('returnUrl') _returnUrl?: string,\n  ) {\n    return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n  }\n\n  @ApiOperation({\n    summary: 'Invia una e-mail per il reset della password',\n    operationId: 'sendPasswordResetEmail',\n  })\n  @ApiBody({ type: SendResetPasswordEmailRequest })\n  @ApiResponse({\n    status: 200,\n    description: \"L'email di reset e stata gestita con successo\",\n    type: ActionResponse,\n  })\n  @ApiResponse({\n    status: 500,\n    description: \"Errore interno durante l'invio dell'email\",\n    type: ErrorResponse,\n  })\n  @Post('send-reset-password-email')\n  async sendPasswordResetEmail(\n    @Req() request: Request,\n    @Body() sendResetPasswordData: SendResetPasswordEmailRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const rateLimitDecision = await checkPublicAuthRateLimit(\n        this.accessiOptions,\n        'passwordResetEmail',\n        request,\n        [sendResetPasswordData?.email],\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      await this.emailService.sendPasswordResetEmail(sendResetPasswordData.email);\n      return RestUtilities.sendOKMessage(\n        res,\n        \"Se l'account esiste, l'email di reset e stata inoltrata al destinatario.\",\n      );\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, EmailController.name);\n    }\n  }\n}\n"]}

package/dist/accessi-module/Controllers/UserController.js

@@ -235,7 +235,7 @@ let UserController = UserController_1 = class UserController {
                 if (((_a = this.accessiOptions.publicRegistration) === null || _a === void 0 ? void 0 : _a.enabled) !== true) {
                     throw new common_1.HttpException('La registrazione pubblica e disabilitata. Un amministratore deve creare l utente.', common_1.HttpStatus.FORBIDDEN);
                 }
-                const rateLimitDecision = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.accessiOptions, 'register', request, [registrationData === null || registrationData === void 0 ? void 0 : registrationData.email]);
+                const rateLimitDecision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.accessiOptions, 'register', request, [registrationData === null || registrationData === void 0 ? void 0 : registrationData.email]);
                 if (!rateLimitDecision.allowed) {
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
                 }

package/dist/accessi-module/Controllers/UserController.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAoBwB;AAExB,6CASyB;AACzB,+BAA4B;AAC5B,yCAAsC;AACtC,+CAAgD;AAEhD,uDAAqE;AACrE,+DAA4D;AAC5D,qDAAsE;AACtE,yEAAsE;AACtE,+DAA4D;AAC5D,6DAA0D;AAC1D,yEAAyE;AACzE,2EAAwE;AACxE,6CAA0C;AAC1C,qEAAkE;AAClE,wEAAqE;AACrE,qEAAkE;AAClE,sDAAqD;AACrD,yEAGyC;AACzC,6DAQmC;AAEnC,uEAAuE;AACvE,iDAAsD;AACtD,mEAAgE;AAQzD,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YAC6B,cAA+C,EACzD,WAAwB,EACxB,YAA0B,EAC1B,WAAwB;QAHG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAa;QAN1B,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAOvD,CAAC;IAEI,mBAAmB,CAAC,GAAa,EAAE,KAAc;QACvD,gFAAgF;QAChF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACW,sBAAsB,CAClC,KAA+B,EAC/B,YAAoB;;YAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAAiB,CAAC,4BAA4B,YAAY,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,IAAA,yCAAyB,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAYK,sBAAsB,CAAQ,GAAa,EAAkB,MAAc;;YAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAqDK,QAAQ,CACL,OAAgB,EAChB,GAAa,EACJ,KAAc,EAC+B,YAAqB,EAElF,sBAAgC,EAEhC,aAAuB,EAC+B,KAAc,EACb,MAAe;;YAEtE,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,wDAAwD,CACzD,CAAC;gBAEF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG;oBACd,sBAAsB,EAAE,sBAAsB,aAAtB,sBAAsB,cAAtB,sBAAsB,GAAI,IAAI;oBACtD,aAAa,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,IAAI;iBACrC,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAuBK,UAAU,CACP,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAqBK,qBAAqB,CAClB,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,2BAAW,EACT,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;gBAEF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,4BAAmB,CAAC,0DAA0D,CAAC,CAAC;gBAC5F,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAcK,kBAAkB,CACf,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,qCAAqC,YAAY,GAAG,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAYK,wBAAwB,CAAQ,OAAgB,EAAS,GAAa;;YAC1E,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oCAAoC,EAAE,CAAC;gBAC3E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,IAAI,8BAA8B,CAAC,CAAC;YAC1G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAiBK,gBAAgB,CACb,OAAgB,EACc,YAAoB,EACjD,IAAoB,EACrB,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;gBACF,iFAAiF;gBACjF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,IAAA,yBAAe,EAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAE/E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,iBAAiB,CAAC,YAAY,YAAY,YAAY,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CACtH,CAAC;gBAEF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE;oBACzC,QAAQ;oBACR,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,gBAAgB;oBAChB,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAeK,eAAe,CACZ,OAAgB,EACc,YAAoB,EACjD,IAA4B,EAC7B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,qEAAqE,CACtE,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACnE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,wBAAwB,YAAY,cAAc,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAyBK,qBAAqB,CAClB,OAAgB,EACf,IAA8B,EAC/B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;gBAEF,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;gBAClD,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;gBACvF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,kBAAkB,KAAK,uCAAkB,CAAC,MAAM;uBAC7D,kBAAkB,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBACrD,IAAI,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,wBAAwB,YAAY,0BAA0B,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,QAAQ,CACL,OAAgB,EACf,gBAAuC,EACxC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,kBAAkB,0CAAE,OAAO,MAAK,IAAI,EAAE,CAAC;oBAC7D,MAAM,IAAI,sBAAa,CACrB,mFAAmF,EACnF,mBAAU,CAAC,SAAS,CACrB,CAAC;gBACJ,CAAC;gBAED,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,cAAc,EACnB,UAAU,EACV,OAAO,EACP,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,KAAK,CAAC,CAC1B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,KAAK;iBAC7B,CAAC,CAAC;gBAEH,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACrK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,2DAA2D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,uBAAuB;qBACjK,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GACV,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAAC;gBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;IAQK,iBAAiB,CAAQ,OAAgB,EAAU,gBAAiC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;gBAC1F,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;gBAEhE,wEAAwE;gBACxE,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACpG,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,qFAAqF;oBACrF,iEAAiE;oBACjE,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACjK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,0DAA0D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,oEAAoE;qBAC7M,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,YAAY,CACT,OAAgB,EACc,YAAoB,EACjD,IAAa,EACd,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,kBAAkB,GAAG,IAAA,wCAAwB,EAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,KAAK,YAAY,CAAC;gBAE/D,mFAAmF;gBACnF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,IAAI,kBAAkB,EAAE,CAAC;oBACvB,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,iFAAiF,CAClF,CAAC;oBACF,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;oBACpD,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;wBAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,sCAAsC,CACvC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBAC1E,MAAM,IAAI,4BAAmB,CAAC,6DAA6D,CAAC,CAAC;gBAC/F,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE;oBACpD,sBAAsB,EAAE,iBAAiB,CAAC,SAAS,IAAI,iBAAiB,CAAC,SAAS;iBACnF,CAAC,CAAC;gBAEH,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,YAAY,YAAY,oCAAoC,CAC7D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAsBK,OAAO,CACJ,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,6CAA6C,CAC9C,CAAC;gBACF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,YAAY,wBAAwB,CAAC,CAAC;YAC5F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA5oBY,wCAAc;AA0CnB;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,4BAA4B;KAC1C,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,YAAG,EAAC,uBAAuB,CAAC;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;4DAEjE;AAqDK;IAnDL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8BAA8B;QAC3C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+DAA+D;QAC5E,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4CAA4C;QACzD,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,WAAW,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3D,WAAA,IAAA,cAAK,EAAC,wBAAwB,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEtE,WAAA,IAAA,cAAK,EAAC,eAAe,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE7D,WAAA,IAAA,cAAK,EAAC,OAAO,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;;;;8CAsBvD;AAuBK;IArBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,qEAAqE;KACnF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,2BAA2B,CAAC;IAEjC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gDAmBP;AAqBK;IAnBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,2FAA2F;KACzG,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gEAAgE;QAC7E,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,qCAAqC,CAAC;IAE3C,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAuBP;AAcK;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,yHAAyH;KACvI,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,oCAAoC,CAAC;IAExC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAcP;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kEAAkE;QAC3E,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,+JAA+J;KAC7K,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,6BAA6B,CAAC;IACJ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAW7D;AAiBK;IAfL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0DAA0D;QACnE,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EACT,4XAA4X;KAC/X,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAc,EAAE,CAAC;IACjC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,6BAAe,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,wBAAwB,CAAC;IAE5B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,4BAAc;;sDAkC7B;AAeK;IAbL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,6GAA6G;KAC3H,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,+CAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACtF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACrF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAEhC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,+CAAsB;;qDAgBrC;AAyBK;IAvBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EAAE,uBAAuB;KACrC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,gDAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,WAAW,CAAC;IAEf,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,gDAAwB;;2DA+BvC;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,8IAA8I;QAC3J,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,6CAAqB;QAC3B,WAAW,EAAE,iDAAiD;KAC/D,CAAC;IACD,IAAA,4BAAkB,EAAC;QAClB,WAAW,EACT,kGAAkG;QACpG,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,WAAW;QAC9B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,qBAAqB;QACxC,WAAW,EAAE,sEAAsE;QACnF,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,UAAU,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADoB,6CAAqB;;8CA8ChD;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;IAC5N,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAAe,EAAE,CAAC;IAClC,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,mCAAgB,EAAE,CAAC;IAC9C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,qBAAqB,CAAC;IACH,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAqC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAvB,iCAAe;;uDA6BzF;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,cAAc;KAC5B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,iBAAO;QACb,WAAW,EAAE,6BAA6B;KAC3C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,EAAE;QACrB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAE9B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,iBAAO;;kDA6CtB;AAsBK;IApBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,SAAS;KACvB,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,cAAK,EAAC,wBAAwB,CAAC;IAE7B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6CAkBP;yBA3oBU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAKE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACV,2BAAY;QACb,yBAAW;GAPhC,cAAc,CA4oB1B","sourcesContent":["import {\n  BadRequestException,\n  Body,\n  Controller,\n  Delete,\n  Get,\n  HttpException,\n  HttpStatus,\n  NotFoundException,\n  Param,\n  ParseBoolPipe,\n  ParseIntPipe,\n  Patch,\n  Post,\n  Put,\n  Query,\n  Inject,\n  Req,\n  Res,\n  UseGuards,\n} from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiCreatedResponse,\n  ApiOperation,\n  ApiParam,\n  ApiQuery,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { join } from 'path';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { GetUsersResponse } from '../Dtos/GetUsersResponse';\nimport { LoginAsRequest, LoginAsResponse } from '../Dtos/LoginAsDtos';\nimport { PublicRegisterRequest } from '../Dtos/PublicRegisterRequest';\nimport { RegisterResponse } from '../Dtos/RegisterResponse';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { SetStatoRegistrazioneDto } from '../Dtos/SetStatoRegistrazione';\nimport { SetUserPasswordRequest } from '../Dtos/SetUserPasswordRequest';\nimport { UserDto } from '../Dtos/UserDto';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\nimport {\n  ensureAdmin,\n  ensureCanManageTargetUser,\n  ensurePrivilegeFlagChanges,\n  ensureSelfOrSuperUser,\n  ensureUserManagement,\n  getAuthenticatedAccessiUser,\n  hasPrivilegedUserChanges,\n} from '../security/accessControl';\nimport type { AuthenticatedAccessiUser } from '../security/accessControl';\nimport { assertEmailConfigured } from '../security/emailConfiguration';\nimport { buildLoginAsUrl } from '../security/loginAs';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\n\n@ApiTags('User')\n@Controller('accessi/user')\n/**\n * Gestione utenti: la registrazione pubblica e opt-in, mentre creazione, stato e profili privilegiati\n * richiedono un superutente Accessi. Le API restituiscono sempre il wrapper `BaseResponse` storico.\n */\nexport class UserController {\n  private readonly logger = new Logger(UserController.name);\n\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly userService: UserService,\n    private readonly emailService: EmailService,\n    private readonly authService: AuthService,\n  ) {}\n\n  private sendControllerError(res: Response, error: unknown) {\n    // Lo status viene derivato centralmente da RestUtilities (HttpException o 500).\n    return RestUtilities.sendErrorMessage(res, error, UserController.name);\n  }\n\n  /**\n   * Verifica che il target esista e che l'attore possa gestirlo (rango attore >=\n   * rango target: ADMIN > SUPER > utente). Restituisce lo snapshot corrente del\n   * target, così i chiamanti possono controllare se e' admin.\n   */\n  private async ensureManageableTarget(\n    actor: AuthenticatedAccessiUser,\n    codiceUtente: number,\n  ) {\n    const target = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!target) {\n      throw new NotFoundException(`Nessun utente con codice ${codiceUtente}.`);\n    }\n    ensureCanManageTargetUser(actor, target);\n    return target;\n  }\n\n  @ApiOperation({\n    summary: 'Serve la pagina di reset password',\n    operationId: 'serveResetPasswordPageUser',\n  })\n  @ApiParam({\n    name: 'token',\n    description: 'Token per il reset della password',\n    required: true,\n  })\n  @Get('reset-password/:token')\n  async serveResetPasswordPage(@Res() res: Response, @Param('token') _token: string) {\n    return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n  }\n\n  @ApiOperation({\n    summary: 'Recupera la lista degli utenti',\n    operationId: 'getUsers',\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Lista utenti recuperata con successo',\n    type: GetUsersResponse,\n  })\n  @ApiResponse({ status: 401, description: 'Credenziali non valide', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiQuery({\n    name: 'email',\n    required: false,\n    description: \"Email dell'utente da cercare\",\n    type: String,\n  })\n  @ApiQuery({\n    name: 'codiceUtente',\n    required: false,\n    description: \"Codice dell'utente da cercare\",\n    type: Number,\n  })\n  @ApiQuery({\n    name: 'includeExtensionFields',\n    required: false,\n    description: 'Includi extension fields',\n    type: Boolean,\n  })\n  @ApiQuery({\n    name: 'includeGrants',\n    required: false,\n    description: 'Includi permessi',\n    type: Boolean,\n  })\n  @ApiQuery({\n    name: 'limit',\n    required: false,\n    description: 'Numero massimo di utenti restituiti (1-1000). Omesso = tutti.',\n    type: Number,\n  })\n  @ApiQuery({\n    name: 'offset',\n    required: false,\n    description: 'Numero di utenti da saltare (paginazione).',\n    type: Number,\n  })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Get('get-users')\n  async getUsers(\n    @Req() request: Request,\n    @Res() res: Response,\n    @Query('email') email?: string,\n    @Query('codiceUtente', new ParseIntPipe({ optional: true })) codiceUtente?: number,\n    @Query('includeExtensionFields', new ParseBoolPipe({ optional: true }))\n    includeExtensionFields?: boolean,\n    @Query('includeGrants', new ParseBoolPipe({ optional: true }))\n    includeGrants?: boolean,\n    @Query('limit', new ParseIntPipe({ optional: true })) limit?: number,\n    @Query('offset', new ParseIntPipe({ optional: true })) offset?: number,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono consultare gli utenti.',\n      );\n\n      const filters = { email, codiceUtente, limit, offset };\n      const options = {\n        includeExtensionFields: includeExtensionFields ?? true,\n        includeGrants: includeGrants ?? true,\n      };\n\n      const users = await this.userService.getUsers(filters, options);\n      const total = await this.userService.countUsers({ email, codiceUtente });\n      res.setHeader('X-Total-Count', String(total));\n      return RestUtilities.sendBaseResponse(res, users);\n    } catch (error) {\n      this.logger.error('Errore durante il recupero degli utenti: ', error);\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Elimina un utente',\n    operationId: 'deleteUser',\n    description: 'Imposta lo stato di un utente a eliminato senza rimuovere i record.',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da eliminare\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({ status: 200, description: 'Utente eliminato con successo', type: ActionResponse })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nei parametri della richiesta',\n    type: ErrorResponse,\n  })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Delete('delete-user/:codiceUtente')\n  async deleteUser(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(\n        authenticatedUser,\n        'Solo gli amministratori possono eliminare utenti.',\n      );\n\n      const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      if (target.flagAdmin) {\n        await this.userService.assertNotLastActiveAdmin(codiceUtente);\n      }\n\n      await this.userService.deleteUser(codiceUtente);\n      return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato con successo.\");\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Elimina definitivamente un utente',\n    operationId: 'deleteUserPermanently',\n    description: 'Rimuove l utente e tutti i record collegati. Operazione distruttiva riservata agli admin.',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da eliminare definitivamente\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({ status: 200, description: 'Utente eliminato definitivamente', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Errore nei parametri della richiesta', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Delete('delete-user-permanent/:codiceUtente')\n  async deleteUserPermanently(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureAdmin(\n        authenticatedUser,\n        'Solo gli admin possono eliminare definitivamente un utente.',\n      );\n\n      if (authenticatedUser.codiceUtente === codiceUtente) {\n        throw new BadRequestException('Non puoi eliminare definitivamente il tuo stesso utente.');\n      }\n\n      const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      if (target.flagAdmin) {\n        await this.userService.assertNotLastActiveAdmin(codiceUtente);\n      }\n\n      await this.userService.deleteUserPermanently(codiceUtente);\n      return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato definitivamente.\");\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Forza l invio dell email di reset password a un utente',\n    operationId: 'forcePasswordReset',\n    description: 'Riservato al superutente. Richiede un servizio email configurato; altrimenti risponde con ACCESSI_EMAIL_NOT_CONFIGURED.',\n  })\n  @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n  @ApiResponse({ status: 200, description: 'Email di reset inviata', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n  @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('force-password-reset/:codiceUtente')\n  async forcePasswordReset(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(\n        authenticatedUser,\n        'Solo gli amministratori possono forzare il reset password.',\n      );\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      await this.userService.forcePasswordReset(codiceUtente);\n      return RestUtilities.sendOKMessage(res, `Email di reset inviata all utente ${codiceUtente}.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Forza il reset password per tutti gli utenti con password legacy',\n    operationId: 'forcePasswordResetLegacy',\n    description: 'Riservato al superutente. Invia l email di reset a tutti gli utenti la cui password non e ancora nel formato moderno. Richiede un servizio email configurato.',\n  })\n  @ApiResponse({ status: 200, description: 'Email di reset inviate', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('force-password-reset-legacy')\n  async forcePasswordResetLegacy(@Req() request: Request, @Res() res: Response) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono forzare il reset password.',\n      );\n      const sent = await this.userService.forcePasswordResetForLegacyPasswords();\n      return RestUtilities.sendOKMessage(res, `Email di reset inviata a ${sent} utenti con password legacy.