emilsoftware-utilities 2.0.0-dev.67 → 2.0.0-dev.68

package/dist/accessi-module/security/jwks.d.ts

@@ -0,0 +1,33 @@
+import type { JsonWebKey } from "crypto";
+import type { Request, Response } from "express";
+import type { AccessiOptions } from "../AccessiModule";
+/** Chiave pubblica in formato JWK, pronta per una risposta JWKS. */
+export type AccessiJwksKey = JsonWebKey & {
+    kid: string;
+    alg: string;
+    use: "sig";
+};
+export interface AccessiJwksDocument {
+    keys: AccessiJwksKey[];
+}
+/** Path pubblico della JWKS, oppure `undefined` quando si usa HS256. */
+export declare function getAccessiJwksPath(options: AccessiOptions): string | undefined;
+/**
+ * Costruisce la JWKS pubblica con chiave corrente e chiavi precedenti.
+ *
+ * Restituisce `null` per HS256 o quando non e configurata una chiave
+ * pubblica/privata asimmetrica.
+ */
+export declare function buildAccessiJwks(options: AccessiOptions): AccessiJwksDocument | null;
+/** Handler Express per la JWKS. Risponde 404 se la configurazione e HS256. */
+export declare function createAccessiJwksHandler(options: AccessiOptions): (req: Request, res: Response) => Response | void;
+/**
+ * Monta la route JWKS sull'Express host.
+ *
+ * Per un'app Nest esistente passare `app.getHttpAdapter().getInstance()`.
+ * Restituisce il path montato, oppure `undefined` se HS256.
+ */
+export interface AccessiJwksExpressApp {
+    get(path: string, handler: (req: Request, res: Response) => unknown): unknown;
+}
+export declare function setupAccessiJwks(app: AccessiJwksExpressApp, options: AccessiOptions): string | undefined;

package/dist/accessi-module/security/jwks.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAccessiJwksPath = getAccessiJwksPath;
+exports.buildAccessiJwks = buildAccessiJwks;
+exports.createAccessiJwksHandler = createAccessiJwksHandler;
+exports.setupAccessiJwks = setupAccessiJwks;
+const crypto_1 = require("crypto");
+const DEFAULT_JWKS_PATH = "accessi/.well-known/jwks.json";
+function normalizePath(value) {
+    return `/${value.replace(/^\/+|\/+$/g, "")}`;
+}
+function fingerprintPublicKey(publicKey) {
+    const der = (0, crypto_1.createPublicKey)(publicKey).export({ type: "spki", format: "der" });
+    return (0, crypto_1.createHash)("sha256").update(der).digest("base64url").slice(0, 16);
+}
+function toJwksKey(publicKey, keyId, algorithm) {
+    const jwk = (0, crypto_1.createPublicKey)(publicKey).export({ format: "jwk" });
+    return Object.assign(Object.assign({}, jwk), { kid: keyId !== null && keyId !== void 0 ? keyId : fingerprintPublicKey(publicKey), alg: algorithm, use: "sig" });
+}
+/** Path pubblico della JWKS, oppure `undefined` quando si usa HS256. */
+function getAccessiJwksPath(options) {
+    var _a, _b;
+    const algorithm = (_a = options.jwtOptions.algorithm) !== null && _a !== void 0 ? _a : "HS256";
+    if (algorithm.startsWith("HS"))
+        return undefined;
+    return normalizePath((_b = options.jwtOptions.jwksPath) !== null && _b !== void 0 ? _b : DEFAULT_JWKS_PATH);
+}
+/**
+ * Costruisce la JWKS pubblica con chiave corrente e chiavi precedenti.
+ *
+ * Restituisce `null` per HS256 o quando non e configurata una chiave
+ * pubblica/privata asimmetrica.