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Genera un URL di accesso temporaneo come un altro utente',\n    operationId: 'createLoginAsUrl',\n    description:\n      'Riservato a superutenti e admin (con la gerarchia ADMIN > SUPER). Genera un token per l utente target, con la stessa durata della sessione Accessi standard (jwtOptions.expiresIn), e lo allega all URL indicato come query parameter loginAsToken. Il token e una credenziale: non condividerlo e non registrarlo. Da quel momento l applicazione di destinazione decide come consumarlo.',\n  })\n  @ApiParam({ name: 'codiceUtente', description: 'Utente da impersonare', required: true, example: 123, type: Number })\n  @ApiBody({ type: LoginAsRequest })\n  @ApiResponse({ status: 200, description: 'URL di accesso temporaneo generato', type: LoginAsResponse })\n  @ApiResponse({ status: 400, description: 'URL non valido', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('login-as/:codiceUtente')\n  async createLoginAsUrl(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Body() body: LoginAsRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(\n        authenticatedUser,\n        'Solo superutenti e admin possono generare un accesso temporaneo.',\n      );\n      // Stessa gerarchia della gestione utenti: un superutente non impersona un admin.\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n      const loginResult = await this.authService.getLoginResultForUser(codiceUtente);\n      const issued = this.authService.createLoginAsToken(loginResult.utente, authenticatedUser);\n      const loginUrl = buildLoginAsUrl(body?.url, issued.value);\n      const expiresInSeconds = Number(issued.expiresIn);\n      if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {\n        throw new Error('Token Login as emesso senza una scadenza valida.');\n      }\n      const expiresAt = new Date(Date.now() + expiresInSeconds * 1000).toISOString();\n\n      this.logger.info(\n        `Login as generato: attore=${authenticatedUser.codiceUtente}, target=${codiceUtente}, host=${new URL(loginUrl).host}`,\n      );\n\n      return RestUtilities.sendBaseResponse(res, {\n        loginUrl,\n        token: issued.value,\n        expiresInSeconds,\n        expiresAt,\n      });\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta direttamente la password di un utente',\n    operationId: 'setUserPassword',\n    description: 'Riservato agli amministratori. Hasha la password, aggiorna la scadenza secondo la policy e non invia email.',\n  })\n  @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n  @ApiBody({ type: SetUserPasswordRequest })\n  @ApiResponse({ status: 200, description: 'Password aggiornata', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Password non valida', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('set-password/:codiceUtente')\n  async setUserPassword(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Body() body: SetUserPasswordRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(\n        authenticatedUser,\n        'Solo gli amministratori possono impostare la password di un utente.',\n      );\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n      await this.authService.setPassword(codiceUtente, body.newPassword);\n      return RestUtilities.sendOKMessage(res, `Password dell utente ${codiceUtente} aggiornata.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta lo stato di registrazione di un utente',\n    operationId: 'setStatoRegistrazione',\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Stato registrazione aggiornato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nei parametri della richiesta',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: 500,\n    description: 'Errore interno del server',\n    type: ErrorResponse,\n  })\n  @ApiBody({ type: SetStatoRegistrazioneDto })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('set-stato')\n  async setStatoRegistrazione(\n    @Req() request: Request,\n    @Body() body: SetStatoRegistrazioneDto,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(\n        authenticatedUser,\n        'Solo gli amministratori possono modificare lo stato di registrazione.',\n      );\n\n      const { codiceUtente, statoRegistrazione } = body;\n      if (!codiceUtente) throw new BadRequestException('Il codice utente e\\' obbligatorio.');\n      if (statoRegistrazione === undefined) {\n        throw new BadRequestException('Lo stato registrazione e\\' obbligatorio.');\n      }\n\n      const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      const disabling = statoRegistrazione === StatoRegistrazione.DELETE\n        || statoRegistrazione === StatoRegistrazione.BLOCC;\n      if (target.flagAdmin && disabling) {\n        await this.userService.assertNotLastActiveAdmin(codiceUtente);\n      }\n\n      await this.userService.setStato(codiceUtente, statoRegistrazione);\n      return RestUtilities.sendOKMessage(\n        res,\n        `Lo stato dell'utente ${codiceUtente} e' stato aggiornato a ${statoRegistrazione}.`,\n      );\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Registra un nuovo utente',\n    description: 'Disponibile soltanto quando publicRegistration.enabled e true. Per utenti SSO usare il provisioning master nel tag Federated authentication.',\n    operationId: 'register',\n  })\n  @ApiBody({\n    type: PublicRegisterRequest,\n    description: \"Dati necessari per la registrazione dell'utente\",\n  })\n  @ApiCreatedResponse({\n    description:\n      'Utente registrato con successo. Restituisce il codice utente e invia una mail di reset password.',\n    type: RegisterResponse,\n  })\n  @ApiResponse({\n    status: HttpStatus.BAD_REQUEST,\n    description: 'Errore nella registrazione.',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: HttpStatus.INTERNAL_SERVER_ERROR,\n    description: 'Errore interno del server durante la registrazione o l\\'invio email.',\n    type: ErrorResponse,\n  })\n  @Post('register')\n  async register(\n    @Req() request: Request,\n    @Body() registrationData: PublicRegisterRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      if (this.accessiOptions.publicRegistration?.enabled !== true) {\n        throw new HttpException(\n          'La registrazione pubblica e disabilitata. Un amministratore deve creare l utente.',\n          HttpStatus.FORBIDDEN,\n        );\n      }\n\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.accessiOptions,\n        'register',\n        request,\n        [registrationData?.email],\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      assertEmailConfigured(this.accessiOptions);\n\n      const codiceUtente = await this.userService.register(registrationData, {\n        allowPrivilegedFields: false,\n      });\n\n      try {\n        await this.emailService.sendPasswordResetEmail(registrationData.email);\n      } catch (emailError) {\n        try {\n          await this.userService.deleteUserPermanently(codiceUtente);\n        } catch (rollbackError) {\n          this.logger.error(`Rollback registrazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n        }\n        throw new BadRequestException({\n          code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n          message: `Registrazione non completata: invio email non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova piu tardi.`,\n        });\n      }\n      return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n    } catch (error) {\n      const status =\n        error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST;\n      return RestUtilities.sendErrorMessage(res, error, UserController.name, status);\n    }\n  }\n\n  @ApiOperation({ summary: 'Crea un utente locale da amministrazione', operationId: 'createManagedUser', description: 'Riservato a superutente. Crea un utente in attesa di impostazione password e invia la mail di reset.' })\n  @ApiBody({ type: RegisterRequest })\n  @ApiCreatedResponse({ type: RegisterResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('create-managed-user')\n  async createManagedUser(@Req() request: Request, @Body() registrationData: RegisterRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono creare utenti.');\n      ensurePrivilegeFlagChanges(authenticatedUser, registrationData);\n\n      // Fail-fast prima di scrivere: senza SMTP non si crea un utente orfano.\n      assertEmailConfigured(this.accessiOptions);\n\n      const codiceUtente = await this.userService.register(registrationData, { allowPrivilegedFields: true });\n      try {\n        await this.emailService.sendPasswordResetEmail(registrationData.email, registrationData.htmlMail);\n      } catch (emailError) {\n        // L'invio e' esterno: se fallisce annulliamo la creazione per non lasciare un utente\n        // senza password e senza email di invito (rollback best-effort).\n        try {\n          await this.userService.deleteUserPermanently(codiceUtente);\n        } catch (rollbackError) {\n          this.logger.error(`Rollback creazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n        }\n        throw new BadRequestException({\n          code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n          message: `Utente non creato: invio email di invito non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova oppure crea l utente e imposta la password manualmente.`,\n        });\n      }\n      return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Aggiorna un utente esistente',\n    operationId: 'updateUtente',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da aggiornare\",\n    required: true,\n    example: 123,\n  })\n  @ApiBody({\n    type: UserDto,\n    description: \"Dati aggiornati dell'utente\",\n  })\n  @ApiResponse({\n    status: HttpStatus.OK,\n    description: 'Utente aggiornato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({ status: 400, description: \"Errore nell'aggiornamento\", type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Put('update-user/:codiceUtente')\n  async updateUtente(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Body() user: UserDto,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      const isPrivilegedUpdate = hasPrivilegedUserChanges(user);\n      const isSelf = authenticatedUser.codiceUtente === codiceUtente;\n\n      // ADMIN > SUPER: un superutente non puo' toccare un admin. Self sempre consentito.\n      if (!isSelf) {\n        await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      }\n\n      if (isPrivilegedUpdate) {\n        ensureUserManagement(\n          authenticatedUser,\n          'Solo gli amministratori possono modificare ruoli, permessi o flag privilegiati.',\n        );\n        ensurePrivilegeFlagChanges(authenticatedUser, user);\n        if (user.flagAdmin === false) {\n          await this.userService.assertNotLastActiveAdmin(codiceUtente);\n        }\n      } else {\n        ensureSelfOrSuperUser(\n          authenticatedUser,\n          codiceUtente,\n          'Puoi modificare solo il tuo profilo.',\n        );\n      }\n\n      if (user.codiceUtente !== undefined && user.codiceUtente !== codiceUtente) {\n        throw new BadRequestException('Il codice utente nel body non coincide con quello del path.');\n      }\n\n      await this.userService.updateUser(codiceUtente, user, {\n        allowPrivilegedChanges: authenticatedUser.flagSuper || authenticatedUser.flagAdmin,\n      });\n\n      return RestUtilities.sendOKMessage(\n        res,\n        `L'utente ${codiceUtente} e' stato aggiornato con successo.`,\n      );\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta il consenso GDPR per un utente',\n    operationId: 'setGdpr',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente che accetta il GDPR\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Consenso GDPR impostato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({ status: 400, description: 'Errore nella richiesta', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Patch('set-gdpr/:codiceUtente')\n  async setGdpr(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureSelfOrSuperUser(\n        authenticatedUser,\n        codiceUtente,\n        'Puoi impostare il GDPR solo sul tuo utente.',\n      );\n      if (authenticatedUser.codiceUtente !== codiceUtente) {\n        await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      }\n\n      await this.userService.setGdpr(codiceUtente);\n      return RestUtilities.sendOKMessage(res, `L'utente ${codiceUtente} ha accettato il GDPR.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n}\n"]}
+{"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAoBwB;AAExB,6CASyB;AACzB,+BAA4B;AAC5B,yCAAsC;AACtC,+CAAgD;AAEhD,uDAAqE;AACrE,+DAA4D;AAC5D,qDAAsE;AACtE,yEAAsE;AACtE,+DAA4D;AAC5D,6DAA0D;AAC1D,yEAAyE;AACzE,2EAAwE;AACxE,6CAA0C;AAC1C,qEAAkE;AAClE,wEAAqE;AACrE,qEAAkE;AAClE,sDAAqD;AACrD,yEAGyC;AACzC,6DAQmC;AAEnC,uEAAuE;AACvE,iDAAsD;AACtD,mEAAgE;AAQzD,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YAC6B,cAA+C,EACzD,WAAwB,EACxB,YAA0B,EAC1B,WAAwB;QAHG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAa;QAN1B,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAOvD,CAAC;IAEI,mBAAmB,CAAC,GAAa,EAAE,KAAc;QACvD,gFAAgF;QAChF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACW,sBAAsB,CAClC,KAA+B,EAC/B,YAAoB;;YAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAAiB,CAAC,4BAA4B,YAAY,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,IAAA,yCAAyB,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAYK,sBAAsB,CAAQ,GAAa,EAAkB,MAAc;;YAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAqDK,QAAQ,CACL,OAAgB,EAChB,GAAa,EACJ,KAAc,EAC+B,YAAqB,EAElF,sBAAgC,EAEhC,aAAuB,EAC+B,KAAc,EACb,MAAe;;YAEtE,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,wDAAwD,CACzD,CAAC;gBAEF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG;oBACd,sBAAsB,EAAE,sBAAsB,aAAtB,sBAAsB,cAAtB,sBAAsB,GAAI,IAAI;oBACtD,aAAa,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,IAAI;iBACrC,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAuBK,UAAU,CACP,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAqBK,qBAAqB,CAClB,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,2BAAW,EACT,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;gBAEF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,4BAAmB,CAAC,0DAA0D,CAAC,CAAC;gBAC5F,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAcK,kBAAkB,CACf,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,qCAAqC,YAAY,GAAG,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAYK,wBAAwB,CAAQ,OAAgB,EAAS,GAAa;;YAC1E,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oCAAoC,EAAE,CAAC;gBAC3E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,IAAI,8BAA8B,CAAC,CAAC;YAC1G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAiBK,gBAAgB,CACb,OAAgB,EACc,YAAoB,EACjD,IAAoB,EACrB,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;gBACF,iFAAiF;gBACjF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,IAAA,yBAAe,EAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAE/E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,iBAAiB,CAAC,YAAY,YAAY,YAAY,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CACtH,CAAC;gBAEF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE;oBACzC,QAAQ;oBACR,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,gBAAgB;oBAChB,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAeK,eAAe,CACZ,OAAgB,EACc,YAAoB,EACjD,IAA4B,EAC7B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,qEAAqE,CACtE,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACnE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,wBAAwB,YAAY,cAAc,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAyBK,qBAAqB,CAClB,OAAgB,EACf,IAA8B,EAC/B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;gBAEF,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;gBAClD,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;gBACvF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,kBAAkB,KAAK,uCAAkB,CAAC,MAAM;uBAC7D,kBAAkB,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBACrD,IAAI,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,wBAAwB,YAAY,0BAA0B,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,QAAQ,CACL,OAAgB,EACf,gBAAuC,EACxC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,kBAAkB,0CAAE,OAAO,MAAK,IAAI,EAAE,CAAC;oBAC7D,MAAM,IAAI,sBAAa,CACrB,mFAAmF,EACnF,mBAAU,CAAC,SAAS,CACrB,CAAC;gBACJ,CAAC;gBAED,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,cAAc,EACnB,UAAU,EACV,OAAO,EACP,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,KAAK,CAAC,CAC1B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,KAAK;iBAC7B,CAAC,CAAC;gBAEH,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACrK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,2DAA2D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,uBAAuB;qBACjK,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GACV,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAAC;gBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;IAQK,iBAAiB,CAAQ,OAAgB,EAAU,gBAAiC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;gBAC1F,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;gBAEhE,wEAAwE;gBACxE,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACpG,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,qFAAqF;oBACrF,iEAAiE;oBACjE,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACjK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,0DAA0D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,oEAAoE;qBAC7M,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,YAAY,CACT,OAAgB,EACc,YAAoB,EACjD,IAAa,EACd,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,kBAAkB,GAAG,IAAA,wCAAwB,EAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,KAAK,YAAY,CAAC;gBAE/D,mFAAmF;gBACnF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,IAAI,kBAAkB,EAAE,CAAC;oBACvB,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,iFAAiF,CAClF,CAAC;oBACF,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;oBACpD,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;wBAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,sCAAsC,CACvC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBAC1E,MAAM,IAAI,4BAAmB,CAAC,6DAA6D,CAAC,CAAC;gBAC/F,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE;oBACpD,sBAAsB,EAAE,iBAAiB,CAAC,SAAS,IAAI,iBAAiB,CAAC,SAAS;iBACnF,CAAC,CAAC;gBAEH,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,YAAY,YAAY,oCAAoC,CAC7D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAsBK,OAAO,CACJ,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,6CAA6C,CAC9C,CAAC;gBACF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,YAAY,wBAAwB,CAAC,CAAC;YAC5F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA5oBY,wCAAc;AA0CnB;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,4BAA4B;KAC1C,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,YAAG,EAAC,uBAAuB,CAAC;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;4DAEjE;AAqDK;IAnDL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8BAA8B;QAC3C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+DAA+D;QAC5E,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4CAA4C;QACzD,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,WAAW,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3D,WAAA,IAAA,cAAK,EAAC,wBAAwB,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEtE,WAAA,IAAA,cAAK,EAAC,eAAe,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE7D,WAAA,IAAA,cAAK,EAAC,OAAO,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;;;;8CAsBvD;AAuBK;IArBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,qEAAqE;KACnF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,2BAA2B,CAAC;IAEjC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gDAmBP;AAqBK;IAnBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,2FAA2F;KACzG,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gEAAgE;QAC7E,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,qCAAqC,CAAC;IAE3C,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAuBP;AAcK;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,yHAAyH;KACvI,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,oCAAoC,CAAC;IAExC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAcP;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kEAAkE;QAC3E,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,+JAA+J;KAC7K,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,6BAA6B,CAAC;IACJ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAW7D;AAiBK;IAfL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0DAA0D;QACnE,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EACT,4XAA4X;KAC/X,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAc,EAAE,CAAC;IACjC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,6BAAe,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,wBAAwB,CAAC;IAE5B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,4BAAc;;sDAkC7B;AAeK;IAbL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,6GAA6G;KAC3H,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,+CAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACtF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACrF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAEhC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,+CAAsB;;qDAgBrC;AAyBK;IAvBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EAAE,uBAAuB;KACrC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,gDAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,WAAW,CAAC;IAEf,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,gDAAwB;;2DA+BvC;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,8IAA8I;QAC3J,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,6CAAqB;QAC3B,WAAW,EAAE,iDAAiD;KAC/D,CAAC;IACD,IAAA,4BAAkB,EAAC;QAClB,WAAW,EACT,kGAAkG;QACpG,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,WAAW;QAC9B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,qBAAqB;QACxC,WAAW,EAAE,sEAAsE;QACnF,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,UAAU,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADoB,6CAAqB;;8CA8ChD;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;IAC5N,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAAe,EAAE,CAAC;IAClC,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,mCAAgB,EAAE,CAAC;IAC9C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,qBAAqB,CAAC;IACH,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAqC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAvB,iCAAe;;uDA6BzF;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,cAAc;KAC5B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,iBAAO;QACb,WAAW,EAAE,6BAA6B;KAC3C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,EAAE;QACrB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAE9B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,iBAAO;;kDA6CtB;AAsBK;IApBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,SAAS;KACvB,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,cAAK,EAAC,wBAAwB,CAAC;IAE7B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6CAkBP;yBA3oBU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAKE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACV,2BAAY;QACb,yBAAW;GAPhC,cAAc,CA4oB1B","sourcesContent":["import {\n  BadRequestException,\n  Body,\n  Controller,\n  Delete,\n  Get,\n  HttpException,\n  HttpStatus,\n  NotFoundException,\n  Param,\n  ParseBoolPipe,\n  ParseIntPipe,\n  Patch,\n  Post,\n  Put,\n  Query,\n  Inject,\n  Req,\n  Res,\n  UseGuards,\n} from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiCreatedResponse,\n  ApiOperation,\n  ApiParam,\n  ApiQuery,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { join } from 'path';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { GetUsersResponse } from '../Dtos/GetUsersResponse';\nimport { LoginAsRequest, LoginAsResponse } from '../Dtos/LoginAsDtos';\nimport { PublicRegisterRequest } from '../Dtos/PublicRegisterRequest';\nimport { RegisterResponse } from '../Dtos/RegisterResponse';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { SetStatoRegistrazioneDto } from '../Dtos/SetStatoRegistrazione';\nimport { SetUserPasswordRequest } from '../Dtos/SetUserPasswordRequest';\nimport { UserDto } from '../Dtos/UserDto';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\nimport {\n  ensureAdmin,\n  ensureCanManageTargetUser,\n  ensurePrivilegeFlagChanges,\n  ensureSelfOrSuperUser,\n  ensureUserManagement,\n  getAuthenticatedAccessiUser,\n  hasPrivilegedUserChanges,\n} from '../security/accessControl';\nimport type { AuthenticatedAccessiUser } from '../security/accessControl';\nimport { assertEmailConfigured } from '../security/emailConfiguration';\nimport { buildLoginAsUrl } from '../security/loginAs';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\n\n@ApiTags('User')\n@Controller('accessi/user')\n/**\n * Gestione utenti: la registrazione pubblica e opt-in, mentre creazione, stato e profili privilegiati\n * richiedono un superutente Accessi. Le API restituiscono sempre il wrapper `BaseResponse` storico.\n */\nexport class UserController {\n  private readonly logger = new Logger(UserController.name);\n\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly userService: UserService,\n    private readonly emailService: EmailService,\n    private readonly authService: AuthService,\n  ) {}\n\n  private sendControllerError(res: Response, error: unknown) {\n    // Lo status viene derivato centralmente da RestUtilities (HttpException o 500).\n    return RestUtilities.sendErrorMessage(res, error, UserController.name);\n  }\n\n  /**\n   * Verifica che il target esista e che l'attore possa gestirlo (rango attore >=\n   * rango target: ADMIN > SUPER > utente). Restituisce lo snapshot corrente del\n   * target, così i chiamanti possono controllare se e' admin.\n   */\n  private async ensureManageableTarget(\n    actor: AuthenticatedAccessiUser,\n    codiceUtente: number,\n  ) {\n    const target = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!target) {\n      throw new NotFoundException(`Nessun utente con codice ${codiceUtente}.`);\n    }\n    ensureCanManageTargetUser(actor, target);\n    return target;\n  }\n\n  @ApiOperation({\n    summary: 'Serve la pagina di reset password',\n    operationId: 'serveResetPasswordPageUser',\n  })\n  @ApiParam({\n    name: 'token',\n    description: 'Token per il reset della password',\n    required: true,\n  })\n  @Get('reset-password/:token')\n  async serveResetPasswordPage(@Res() res: Response, @Param('token') _token: string) {\n    return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n  }\n\n  @ApiOperation({\n    summary: 'Recupera la lista degli utenti',\n    operationId: 'getUsers',\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Lista utenti recuperata con successo',\n    type: GetUsersResponse,\n  })\n  @ApiResponse({ status: 401, description: 'Credenziali non valide', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiQuery({\n    name: 'email',\n    required: false,\n    description: \"Email dell'utente da cercare\",\n    type: String,\n  })\n  @ApiQuery({\n    name: 'codiceUtente',\n    required: false,\n    description: \"Codice dell'utente da cercare\",\n    type: Number,\n  })\n  @ApiQuery({\n    name: 'includeExtensionFields',\n    required: false,\n    description: 'Includi extension fields',\n    type: Boolean,\n  })\n  @ApiQuery({\n    name: 'includeGrants',\n    required: false,\n    description: 'Includi permessi',\n    type: Boolean,\n  })\n  @ApiQuery({\n    name: 'limit',\n    required: false,\n    description: 'Numero massimo di utenti restituiti (1-1000). Omesso = tutti.',\n    type: Number,\n  })\n  @ApiQuery({\n    name: 'offset',\n    required: false,\n    description: 'Numero di utenti da saltare (paginazione).',\n    type: Number,\n  })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Get('get-users')\n  async getUsers(\n    @Req() request: Request,\n    @Res() res: Response,\n    @Query('email') email?: string,\n    @Query('codiceUtente', new ParseIntPipe({ optional: true })) codiceUtente?: number,\n    @Query('includeExtensionFields', new ParseBoolPipe({ optional: true }))\n    includeExtensionFields?: boolean,\n    @Query('includeGrants', new ParseBoolPipe({ optional: true }))\n    includeGrants?: boolean,\n    @Query('limit', new ParseIntPipe({ optional: true })) limit?: number,\n    @Query('offset', new ParseIntPipe({ optional: true })) offset?: number,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono consultare gli utenti.',\n      );\n\n      const filters = { email, codiceUtente, limit, offset };\n      const options = {\n        includeExtensionFields: includeExtensionFields ?? true,\n        includeGrants: includeGrants ?? true,\n      };\n\n      const users = await this.userService.getUsers(filters, options);\n      const total = await this.userService.countUsers({ email, codiceUtente });\n      res.setHeader('X-Total-Count', String(total));\n      return RestUtilities.sendBaseResponse(res, users);\n    } catch (error) {\n      this.logger.error('Errore durante il recupero degli utenti: ', error);\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Elimina un utente',\n    operationId: 'deleteUser',\n    description: 'Imposta lo stato di un utente a eliminato senza rimuovere i record.',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da eliminare\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({ status: 200, description: 'Utente eliminato con successo', type: ActionResponse })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nei parametri della richiesta',\n    type: ErrorResponse,\n  })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Delete('delete-user/:codiceUtente')\n  async deleteUser(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(\n        authenticatedUser,\n        'Solo gli amministratori possono eliminare utenti.',\n      );\n\n      const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      if (target.flagAdmin) {\n        await this.userService.assertNotLastActiveAdmin(codiceUtente);\n      }\n\n      await this.userService.deleteUser(codiceUtente);\n      return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato con successo.\");\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Elimina definitivamente un utente',\n    operationId: 'deleteUserPermanently',\n    description: 'Rimuove l utente e tutti i record collegati. Operazione distruttiva riservata agli admin.',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da eliminare definitivamente\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({ status: 200, description: 'Utente eliminato definitivamente', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Errore nei parametri della richiesta', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Delete('delete-user-permanent/:codiceUtente')\n  async deleteUserPermanently(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureAdmin(\n        authenticatedUser,\n        'Solo gli admin possono eliminare definitivamente un utente.',\n      );\n\n      if (authenticatedUser.codiceUtente === codiceUtente) {\n        throw new BadRequestException('Non puoi eliminare definitivamente il tuo stesso utente.');\n      }\n\n      const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      if (target.flagAdmin) {\n        await this.userService.assertNotLastActiveAdmin(codiceUtente);\n      }\n\n      await this.userService.deleteUserPermanently(codiceUtente);\n      return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato definitivamente.\");\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Forza l invio dell email di reset password a un utente',\n    operationId: 'forcePasswordReset',\n    description: 'Riservato al superutente. Richiede un servizio email configurato; altrimenti risponde con ACCESSI_EMAIL_NOT_CONFIGURED.',\n  })\n  @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n  @ApiResponse({ status: 200, description: 'Email di reset inviata', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n  @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('force-password-reset/:codiceUtente')\n  async forcePasswordReset(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(\n        authenticatedUser,\n        'Solo gli amministratori possono forzare il reset password.',\n      );\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      await this.userService.forcePasswordReset(codiceUtente);\n      return RestUtilities.sendOKMessage(res, `Email di reset inviata all utente ${codiceUtente}.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Forza il reset password per tutti gli utenti con password legacy',\n    operationId: 'forcePasswordResetLegacy',\n    description: 'Riservato al superutente. Invia l email di reset a tutti gli utenti la cui password non e ancora nel formato moderno. Richiede un servizio email configurato.',\n  })\n  @ApiResponse({ status: 200, description: 'Email di reset inviate', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('force-password-reset-legacy')\n  async forcePasswordResetLegacy(@Req() request: Request, @Res() res: Response) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono forzare il reset password.',\n      );\n      const sent = await this.userService.forcePasswordResetForLegacyPasswords();\n      return RestUtilities.sendOKMessage(res, `Email di reset inviata a ${sent} utenti con password legacy.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Genera un URL di accesso temporaneo come un altro utente',\n    operationId: 'createLoginAsUrl',\n    description:\n      'Riservato a superutenti e admin (con la gerarchia ADMIN > SUPER). Genera un token per l utente target, con la stessa durata della sessione Accessi standard (jwtOptions.expiresIn), e lo allega all URL indicato come query parameter loginAsToken. Il token e una credenziale: non condividerlo e non registrarlo. Da quel momento l applicazione di destinazione decide come consumarlo.',\n  })\n  @ApiParam({ name: 'codiceUtente', description: 'Utente da impersonare', required: true, example: 123, type: Number })\n  @ApiBody({ type: LoginAsRequest })\n  @ApiResponse({ status: 200, description: 'URL di accesso temporaneo generato', type: LoginAsResponse })\n  @ApiResponse({ status: 400, description: 'URL non valido', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('login-as/:codiceUtente')\n  async createLoginAsUrl(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Body() body: LoginAsRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(\n        authenticatedUser,\n        'Solo superutenti e admin possono generare un accesso temporaneo.',\n      );\n      // Stessa gerarchia della gestione utenti: un superutente non impersona un admin.