+ */
+function buildAccessiJwks(options) {
+    var _a, _b, _c, _d;
+    const algorithm = (_a = options.jwtOptions.algorithm) !== null && _a !== void 0 ? _a : "HS256";
+    if (algorithm.startsWith("HS"))
+        return null;
+    const currentPublicKey = (_b = options.jwtOptions.publicKey) !== null && _b !== void 0 ? _b : options.jwtOptions.privateKey;
+    if (!currentPublicKey)
+        return null;
+    const keys = [
+        toJwksKey(currentPublicKey, options.jwtOptions.keyId, algorithm),
+    ];
+    for (const previous of (_c = options.jwtOptions.previousPublicKeys) !== null && _c !== void 0 ? _c : []) {
+        const previousAlgorithm = (_d = previous.algorithm) !== null && _d !== void 0 ? _d : algorithm;
+        keys.push(toJwksKey(previous.publicKey, previous.keyId, previousAlgorithm));
+    }
+    // Deduplica per kid: la chiave corrente vince sulle precedenti.
+    const unique = new Map();
+    for (const key of keys) {
+        if (!unique.has(key.kid))
+            unique.set(key.kid, key);
+    }
+    return { keys: [...unique.values()] };
+}
+/** Handler Express per la JWKS. Risponde 404 se la configurazione e HS256. */
+function createAccessiJwksHandler(options) {
+    return (_req, res) => {
+        const document = buildAccessiJwks(options);
+        if (!document) {
+            return res.status(404).json({
+                severity: "error",
+                status: 404,
+                statusCode: 2,
+                code: "ACCESSI_JWKS_NOT_AVAILABLE",
+                error: "ACCESSI_JWKS_NOT_AVAILABLE",
+                message: "JWKS non disponibile: Accessi usa HS256 o non ha una chiave asimmetrica.",
+            });
+        }
+        res.setHeader("Content-Type", "application/json");
+        res.setHeader("Cache-Control", "public, max-age=300");
+        return res.status(200).send(document);
+    };
+}
+function setupAccessiJwks(app, options) {
+    const path = getAccessiJwksPath(options);
+    if (!path)
+        return undefined;
+    app.get(path, createAccessiJwksHandler(options));
+    return path;
+}
+//# sourceMappingURL=jwks.js.map

package/dist/accessi-module/security/jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../../src/accessi-module/security/jwks.ts"],"names":[],"mappings":";;AA0CA,gDAIC;AAQD,4CAuBC;AAGD,4DAoBC;AAYD,4CAQC;AAxHD,mCAAqD;AAgBrD,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAE1D,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,SAA0B;IACtD,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAChB,SAA0B,EAC1B,KAAyB,EACzB,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAe,CAAC;IAC/E,uCACK,GAAG,KACN,GAAG,EAAE,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,oBAAoB,CAAC,SAAS,CAAC,EAC7C,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,KAAK,IACV;AACJ,CAAC;AAED,wEAAwE;AACxE,SAAgB,kBAAkB,CAAC,OAAuB;;IACxD,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC;IAC1D,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,aAAa,CAAC,MAAA,OAAO,CAAC,UAAU,CAAC,QAAQ,mCAAI,iBAAiB,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,OAAuB;;IACtD,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC;IAC1D,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,gBAAgB,GAAG,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;IACvF,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,IAAI,GAAqB;QAC7B,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC;KACjE,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,MAAA,OAAO,CAAC,UAAU,CAAC,kBAAkB,mCAAI,EAAE,EAAE,CAAC;QACnE,MAAM,iBAAiB,GAAG,MAAA,QAAQ,CAAC,SAAS,mCAAI,SAAS,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,gEAAgE;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,SAAgB,wBAAwB,CACtC,OAAuB;IAEvB,OAAO,CAAC,IAAa,EAAE,GAAa,EAAmB,EAAE;QACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,GAAG;gBACX,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,4BAA4B;gBAClC,KAAK,EAAE,4BAA4B;gBACnC,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAYD,SAAgB,gBAAgB,CAC9B,GAA0B,EAC1B,OAAuB;IAEvB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { createHash, createPublicKey } from \"crypto\";\nimport type { JsonWebKey } from \"crypto\";\nimport type { Request, Response } from \"express\";\nimport type { AccessiOptions } from \"../AccessiModule\";\n\n/** Chiave pubblica in formato JWK, pronta per una risposta JWKS. */\nexport type AccessiJwksKey = JsonWebKey & {\n  kid: string;\n  alg: string;\n  use: \"sig\";\n};\n\nexport interface AccessiJwksDocument {\n  keys: AccessiJwksKey[];\n}\n\nconst DEFAULT_JWKS_PATH = \"accessi/.well-known/jwks.json\";\n\nfunction normalizePath(value: string): string {\n  return `/${value.replace(/^\\/+|\\/+$/g, \"\")}`;\n}\n\nfunction fingerprintPublicKey(publicKey: string | Buffer): string {\n  const der = createPublicKey(publicKey).export({ type: \"spki\", format: \"der\" });\n  return createHash(\"sha256\").update(der).digest(\"base64url\").slice(0, 16);\n}\n\nfunction toJwksKey(\n  publicKey: string | Buffer,\n  keyId: string | undefined,\n  algorithm: string,\n): AccessiJwksKey {\n  const jwk = createPublicKey(publicKey).export({ format: \"jwk\" }) as JsonWebKey;\n  return {\n    ...jwk,\n    kid: keyId ?? fingerprintPublicKey(publicKey),\n    alg: algorithm,\n    use: \"sig\",\n  };\n}\n\n/** Path pubblico della JWKS, oppure `undefined` quando si usa HS256. */\nexport function getAccessiJwksPath(options: AccessiOptions): string | undefined {\n  const algorithm = options.jwtOptions.algorithm ?? \"HS256\";\n  if (algorithm.startsWith(\"HS\")) return undefined;\n  return normalizePath(options.jwtOptions.jwksPath ?? DEFAULT_JWKS_PATH);\n}\n\n/**\n * Costruisce la JWKS pubblica con chiave corrente e chiavi precedenti.\n *\n * Restituisce `null` per HS256 o quando non e configurata una chiave\n * pubblica/privata asimmetrica.\n */\nexport function buildAccessiJwks(options: AccessiOptions): AccessiJwksDocument | null {\n  const algorithm = options.jwtOptions.algorithm ?? \"HS256\";\n  if (algorithm.startsWith(\"HS\")) return null;\n\n  const currentPublicKey = options.jwtOptions.publicKey ?? options.jwtOptions.privateKey;\n  if (!currentPublicKey) return null;\n\n  const keys: AccessiJwksKey[] = [\n    toJwksKey(currentPublicKey, options.jwtOptions.keyId, algorithm),\n  ];\n\n  for (const previous of options.jwtOptions.previousPublicKeys ?? []) {\n    const previousAlgorithm = previous.algorithm ?? algorithm;\n    keys.push(toJwksKey(previous.publicKey, previous.keyId, previousAlgorithm));\n  }\n\n  // Deduplica per kid: la chiave corrente vince sulle precedenti.\n  const unique = new Map<string, AccessiJwksKey>();\n  for (const key of keys) {\n    if (!unique.has(key.kid)) unique.set(key.kid, key);\n  }\n\n  return { keys: [...unique.values()] };\n}\n\n/** Handler Express per la JWKS. Risponde 404 se la configurazione e HS256. */\nexport function createAccessiJwksHandler(\n  options: AccessiOptions,\n): (req: Request, res: Response) => Response | void {\n  return (_req: Request, res: Response): Response | void => {\n    const document = buildAccessiJwks(options);\n    if (!document) {\n      return res.status(404).json({\n        severity: \"error\",\n        status: 404,\n        statusCode: 2,\n        code: \"ACCESSI_JWKS_NOT_AVAILABLE\",\n        error: \"ACCESSI_JWKS_NOT_AVAILABLE\",\n        message: \"JWKS non disponibile: Accessi usa HS256 o non ha una chiave asimmetrica.\",\n      });\n    }\n\n    res.setHeader(\"Content-Type\", \"application/json\");\n    res.setHeader(\"Cache-Control\", \"public, max-age=300\");\n    return res.status(200).send(document);\n  };\n}\n\n/**\n * Monta la route JWKS sull'Express host.\n *\n * Per un'app Nest esistente passare `app.getHttpAdapter().getInstance()`.\n * Restituisce il path montato, oppure `undefined` se HS256.\n */\nexport interface AccessiJwksExpressApp {\n  get(path: string, handler: (req: Request, res: Response) => unknown): unknown;\n}\n\nexport function setupAccessiJwks(\n  app: AccessiJwksExpressApp,\n  options: AccessiOptions,\n): string | undefined {\n  const path = getAccessiJwksPath(options);\n  if (!path) return undefined;\n  app.get(path, createAccessiJwksHandler(options));\n  return path;\n}\n"]}

package/dist/accessi-module/security/publicAuthRateLimit.d.ts

@@ -1,10 +1,12 @@
 import { Request, Response } from 'express';
 import type { AccessiOptions } from '../AccessiModule';
+import type { RateLimitDecision } from './rateLimitStore';
 export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken' | 'adminBootstrap' | 'consoleEntry';
-type RateLimitDecision = {
-    allowed: boolean;
-    retryAfterSeconds: number;
-};
-export declare function checkPublicAuthRateLimit(options: AccessiOptions, scope: PublicAuthRateLimitScope, req: Request, identifiers?: string[]): RateLimitDecision;
+/**
+ * Applica il rate limit per IP e, opzionalmente, per soggetto.