\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n      const loginResult = await this.authService.getLoginResultForUser(codiceUtente);\n      const issued = this.authService.createLoginAsToken(loginResult.utente, authenticatedUser);\n      const loginUrl = buildLoginAsUrl(body?.url, issued.value);\n      const expiresInSeconds = Number(issued.expiresIn);\n      if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {\n        throw new Error('Token Login as emesso senza una scadenza valida.');\n      }\n      const expiresAt = new Date(Date.now() + expiresInSeconds * 1000).toISOString();\n\n      this.logger.info(\n        `Login as generato: attore=${authenticatedUser.codiceUtente}, target=${codiceUtente}, host=${new URL(loginUrl).host}`,\n      );\n\n      return RestUtilities.sendBaseResponse(res, {\n        loginUrl,\n        token: issued.value,\n        expiresInSeconds,\n        expiresAt,\n      });\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta direttamente la password di un utente',\n    operationId: 'setUserPassword',\n    description: 'Riservato agli amministratori. Hasha la password, aggiorna la scadenza secondo la policy e non invia email.',\n  })\n  @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n  @ApiBody({ type: SetUserPasswordRequest })\n  @ApiResponse({ status: 200, description: 'Password aggiornata', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Password non valida', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('set-password/:codiceUtente')\n  async setUserPassword(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Body() body: SetUserPasswordRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(\n        authenticatedUser,\n        'Solo gli amministratori possono impostare la password di un utente.',\n      );\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n      await this.authService.setPassword(codiceUtente, body.newPassword);\n      return RestUtilities.sendOKMessage(res, `Password dell utente ${codiceUtente} aggiornata.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta lo stato di registrazione di un utente',\n    operationId: 'setStatoRegistrazione',\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Stato registrazione aggiornato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nei parametri della richiesta',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: 500,\n    description: 'Errore interno del server',\n    type: ErrorResponse,\n  })\n  @ApiBody({ type: SetStatoRegistrazioneDto })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('set-stato')\n  async setStatoRegistrazione(\n    @Req() request: Request,\n    @Body() body: SetStatoRegistrazioneDto,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(\n        authenticatedUser,\n        'Solo gli amministratori possono modificare lo stato di registrazione.',\n      );\n\n      const { codiceUtente, statoRegistrazione } = body;\n      if (!codiceUtente) throw new BadRequestException('Il codice utente e\\' obbligatorio.');\n      if (statoRegistrazione === undefined) {\n        throw new BadRequestException('Lo stato registrazione e\\' obbligatorio.');\n      }\n\n      const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      const disabling = statoRegistrazione === StatoRegistrazione.DELETE\n        || statoRegistrazione === StatoRegistrazione.BLOCC;\n      if (target.flagAdmin && disabling) {\n        await this.userService.assertNotLastActiveAdmin(codiceUtente);\n      }\n\n      await this.userService.setStato(codiceUtente, statoRegistrazione);\n      return RestUtilities.sendOKMessage(\n        res,\n        `Lo stato dell'utente ${codiceUtente} e' stato aggiornato a ${statoRegistrazione}.`,\n      );\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Registra un nuovo utente',\n    description: 'Disponibile soltanto quando publicRegistration.enabled e true. Per utenti SSO usare il provisioning master nel tag Federated authentication.',\n    operationId: 'register',\n  })\n  @ApiBody({\n    type: PublicRegisterRequest,\n    description: \"Dati necessari per la registrazione dell'utente\",\n  })\n  @ApiCreatedResponse({\n    description:\n      'Utente registrato con successo. Restituisce il codice utente e invia una mail di reset password.',\n    type: RegisterResponse,\n  })\n  @ApiResponse({\n    status: HttpStatus.BAD_REQUEST,\n    description: 'Errore nella registrazione.',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: HttpStatus.INTERNAL_SERVER_ERROR,\n    description: 'Errore interno del server durante la registrazione o l\\'invio email.',\n    type: ErrorResponse,\n  })\n  @Post('register')\n  async register(\n    @Req() request: Request,\n    @Body() registrationData: PublicRegisterRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      if (this.accessiOptions.publicRegistration?.enabled !== true) {\n        throw new HttpException(\n          'La registrazione pubblica e disabilitata. Un amministratore deve creare l utente.',\n          HttpStatus.FORBIDDEN,\n        );\n      }\n\n      const rateLimitDecision = await checkPublicAuthRateLimit(\n        this.accessiOptions,\n        'register',\n        request,\n        [registrationData?.email],\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      assertEmailConfigured(this.accessiOptions);\n\n      const codiceUtente = await this.userService.register(registrationData, {\n        allowPrivilegedFields: false,\n      });\n\n      try {\n        await this.emailService.sendPasswordResetEmail(registrationData.email);\n      } catch (emailError) {\n        try {\n          await this.userService.deleteUserPermanently(codiceUtente);\n        } catch (rollbackError) {\n          this.logger.error(`Rollback registrazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n        }\n        throw new BadRequestException({\n          code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n          message: `Registrazione non completata: invio email non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova piu tardi.`,\n        });\n      }\n      return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n    } catch (error) {\n      const status =\n        error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST;\n      return RestUtilities.sendErrorMessage(res, error, UserController.name, status);\n    }\n  }\n\n  @ApiOperation({ summary: 'Crea un utente locale da amministrazione', operationId: 'createManagedUser', description: 'Riservato a superutente. Crea un utente in attesa di impostazione password e invia la mail di reset.' })\n  @ApiBody({ type: RegisterRequest })\n  @ApiCreatedResponse({ type: RegisterResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('create-managed-user')\n  async createManagedUser(@Req() request: Request, @Body() registrationData: RegisterRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono creare utenti.');\n      ensurePrivilegeFlagChanges(authenticatedUser, registrationData);\n\n      // Fail-fast prima di scrivere: senza SMTP non si crea un utente orfano.\n      assertEmailConfigured(this.accessiOptions);\n\n      const codiceUtente = await this.userService.register(registrationData, { allowPrivilegedFields: true });\n      try {\n        await this.emailService.sendPasswordResetEmail(registrationData.email, registrationData.htmlMail);\n      } catch (emailError) {\n        // L'invio e' esterno: se fallisce annulliamo la creazione per non lasciare un utente\n        // senza password e senza email di invito (rollback best-effort).\n        try {\n          await this.userService.deleteUserPermanently(codiceUtente);\n        } catch (rollbackError) {\n          this.logger.error(`Rollback creazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n        }\n        throw new BadRequestException({\n          code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n          message: `Utente non creato: invio email di invito non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova oppure crea l utente e imposta la password manualmente.`,\n        });\n      }\n      return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Aggiorna un utente esistente',\n    operationId: 'updateUtente',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da aggiornare\",\n    required: true,\n    example: 123,\n  })\n  @ApiBody({\n    type: UserDto,\n    description: \"Dati aggiornati dell'utente\",\n  })\n  @ApiResponse({\n    status: HttpStatus.OK,\n    description: 'Utente aggiornato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({ status: 400, description: \"Errore nell'aggiornamento\", type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Put('update-user/:codiceUtente')\n  async updateUtente(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Body() user: UserDto,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      const isPrivilegedUpdate = hasPrivilegedUserChanges(user);\n      const isSelf = authenticatedUser.codiceUtente === codiceUtente;\n\n      // ADMIN > SUPER: un superutente non puo' toccare un admin. Self sempre consentito.\n      if (!isSelf) {\n        await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      }\n\n      if (isPrivilegedUpdate) {\n        ensureUserManagement(\n          authenticatedUser,\n          'Solo gli amministratori possono modificare ruoli, permessi o flag privilegiati.',\n        );\n        ensurePrivilegeFlagChanges(authenticatedUser, user);\n        if (user.flagAdmin === false) {\n          await this.userService.assertNotLastActiveAdmin(codiceUtente);\n        }\n      } else {\n        ensureSelfOrSuperUser(\n          authenticatedUser,\n          codiceUtente,\n          'Puoi modificare solo il tuo profilo.',\n        );\n      }\n\n      if (user.codiceUtente !== undefined && user.codiceUtente !== codiceUtente) {\n        throw new BadRequestException('Il codice utente nel body non coincide con quello del path.');\n      }\n\n      await this.userService.updateUser(codiceUtente, user, {\n        allowPrivilegedChanges: authenticatedUser.flagSuper || authenticatedUser.flagAdmin,\n      });\n\n      return RestUtilities.sendOKMessage(\n        res,\n        `L'utente ${codiceUtente} e' stato aggiornato con successo.`,\n      );\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta il consenso GDPR per un utente',\n    operationId: 'setGdpr',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente che accetta il GDPR\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Consenso GDPR impostato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({ status: 400, description: 'Errore nella richiesta', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Patch('set-gdpr/:codiceUtente')\n  async setGdpr(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureSelfOrSuperUser(\n        authenticatedUser,\n        codiceUtente,\n        'Puoi impostare il GDPR solo sul tuo utente.',\n      );\n      if (authenticatedUser.codiceUtente !== codiceUtente) {\n        await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      }\n\n      await this.userService.setGdpr(codiceUtente);\n      return RestUtilities.sendOKMessage(res, `L'utente ${codiceUtente} ha accettato il GDPR.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n}\n"]}

package/dist/accessi-module/database-updates/accessiOptionsFromEnv.js

@@ -54,18 +54,7 @@ function createAccessiOptionsFromEnv() {
         databaseOptions.wireCrypt = wireCrypt;
     if (authPlugin)
         databaseOptions.pluginName = authPlugin;
-    return {
-        databaseOptions,
-        confirmationEmailUrl: getEnv("ACCESSI_CONFIRMATION_EMAIL_URL", "http://localhost"),
-        confirmationEmailReturnUrl: getEnv("ACCESSI_CONFIRMATION_RETURN_EMAIL_URL", "http://localhost"),
-        confirmationEmailPrefix: process.env.ACCESSI_CONFIRMATION_EMAIL_PREFIX,
-        customResetPage: process.env.ACCESSI_CUSTOM_RESET_PAGE,
-        encryptionKey: getEnv("ACCESSI_ENCRYPTION_KEY", "1234567890ABCDEF"),
-        mockDemoUser: getOptionalBoolean("ACCESSI_MOCK_DEMO_USER", false),
-        passwordExpiration: getOptionalBoolean("ACCESSI_PASSWORD_EXPIRATION", false),
-        autoUpdateDatabase: true,
-        jwtOptions: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ secret: getEnv("ACCESSI_JWT_SECRET", "local-accessi-update"), expiresIn: getEnv("ACCESSI_JWT_EXPIRES", "24h") }, (process.env.ACCESSI_JWT_ISSUER ? { issuer: process.env.ACCESSI_JWT_ISSUER } : {})), (process.env.ACCESSI_JWT_AUDIENCE ? { audience: process.env.ACCESSI_JWT_AUDIENCE } : {})), (getJwtAlgorithm() ? { algorithm: getJwtAlgorithm() } : {})), (process.env.ACCESSI_JWT_PRIVATE_KEY ? { privateKey: process.env.ACCESSI_JWT_PRIVATE_KEY } : {})), (process.env.ACCESSI_JWT_PUBLIC_KEY ? { publicKey: process.env.ACCESSI_JWT_PUBLIC_KEY } : {})), (process.env.ACCESSI_JWT_KEY_ID ? { keyId: process.env.ACCESSI_JWT_KEY_ID } : {})),
-        emailOptions: {
+    return Object.assign(Object.assign({ databaseOptions, confirmationEmailUrl: getEnv("ACCESSI_CONFIRMATION_EMAIL_URL", "http://localhost"), confirmationEmailReturnUrl: getEnv("ACCESSI_CONFIRMATION_RETURN_EMAIL_URL", "http://localhost"), confirmationEmailPrefix: process.env.ACCESSI_CONFIRMATION_EMAIL_PREFIX, customResetPage: process.env.ACCESSI_CUSTOM_RESET_PAGE, encryptionKey: getEnv("ACCESSI_ENCRYPTION_KEY", "1234567890ABCDEF"), mockDemoUser: getOptionalBoolean("ACCESSI_MOCK_DEMO_USER", false), passwordExpiration: getOptionalBoolean("ACCESSI_PASSWORD_EXPIRATION", false), autoUpdateDatabase: true, jwtOptions: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ secret: getEnv("ACCESSI_JWT_SECRET", "local-accessi-update"), expiresIn: getEnv("ACCESSI_JWT_EXPIRES", "24h") }, (process.env.ACCESSI_JWT_ISSUER ? { issuer: process.env.ACCESSI_JWT_ISSUER } : {})), (process.env.ACCESSI_JWT_AUDIENCE ? { audience: process.env.ACCESSI_JWT_AUDIENCE } : {})), (getJwtAlgorithm() ? { algorithm: getJwtAlgorithm() } : {})), (process.env.ACCESSI_JWT_PRIVATE_KEY ? { privateKey: process.env.ACCESSI_JWT_PRIVATE_KEY } : {})), (process.env.ACCESSI_JWT_PUBLIC_KEY ? { publicKey: process.env.ACCESSI_JWT_PUBLIC_KEY } : {})), (process.env.ACCESSI_JWT_KEY_ID ? { keyId: process.env.ACCESSI_JWT_KEY_ID } : {})), (process.env.ACCESSI_JWKS_PATH ? { jwksPath: process.env.ACCESSI_JWKS_PATH } : {})), emailOptions: {
             host: getEnv("ACCESSI_EMAIL_HOST", "localhost"),
             port: Number(getEnv("ACCESSI_EMAIL_PORT", "25")),
             secure: getOptionalBoolean("ACCESSI_EMAIL_SECURE", false),
@@ -78,9 +67,12 @@ function createAccessiOptionsFromEnv() {
                 user: getEnv("ACCESSI_EMAIL_USER", "local-user"),
                 pass: getEnv("ACCESSI_EMAIL_PASSWORD", "local-password"),
             },
-        },
-        extensionFieldsOptions: [],
-        catalogScripts: createCatalogScriptsOptionsFromEnv(),
-    };
+        } }, (process.env.ACCESSI_CONSOLE_ENTRY_TTL_MS
+        ? {
+            consoleEntry: {
+                ttlMs: Number(process.env.ACCESSI_CONSOLE_ENTRY_TTL_MS),
+            },
+        }
+        : {})), { extensionFieldsOptions: [], catalogScripts: createCatalogScriptsOptionsFromEnv() });
 }
 //# sourceMappingURL=accessiOptionsFromEnv.js.map

package/dist/accessi-module/database-updates/accessiOptionsFromEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessiOptionsFromEnv.js","sourceRoot":"","sources":["../../../src/accessi-module/database-updates/accessiOptionsFromEnv.ts"],"names":[],"mappings":";;AAgCA,gFAeC;AAGD,kEAoDC;AArGD,+CAAoD;AAEpD,SAAS,MAAM,CAAC,KAAwB,EAAE,QAAiB;;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAA,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,mCAAI,QAAQ,CAAC;IACvI,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAiB;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AACxC,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;CACjB,CAAC;AAEX,SAAS,eAAe;;IACtB,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,qBAAqB,0CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;IACtE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,kFAAkF;AAClF,SAAgB,kCAAkC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IAC3D,MAAM,cAAc,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5G,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,kBAAkB,EAAE,cAAc;QAClC,WAAW,EAAE,kBAAkB,CAAC,+BAA+B,EAAE,IAAI,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAgB,2BAA2B;IACzC,MAAM,eAAe,GAAG,6BAAiB,CAAC,YAAY,CACpD,MAAM,CAAC,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC,EACpD,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC,CAAC,EACpE,MAAM,CAAC,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC,EAC5D,MAAM,CAAC,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,EAAE,QAAQ,CAAC,EAC9D,MAAM,CAAC,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,EAAE,WAAW,CAAC,CAC1E,CAAC;IAEF,sGAAsG;IACtG,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACtD,IAAI,SAAS;QAAG,eAA0C,CAAC,SAAS,GAAG,SAAS,CAAC;IACjF,IAAI,UAAU;QAAG,eAA2C,CAAC,UAAU,GAAG,UAAU,CAAC;IAErF,OAAO;QACL,eAAe;QACf,oBAAoB,EAAE,MAAM,CAAC,gCAAgC,EAAE,kBAAkB,CAAC;QAClF,0BAA0B,EAAE,MAAM,CAAC,uCAAuC,EAAE,kBAAkB,CAAC;QAC/F,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;QACtE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACtD,aAAa,EAAE,MAAM,CAAC,wBAAwB,EAAE,kBAAkB,CAAC;QACnE,YAAY,EAAE,kBAAkB,CAAC,wBAAwB,EAAE,KAAK,CAAC;QACjE,kBAAkB,EAAE,kBAAkB,CAAC,6BAA6B,EAAE,KAAK,CAAC;QAC5E,kBAAkB,EAAE,IAAI;QACxB,UAAU,wFACR,MAAM,EAAE,MAAM,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,EAC5D,SAAS,EAAE,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,IAC5C,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClF,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxF,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC3D,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7F,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACrF;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,MAAM,CAAC,oBAAoB,EAAE,WAAW,CAAC;YAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,EAAE,kBAAkB,CAAC,sBAAsB,EAAE,KAAK,CAAC;YACzD,UAAU,EAAE,kBAAkB,CAAC,2BAA2B,EAAE,KAAK,CAAC;YAClE,GAAG,EAAE;gBACH,kBAAkB,EAAE,kBAAkB,CAAC,uCAAuC,EAAE,KAAK,CAAC;aACvF;YACD,IAAI,EAAE,MAAM,CAAC,oBAAoB,EAAE,uBAAuB,CAAC;YAC3D,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM,CAAC,oBAAoB,EAAE,YAAY,CAAC;gBAChD,IAAI,EAAE,MAAM,CAAC,wBAAwB,EAAE,gBAAgB,CAAC;aACzD;SACF;QACD,sBAAsB,EAAE,EAAE;QAC1B,cAAc,EAAE,kCAAkC,EAAE;KACrD,CAAC;AACJ,CAAC","sourcesContent":["import type { AccessiOptions, CatalogScriptsOptions } from '../AccessiModule';\nimport { DatabaseUtilities } from '../../Utilities';\n\nfunction getEnv(names: string | string[], fallback?: string): string {\n  const candidates = Array.isArray(names) ? names : [names];\n  const value = candidates.map((name) => process.env[name]).find((candidate) => candidate !== undefined && candidate !== \"\") ?? fallback;\n  if (!value) {\n    throw new Error(`Variabile ambiente mancante: ${candidates.join(\" oppure \")}`);\n  }\n  return value;\n}\n\nfunction getOptionalBoolean(name: string, fallback: boolean): boolean {\n  const value = process.env[name];\n  if (value === undefined) {\n    return fallback;\n  }\n  return value.toLowerCase() === \"true\";\n}\n\nconst JWT_ALGORITHMS = [\n  \"HS256\", \"HS384\", \"HS512\",\n  \"RS256\", \"RS384\", \"RS512\",\n  \"ES256\", \"ES384\", \"ES512\",\n] as const;\n\nfunction getJwtAlgorithm(): (typeof JWT_ALGORITHMS)[number] | undefined {\n  const value = process.env.ACCESSI_JWT_ALGORITHM?.trim().toUpperCase();\n  return JWT_ALGORITHMS.find((algorithm) => algorithm === value);\n}\n\n/** Catalog migrations lette dall'ambiente: cartella in ACCESSI_CATALOG_FOLDER. */\nexport function createCatalogScriptsOptionsFromEnv(): CatalogScriptsOptions | undefined {\n  const folder = process.env.ACCESSI_CATALOG_FOLDER;\n  if (!folder) {\n    return undefined;\n  }\n\n  const policy = process.env.ACCESSI_CATALOG_CHECKSUM_POLICY;\n  const checksumPolicy = policy === 'warn' || policy === 'reapply' || policy === 'error' ? policy : undefined;\n\n  return {\n    enabled: true,\n    folder,\n    onChecksumMismatch: checksumPolicy,\n    stopOnError: getOptionalBoolean('ACCESSI_CATALOG_STOP_ON_ERROR', true),\n  };\n}\n\n/** Costruisce `AccessiOptions` dalle variabili ambiente (stesse di runAccessiDbUpdate). */\nexport function createAccessiOptionsFromEnv(): AccessiOptions {\n  const databaseOptions = DatabaseUtilities.createOption(\n    getEnv([\"ACCESSI_DB_HOST\", \"ACCESSI_FIREBIRD_HOST\"]),\n    Number(getEnv([\"ACCESSI_DB_PORT\", \"ACCESSI_FIREBIRD_PORT\"], \"3050\")),\n    getEnv([\"ACCESSI_DB_DATABASE\", \"ACCESSI_FIREBIRD_DATABASE\"]),\n    getEnv([\"ACCESSI_DB_USER\", \"ACCESSI_FIREBIRD_USER\"], \"SYSDBA\"),\n    getEnv([\"ACCESSI_DB_PASSWORD\", \"ACCESSI_FIREBIRD_PASSWORD\"], \"masterkey\")\n  );\n\n  // Firebird 2.5 richiede Legacy_Auth e non supporta la cifratura del wire: override opzionale via env.\n  const wireCrypt = process.env.ACCESSI_DB_WIRE_CRYPT;\n  const authPlugin = process.env.ACCESSI_DB_AUTH_PLUGIN;\n  if (wireCrypt) (databaseOptions as { wireCrypt?: string }).wireCrypt = wireCrypt;\n  if (authPlugin) (databaseOptions as { pluginName?: string }).pluginName = authPlugin;\n\n  return {\n    databaseOptions,\n    confirmationEmailUrl: getEnv(\"ACCESSI_CONFIRMATION_EMAIL_URL\", \"http://localhost\"),\n    confirmationEmailReturnUrl: getEnv(\"ACCESSI_CONFIRMATION_RETURN_EMAIL_URL\", \"http://localhost\"),\n    confirmationEmailPrefix: process.env.ACCESSI_CONFIRMATION_EMAIL_PREFIX,\n    customResetPage: process.env.ACCESSI_CUSTOM_RESET_PAGE,\n    encryptionKey: getEnv(\"ACCESSI_ENCRYPTION_KEY\", \"1234567890ABCDEF\"),\n    mockDemoUser: getOptionalBoolean(\"ACCESSI_MOCK_DEMO_USER\", false),\n    passwordExpiration: getOptionalBoolean(\"ACCESSI_PASSWORD_EXPIRATION\", false),\n    autoUpdateDatabase: true,\n    jwtOptions: {\n      secret: getEnv(\"ACCESSI_JWT_SECRET\", \"local-accessi-update\"),\n      expiresIn: getEnv(\"ACCESSI_JWT_EXPIRES\", \"24h\"),\n      ...(process.env.ACCESSI_JWT_ISSUER ? { issuer: process.env.ACCESSI_JWT_ISSUER } : {}),\n      ...(process.env.ACCESSI_JWT_AUDIENCE ? { audience: process.env.ACCESSI_JWT_AUDIENCE } : {}),\n      ...(getJwtAlgorithm() ? { algorithm: getJwtAlgorithm() } : {}),\n      ...(process.env.ACCESSI_JWT_PRIVATE_KEY ? { privateKey: process.env.ACCESSI_JWT_PRIVATE_KEY } : {}),\n      ...(process.env.ACCESSI_JWT_PUBLIC_KEY ? { publicKey: process.env.ACCESSI_JWT_PUBLIC_KEY } : {}),\n      ...(process.env.ACCESSI_JWT_KEY_ID ? { keyId: process.env.ACCESSI_JWT_KEY_ID } : {}),\n    },\n    emailOptions: {\n      host: getEnv(\"ACCESSI_EMAIL_HOST\", \"localhost\"),\n      port: Number(getEnv(\"ACCESSI_EMAIL_PORT\", \"25\")),\n      secure: getOptionalBoolean(\"ACCESSI_EMAIL_SECURE\", false),\n      requireTLS: getOptionalBoolean(\"ACCESSI_EMAIL_REQUIRE_TLS\", false),\n      tls: {\n        rejectUnauthorized: getOptionalBoolean(\"ACCESSI_EMAIL_TLS_REJECT_UNAUTHORIZED\", false),\n      },\n      from: getEnv(\"ACCESSI_EMAIL_FROM\", \"noreply@example.local\"),\n      auth: {\n        user: getEnv(\"ACCESSI_EMAIL_USER\", \"local-user\"),\n        pass: getEnv(\"ACCESSI_EMAIL_PASSWORD\", \"local-password\"),\n      },\n    },\n    extensionFieldsOptions: [],\n    catalogScripts: createCatalogScriptsOptionsFromEnv(),\n  };\n}\n"]}