+ *
+ * Con `publicAuthRateLimit.store` e possibile usare uno store Redis condiviso;
+ * senza store usa la memoria del processo.
+ */
+export declare function checkPublicAuthRateLimit(options: AccessiOptions, scope: PublicAuthRateLimitScope, req: Request, identifiers?: string[]): Promise<RateLimitDecision>;
 export declare function sendPublicAuthRateLimitExceeded(res: Response, retryAfterSeconds: number): Response;
-export {};

package/dist/accessi-module/security/publicAuthRateLimit.js

@@ -1,9 +1,19 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkPublicAuthRateLimit = checkPublicAuthRateLimit;
 exports.sendPublicAuthRateLimitExceeded = sendPublicAuthRateLimitExceeded;
 const common_1 = require("@nestjs/common");
 const Utilities_1 = require("../../Utilities");
+const rateLimitStore_1 = require("./rateLimitStore");
 const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
     twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },
@@ -15,9 +25,6 @@ const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
     consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
 };
-const RATE_LIMIT_BUCKETS = new Map();
-const MAX_TRACKED_BUCKETS = 20000;
-const MAX_WINDOW_MS = Math.max(...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs));
 function getRule(options, scope) {
     var _a;
     const configuredRule = (_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a[scope];
@@ -33,6 +40,19 @@ function getRule(options, scope) {
     }
     return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];
 }
+function consumeRateLimit(store, key, rule) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            return yield store.consume(key, rule.windowMs, rule.maxAttempts);
+        }
+        catch (_a) {
+            throw new common_1.HttpException({
+                code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',
+                message: 'Rate limit non disponibile. Riprova piu tardi.',
+            }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+        }
+    });
+}
 function normalizeIdentifier(identifier) {
     if (typeof identifier !== 'string') {
         return null;
@@ -40,87 +60,43 @@ function normalizeIdentifier(identifier) {
     const normalized = identifier.trim().toLowerCase();
     return normalized === '' ? null : normalized;
 }
-function pruneRateLimitBuckets(now) {
-    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {
-        return;
-    }
-    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {
-        if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {
-            RATE_LIMIT_BUCKETS.delete(key);
+/**
+ * Applica il rate limit per IP e, opzionalmente, per soggetto.
+ *
+ * Con `publicAuthRateLimit.store` e possibile usare uno store Redis condiviso;
+ * senza store usa la memoria del processo.
+ */
+function checkPublicAuthRateLimit(options_1, scope_1, req_1) {
+    return __awaiter(this, arguments, void 0, function* (options, scope, req, identifiers = []) {
+        var _a, _b, _c, _d, _e, _f, _g;
+        if (((_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.enabled) === false) {
+            return { allowed: true, retryAfterSeconds: 0 };
         }
-        if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {
-            return;
+        const rule = getRule(options, scope);
+        const store = (_c = (_b = options.publicAuthRateLimit) === null || _b === void 0 ? void 0 : _b.store) !== null && _c !== void 0 ? _c : (0, rateLimitStore_1.getDefaultRateLimitStore)();
+        const ipAddress = (_g = normalizeIdentifier((_f = (_d = req.ip) !== null && _d !== void 0 ? _d : (_e = req.socket) === null || _e === void 0 ? void 0 : _e.remoteAddress) !== null && _f !== void 0 ? _f : 'unknown')) !== null && _g !== void 0 ? _g : 'unknown';
+        // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,
+        // evitando crescita di memoria con identificatori sempre diversi.