+{"version":3,"file":"accessiOptionsFromEnv.js","sourceRoot":"","sources":["../../../src/accessi-module/database-updates/accessiOptionsFromEnv.ts"],"names":[],"mappings":";;AAgCA,gFAeC;AAGD,kEA4DC;AA7GD,+CAAoD;AAEpD,SAAS,MAAM,CAAC,KAAwB,EAAE,QAAiB;;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAA,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,mCAAI,QAAQ,CAAC;IACvI,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAiB;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AACxC,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;CACjB,CAAC;AAEX,SAAS,eAAe;;IACtB,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,qBAAqB,0CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;IACtE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,kFAAkF;AAClF,SAAgB,kCAAkC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IAC3D,MAAM,cAAc,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5G,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,kBAAkB,EAAE,cAAc;QAClC,WAAW,EAAE,kBAAkB,CAAC,+BAA+B,EAAE,IAAI,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAgB,2BAA2B;IACzC,MAAM,eAAe,GAAG,6BAAiB,CAAC,YAAY,CACpD,MAAM,CAAC,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC,EACpD,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC,CAAC,EACpE,MAAM,CAAC,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC,EAC5D,MAAM,CAAC,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,EAAE,QAAQ,CAAC,EAC9D,MAAM,CAAC,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,EAAE,WAAW,CAAC,CAC1E,CAAC;IAEF,sGAAsG;IACtG,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACtD,IAAI,SAAS;QAAG,eAA0C,CAAC,SAAS,GAAG,SAAS,CAAC;IACjF,IAAI,UAAU;QAAG,eAA2C,CAAC,UAAU,GAAG,UAAU,CAAC;IAErF,qCACE,eAAe,EACf,oBAAoB,EAAE,MAAM,CAAC,gCAAgC,EAAE,kBAAkB,CAAC,EAClF,0BAA0B,EAAE,MAAM,CAAC,uCAAuC,EAAE,kBAAkB,CAAC,EAC/F,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC,EACtE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,EACtD,aAAa,EAAE,MAAM,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,EACnE,YAAY,EAAE,kBAAkB,CAAC,wBAAwB,EAAE,KAAK,CAAC,EACjE,kBAAkB,EAAE,kBAAkB,CAAC,6BAA6B,EAAE,KAAK,CAAC,EAC5E,kBAAkB,EAAE,IAAI,EACxB,UAAU,sGACR,MAAM,EAAE,MAAM,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,EAC5D,SAAS,EAAE,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,IAC5C,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClF,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxF,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC3D,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7F,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACjF,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAEvF,YAAY,EAAE;YACZ,IAAI,EAAE,MAAM,CAAC,oBAAoB,EAAE,WAAW,CAAC;YAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,EAAE,kBAAkB,CAAC,sBAAsB,EAAE,KAAK,CAAC;YACzD,UAAU,EAAE,kBAAkB,CAAC,2BAA2B,EAAE,KAAK,CAAC;YAClE,GAAG,EAAE;gBACH,kBAAkB,EAAE,kBAAkB,CAAC,uCAAuC,EAAE,KAAK,CAAC;aACvF;YACD,IAAI,EAAE,MAAM,CAAC,oBAAoB,EAAE,uBAAuB,CAAC;YAC3D,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM,CAAC,oBAAoB,EAAE,YAAY,CAAC;gBAChD,IAAI,EAAE,MAAM,CAAC,wBAAwB,EAAE,gBAAgB,CAAC;aACzD;SACF,IACE,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B;QAC1C,CAAC,CAAC;YACE,YAAY,EAAE;gBACZ,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;aACxD;SACF;QACH,CAAC,CAAC,EAAE,CAAC,KACP,sBAAsB,EAAE,EAAE,EAC1B,cAAc,EAAE,kCAAkC,EAAE,IACpD;AACJ,CAAC","sourcesContent":["import type { AccessiOptions, CatalogScriptsOptions } from '../AccessiModule';\nimport { DatabaseUtilities } from '../../Utilities';\n\nfunction getEnv(names: string | string[], fallback?: string): string {\n  const candidates = Array.isArray(names) ? names : [names];\n  const value = candidates.map((name) => process.env[name]).find((candidate) => candidate !== undefined && candidate !== \"\") ?? fallback;\n  if (!value) {\n    throw new Error(`Variabile ambiente mancante: ${candidates.join(\" oppure \")}`);\n  }\n  return value;\n}\n\nfunction getOptionalBoolean(name: string, fallback: boolean): boolean {\n  const value = process.env[name];\n  if (value === undefined) {\n    return fallback;\n  }\n  return value.toLowerCase() === \"true\";\n}\n\nconst JWT_ALGORITHMS = [\n  \"HS256\", \"HS384\", \"HS512\",\n  \"RS256\", \"RS384\", \"RS512\",\n  \"ES256\", \"ES384\", \"ES512\",\n] as const;\n\nfunction getJwtAlgorithm(): (typeof JWT_ALGORITHMS)[number] | undefined {\n  const value = process.env.ACCESSI_JWT_ALGORITHM?.trim().toUpperCase();\n  return JWT_ALGORITHMS.find((algorithm) => algorithm === value);\n}\n\n/** Catalog migrations lette dall'ambiente: cartella in ACCESSI_CATALOG_FOLDER. */\nexport function createCatalogScriptsOptionsFromEnv(): CatalogScriptsOptions | undefined {\n  const folder = process.env.ACCESSI_CATALOG_FOLDER;\n  if (!folder) {\n    return undefined;\n  }\n\n  const policy = process.env.ACCESSI_CATALOG_CHECKSUM_POLICY;\n  const checksumPolicy = policy === 'warn' || policy === 'reapply' || policy === 'error' ? policy : undefined;\n\n  return {\n    enabled: true,\n    folder,\n    onChecksumMismatch: checksumPolicy,\n    stopOnError: getOptionalBoolean('ACCESSI_CATALOG_STOP_ON_ERROR', true),\n  };\n}\n\n/** Costruisce `AccessiOptions` dalle variabili ambiente (stesse di runAccessiDbUpdate). */\nexport function createAccessiOptionsFromEnv(): AccessiOptions {\n  const databaseOptions = DatabaseUtilities.createOption(\n    getEnv([\"ACCESSI_DB_HOST\", \"ACCESSI_FIREBIRD_HOST\"]),\n    Number(getEnv([\"ACCESSI_DB_PORT\", \"ACCESSI_FIREBIRD_PORT\"], \"3050\")),\n    getEnv([\"ACCESSI_DB_DATABASE\", \"ACCESSI_FIREBIRD_DATABASE\"]),\n    getEnv([\"ACCESSI_DB_USER\", \"ACCESSI_FIREBIRD_USER\"], \"SYSDBA\"),\n    getEnv([\"ACCESSI_DB_PASSWORD\", \"ACCESSI_FIREBIRD_PASSWORD\"], \"masterkey\")\n  );\n\n  // Firebird 2.5 richiede Legacy_Auth e non supporta la cifratura del wire: override opzionale via env.\n  const wireCrypt = process.env.ACCESSI_DB_WIRE_CRYPT;\n  const authPlugin = process.env.ACCESSI_DB_AUTH_PLUGIN;\n  if (wireCrypt) (databaseOptions as { wireCrypt?: string }).wireCrypt = wireCrypt;\n  if (authPlugin) (databaseOptions as { pluginName?: string }).pluginName = authPlugin;\n\n  return {\n    databaseOptions,\n    confirmationEmailUrl: getEnv(\"ACCESSI_CONFIRMATION_EMAIL_URL\", \"http://localhost\"),\n    confirmationEmailReturnUrl: getEnv(\"ACCESSI_CONFIRMATION_RETURN_EMAIL_URL\", \"http://localhost\"),\n    confirmationEmailPrefix: process.env.ACCESSI_CONFIRMATION_EMAIL_PREFIX,\n    customResetPage: process.env.ACCESSI_CUSTOM_RESET_PAGE,\n    encryptionKey: getEnv(\"ACCESSI_ENCRYPTION_KEY\", \"1234567890ABCDEF\"),\n    mockDemoUser: getOptionalBoolean(\"ACCESSI_MOCK_DEMO_USER\", false),\n    passwordExpiration: getOptionalBoolean(\"ACCESSI_PASSWORD_EXPIRATION\", false),\n    autoUpdateDatabase: true,\n    jwtOptions: {\n      secret: getEnv(\"ACCESSI_JWT_SECRET\", \"local-accessi-update\"),\n      expiresIn: getEnv(\"ACCESSI_JWT_EXPIRES\", \"24h\"),\n      ...(process.env.ACCESSI_JWT_ISSUER ? { issuer: process.env.ACCESSI_JWT_ISSUER } : {}),\n      ...(process.env.ACCESSI_JWT_AUDIENCE ? { audience: process.env.ACCESSI_JWT_AUDIENCE } : {}),\n      ...(getJwtAlgorithm() ? { algorithm: getJwtAlgorithm() } : {}),\n      ...(process.env.ACCESSI_JWT_PRIVATE_KEY ? { privateKey: process.env.ACCESSI_JWT_PRIVATE_KEY } : {}),\n      ...(process.env.ACCESSI_JWT_PUBLIC_KEY ? { publicKey: process.env.ACCESSI_JWT_PUBLIC_KEY } : {}),\n      ...(process.env.ACCESSI_JWT_KEY_ID ? { keyId: process.env.ACCESSI_JWT_KEY_ID } : {}),\n      ...(process.env.ACCESSI_JWKS_PATH ? { jwksPath: process.env.ACCESSI_JWKS_PATH } : {}),\n    },\n    emailOptions: {\n      host: getEnv(\"ACCESSI_EMAIL_HOST\", \"localhost\"),\n      port: Number(getEnv(\"ACCESSI_EMAIL_PORT\", \"25\")),\n      secure: getOptionalBoolean(\"ACCESSI_EMAIL_SECURE\", false),\n      requireTLS: getOptionalBoolean(\"ACCESSI_EMAIL_REQUIRE_TLS\", false),\n      tls: {\n        rejectUnauthorized: getOptionalBoolean(\"ACCESSI_EMAIL_TLS_REJECT_UNAUTHORIZED\", false),\n      },\n      from: getEnv(\"ACCESSI_EMAIL_FROM\", \"noreply@example.local\"),\n      auth: {\n        user: getEnv(\"ACCESSI_EMAIL_USER\", \"local-user\"),\n        pass: getEnv(\"ACCESSI_EMAIL_PASSWORD\", \"local-password\"),\n      },\n    },\n    ...(process.env.ACCESSI_CONSOLE_ENTRY_TTL_MS\n      ? {\n          consoleEntry: {\n            ttlMs: Number(process.env.ACCESSI_CONSOLE_ENTRY_TTL_MS),\n          },\n        }\n      : {}),\n    extensionFieldsOptions: [],\n    catalogScripts: createCatalogScriptsOptionsFromEnv(),\n  };\n}\n"]}

package/dist/accessi-module/index.d.ts

@@ -29,7 +29,13 @@ export type { AccessiTokenIntrospectionResult } from "./Services/AuthService/Aut
 export { AccessiDatabaseUpdater } from "./database-updates/AccessiDatabaseUpdater";
 export type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from "./AccessiModule";
 export type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from "./AccessiModule";
-export type { CatalogScriptsOptions, CatalogScriptChecksumPolicy } from "./AccessiModule";
+export type { CatalogScriptsOptions, CatalogScriptChecksumPolicy, ConsoleEntryOptions } from "./AccessiModule";
+export { createMemoryConsoleEntryStore, createRedisConsoleEntryStore, getDefaultConsoleEntryStore } from './security/consoleEntry';
+export type { ConsoleEntryRedisClient, ConsoleEntryRecord, ConsoleEntryStore, ConsoleEntryTicket, MemoryConsoleEntryStore, RedisConsoleEntryStoreOptions } from './security/consoleEntry';
+export { createMemoryRateLimitStore, createRedisRateLimitStore, getDefaultRateLimitStore } from './security/rateLimitStore';
+export type { MemoryRateLimitStore, RateLimitDecision, RateLimitRedisClient, RateLimitStore, RedisRateLimitStoreOptions } from './security/rateLimitStore';
+export { createAccessiEdgeRateLimitMiddleware } from './security/edgeRateLimit';
+export type { AccessiEdgeRateLimitMiddleware, AccessiEdgeRateLimitOptions } from './security/edgeRateLimit';
 export { AccessiCatalogMigrator, applyCatalogScripts, listPendingCatalogScripts, splitSqlStatements, analyzeCatalogScript, leadingStatementKeyword, computeCatalogScriptChecksum, discoverCatalogScripts } from "./database-updates/AccessiCatalogMigrator";
 export type { CatalogMigrationReport, CatalogScriptMigration } from "./database-updates/AccessiCatalogMigrator";
 export { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';
@@ -42,6 +48,8 @@ export { getOrCreateAdminBootstrapToken, getAdminBootstrapToken, clearAdminBoots
 export { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';
 export { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';
 export { buildLoginAsUrl, LOGIN_AS_QUERY_PARAM } from './security/loginAs';
+export { buildAccessiJwks, createAccessiJwksHandler, getAccessiJwksPath, setupAccessiJwks } from './security/jwks';
+export type { AccessiJwksDocument, AccessiJwksKey } from './security/jwks';
 export { FederatedAuthService } from './federated-auth/FederatedAuthService';
 export type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';
 export * from "./Dtos";