+        const ipDecision = yield consumeRateLimit(store, `${scope}|ip|${ipAddress}`, rule);
+        if (!ipDecision.allowed) {
+            return ipDecision;
         }
-    }
-}
-/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */
-function enforceBucketCap() {
-    while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {
-        let oldestKey;
-        let oldestSeen = Number.POSITIVE_INFINITY;
-        for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {
-            if (bucket.lastSeenAt < oldestSeen) {
-                oldestSeen = bucket.lastSeenAt;
-                oldestKey = key;
+        let retryAfterSeconds = 0;
+        for (const identifier of identifiers) {
+            const normalizedIdentifier = normalizeIdentifier(identifier);
+            if (!normalizedIdentifier) {
+                continue;
+            }
+            const subjectDecision = yield consumeRateLimit(store, `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`, rule);
+            if (!subjectDecision.allowed) {
+                retryAfterSeconds = Math.max(retryAfterSeconds, subjectDecision.retryAfterSeconds);
             }
         }
-        if (oldestKey === undefined) {
-            return;
+        if (retryAfterSeconds > 0) {
+            return { allowed: false, retryAfterSeconds };
         }
-        RATE_LIMIT_BUCKETS.delete(oldestKey);
-    }
-}
-function consumeBucket(bucketKey, rule, now) {
-    const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);
-    if (!existingBucket || existingBucket.resetAt <= now) {
-        enforceBucketCap();
-        RATE_LIMIT_BUCKETS.set(bucketKey, {
-            count: 1,
-            resetAt: now + rule.windowMs,
-            lastSeenAt: now,
-        });
-        return null;
-    }
-    existingBucket.lastSeenAt = now;
-    if (existingBucket.count >= rule.maxAttempts) {
-        return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));
-    }
-    existingBucket.count += 1;
-    return null;
-}
-function checkPublicAuthRateLimit(options, scope, req, identifiers = []) {
-    var _a, _b, _c, _d, _e;
-    if (((_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.enabled) === false) {
         return { allowed: true, retryAfterSeconds: 0 };
-    }
-    const rule = getRule(options, scope);
-    const now = Date.now();
-    pruneRateLimitBuckets(now);
-    const ipAddress = (_e = normalizeIdentifier((_d = (_b = req.ip) !== null && _b !== void 0 ? _b : (_c = req.socket) === null || _c === void 0 ? void 0 : _c.remoteAddress) !== null && _d !== void 0 ? _d : 'unknown')) !== null && _e !== void 0 ? _e : 'unknown';
-    // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,
-    // evitando crescita di memoria con identificatori sempre diversi.
-    const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);
-    if (ipRetryAfterSeconds) {
-        return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };
-    }
-    let retryAfterSeconds = 0;
-    for (const identifier of identifiers) {
-        const normalizedIdentifier = normalizeIdentifier(identifier);
-        if (!normalizedIdentifier) {
-            continue;
-        }
-        const bucketRetryAfterSeconds = consumeBucket(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`, rule, now);
-        if (bucketRetryAfterSeconds) {
-            retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);
-        }
-    }
-    if (retryAfterSeconds > 0) {
-        return {
-            allowed: false,
-            retryAfterSeconds,
-        };
-    }
-    return { allowed: true, retryAfterSeconds: 0 };
+    });
 }
 function sendPublicAuthRateLimitExceeded(res, retryAfterSeconds) {
     res.setHeader('Retry-After', String(retryAfterSeconds));

package/dist/accessi-module/security/publicAuthRateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA6IA,4DAiDC;AAED,0EAWC;AA3MD,2CAA4C;AAE5C,+CAAgD;AAyBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC7D,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC3D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IAErF,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,aAAa,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,uBAAuB,GAAG,aAAa,CAC3C,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,EACJ,GAAG,CACJ,CAAC;QACF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\n\nexport type PublicAuthRateLimitScope =\n  | 'login'\n  | 'twoFactorVerify'\n  | 'twoFactorResend'\n  | 'register'\n  | 'passwordResetEmail'\n  | 'passwordResetConfirm'\n  | 'getUserByToken'\n  | 'adminBootstrap'\n  | 'consoleEntry';\n\ntype RateLimitBucket = {\n  count: number;\n  resetAt: number;\n  lastSeenAt: number;\n};\n\ntype RateLimitDecision = {\n  allowed: boolean;\n  retryAfterSeconds: number;\n};\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n  PublicAuthRateLimitScope,\n  PublicAuthRateLimitRuleOptions\n> = {\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n  twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n  adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n};\n\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\nconst MAX_TRACKED_BUCKETS = 20000;\nconst MAX_WINDOW_MS = Math.max(\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\n);\n\nfunction getRule(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n  const configuredRule = options.publicAuthRateLimit?.[scope];\n\n  if (\n    configuredRule &&\n    Number.isFinite(configuredRule.windowMs) &&\n    configuredRule.windowMs > 0 &&\n    Number.isFinite(configuredRule.maxAttempts) &&\n    configuredRule.maxAttempts > 0\n  ) {\n    return {\n      windowMs: Math.trunc(configuredRule.windowMs),\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\n    };\n  }\n\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nfunction normalizeIdentifier(identifier: string): string | null {\n  if (typeof identifier !== 'string') {\n    return null;\n  }\n\n  const normalized = identifier.trim().toLowerCase();\n  return normalized === '' ? null : normalized;\n}\n\nfunction pruneRateLimitBuckets(now: number): void {\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n    return;\n  }\n\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\n      RATE_LIMIT_BUCKETS.delete(key);\n    }\n\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n      return;\n    }\n  }\n}\n\n/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */\nfunction enforceBucketCap(): void {\n  while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {\n    let oldestKey: string | undefined;\n    let oldestSeen = Number.POSITIVE_INFINITY;\n\n    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n      if (bucket.lastSeenAt < oldestSeen) {\n        oldestSeen = bucket.lastSeenAt;\n        oldestKey = key;\n      }\n    }\n\n    if (oldestKey === undefined) {\n      return;\n    }\n\n    RATE_LIMIT_BUCKETS.delete(oldestKey);\n  }\n}\n\nfunction consumeBucket(\n  bucketKey: string,\n  rule: PublicAuthRateLimitRuleOptions,\n  now: number,\n): number | null {\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\n  if (!existingBucket || existingBucket.resetAt <= now) {\n    enforceBucketCap();\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\n      count: 1,\n      resetAt: now + rule.windowMs,\n      lastSeenAt: now,\n    });\n    return null;\n  }\n\n  existingBucket.lastSeenAt = now;\n  if (existingBucket.count >= rule.maxAttempts) {\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\n  }\n\n  existingBucket.count += 1;\n  return null;\n}\n\nexport function checkPublicAuthRateLimit(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n  req: Request,\n  identifiers: string[] = [],\n): RateLimitDecision {\n  if (options.publicAuthRateLimit?.enabled === false) {\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  const rule = getRule(options, scope);\n  const now = Date.now();\n  pruneRateLimitBuckets(now);\n\n  const ipAddress =\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n  // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n  // evitando crescita di memoria con identificatori sempre diversi.\n  const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);\n  if (ipRetryAfterSeconds) {\n    return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };\n  }\n\n  let retryAfterSeconds = 0;\n  for (const identifier of identifiers) {\n    const normalizedIdentifier = normalizeIdentifier(identifier);\n    if (!normalizedIdentifier) {\n      continue;\n    }\n\n    const bucketRetryAfterSeconds = consumeBucket(\n      `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`,\n      rule,\n      now,\n    );\n    if (bucketRetryAfterSeconds) {\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\n    }\n  }\n\n  if (retryAfterSeconds > 0) {\n    return {\n      allowed: false,\n      retryAfterSeconds,\n    };\n  }\n\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n  res: Response,\n  retryAfterSeconds: number,\n): Response {\n  res.setHeader('Retry-After', String(retryAfterSeconds));\n  return RestUtilities.sendErrorMessage(\n    res,\n    'Troppi tentativi. Riprova piu tardi.',\n    'PublicAuthRateLimit',\n    HttpStatus.TOO_MANY_REQUESTS,\n  );\n}\n"]}
+{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;;;;;;;;;;AAwFA,4DA4CC;AAED,0EAWC;AAjJD,2CAA2D;AAE3D,+CAAgD;AAEhD,qDAA4D;AAc5D,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC7D,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC3D,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAe,gBAAgB,CAC7B,KAAqB,EACrB,GAAW,EACX,IAAoC;;QAEpC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,sBAAa,CACrB;gBACE,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,gDAAgD;aAC1D,EACD,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;CAAA;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAsB,wBAAwB;yDAC5C,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;QAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,KAAK,mCAAI,IAAA,yCAAwB,GAAE,CAAC;QAC/E,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;QAErF,gFAAgF;QAChF,kEAAkE;QAClE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAC5C,KAAK,EACL,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,CACL,CAAC;YACF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC7B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAC/C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;CAAA;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpException, HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\nimport { getDefaultRateLimitStore } from './rateLimitStore';\nimport type { RateLimitDecision, RateLimitStore } from './rateLimitStore';\n\nexport type PublicAuthRateLimitScope =\n  | 'login'\n  | 'twoFactorVerify'\n  | 'twoFactorResend'\n  | 'register'\n  | 'passwordResetEmail'\n  | 'passwordResetConfirm'\n  | 'getUserByToken'\n  | 'adminBootstrap'\n  | 'consoleEntry';\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n  PublicAuthRateLimitScope,\n  PublicAuthRateLimitRuleOptions\n> = {\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n  twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n  adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n};\n\nfunction getRule(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n  const configuredRule = options.publicAuthRateLimit?.[scope];\n\n  if (\n    configuredRule &&\n    Number.isFinite(configuredRule.windowMs) &&\n    configuredRule.windowMs > 0 &&\n    Number.isFinite(configuredRule.maxAttempts) &&\n    configuredRule.maxAttempts > 0\n  ) {\n    return {\n      windowMs: Math.trunc(configuredRule.windowMs),\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\n    };\n  }\n\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nasync function consumeRateLimit(\n  store: RateLimitStore,\n  key: string,\n  rule: PublicAuthRateLimitRuleOptions,\n): Promise<RateLimitDecision> {\n  try {\n    return await store.consume(key, rule.windowMs, rule.maxAttempts);\n  } catch {\n    throw new HttpException(\n      {\n        code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',\n        message: 'Rate limit non disponibile. Riprova piu tardi.',\n      },\n      HttpStatus.SERVICE_UNAVAILABLE,\n    );\n  }\n}\n\nfunction normalizeIdentifier(identifier: string): string | null {\n  if (typeof identifier !== 'string') {\n    return null;\n  }\n\n  const normalized = identifier.trim().toLowerCase();\n  return normalized === '' ? null : normalized;\n}\n\n/**\n * Applica il rate limit per IP e, opzionalmente, per soggetto.\n *\n * Con `publicAuthRateLimit.store` e possibile usare uno store Redis condiviso;\n * senza store usa la memoria del processo.\n */\nexport async function checkPublicAuthRateLimit(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n  req: Request,\n  identifiers: string[] = [],\n): Promise<RateLimitDecision> {\n  if (options.publicAuthRateLimit?.enabled === false) {\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  const rule = getRule(options, scope);\n  const store = options.publicAuthRateLimit?.store ?? getDefaultRateLimitStore();\n  const ipAddress =\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n  // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n  // evitando crescita di memoria con identificatori sempre diversi.\n  const ipDecision = await consumeRateLimit(store, `${scope}|ip|${ipAddress}`, rule);\n  if (!ipDecision.allowed) {\n    return ipDecision;\n  }\n\n  let retryAfterSeconds = 0;\n  for (const identifier of identifiers) {\n    const normalizedIdentifier = normalizeIdentifier(identifier);\n    if (!normalizedIdentifier) {\n      continue;\n    }\n\n    const subjectDecision = await consumeRateLimit(\n      store,\n      `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`,\n      rule,\n    );\n    if (!subjectDecision.allowed) {\n      retryAfterSeconds = Math.max(retryAfterSeconds, subjectDecision.retryAfterSeconds);\n    }\n  }\n\n  if (retryAfterSeconds > 0) {\n    return { allowed: false, retryAfterSeconds };\n  }\n\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n  res: Response,\n  retryAfterSeconds: number,\n): Response {\n  res.setHeader('Retry-After', String(retryAfterSeconds));\n  return RestUtilities.sendErrorMessage(\n    res,\n    'Troppi tentativi. Riprova piu tardi.',\n    'PublicAuthRateLimit',\n    HttpStatus.TOO_MANY_REQUESTS,\n  );\n}\n"]}

package/dist/accessi-module/security/rateLimitStore.d.ts

@@ -0,0 +1,32 @@
+/** Esito di un controllo di rate limit. */
+export interface RateLimitDecision {
+    allowed: boolean;
+    retryAfterSeconds: number;
+}
+/** Store pluggable per rate limit: memoria per singola istanza, Redis per cluster. */
+export interface RateLimitStore {
+    consume(key: string, windowMs: number, maxAttempts: number): Promise<RateLimitDecision>;
+}
+export interface MemoryRateLimitStore extends RateLimitStore {
+    reset(): void;
+}
+/** Store in memoria con finestra fissa e limite di bucket. */
+export declare function createMemoryRateLimitStore(maxBuckets?: number): MemoryRateLimitStore;
+/** Store di default in memoria, usato quando non viene configurato uno store condiviso. */
+export declare function getDefaultRateLimitStore(): MemoryRateLimitStore;
+/** Client Redis minimale: compatibile con ioredis (`redis.eval(script, numKeys, ...args)`). */
+export interface RateLimitRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+export interface RedisRateLimitStoreOptions {
+    client: RateLimitRedisClient;
+    /** Default: `accessi:rate:`. */
+    keyPrefix?: string;
+}
+/**
+ * Store Redis per rate limit distribuito.
+ *
+ * Usa `INCR` + `PEXPIRE` atomici. Adatto a login, reset password, 2FA,
+ * console entry e service token in deployment multi-istanza.
+ */
+export declare function createRedisRateLimitStore(options: RedisRateLimitStoreOptions): RateLimitStore;

package/dist/accessi-module/security/rateLimitStore.js

@@ -0,0 +1,129 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemoryRateLimitStore = createMemoryRateLimitStore;
+exports.getDefaultRateLimitStore = getDefaultRateLimitStore;
+exports.createRedisRateLimitStore = createRedisRateLimitStore;
+const DEFAULT_MAX_BUCKETS = 20000;
+function normalizeLimits(windowMs, maxAttempts) {
+    return {
+        windowMs: Math.max(1, Math.trunc(windowMs)),
+        maxAttempts: Math.max(1, Math.trunc(maxAttempts)),
+    };
+}
+/** Store in memoria con finestra fissa e limite di bucket. */
+function createMemoryRateLimitStore(maxBuckets = DEFAULT_MAX_BUCKETS) {
+    const buckets = new Map();
+    const safeMaxBuckets = Math.max(1, Math.trunc(maxBuckets));
+    const prune = (now) => {
+        if (buckets.size < safeMaxBuckets)
+            return;
+        for (const [key, bucket] of buckets) {
+            if (bucket.resetAt <= now)
+                buckets.delete(key);
+        }
+    };
+    const enforceCap = () => {
+        while (buckets.size >= safeMaxBuckets) {
+            let oldestKey;
+            let oldestSeen = Number.POSITIVE_INFINITY;
+            for (const [key, bucket] of buckets) {
+                if (bucket.lastSeenAt < oldestSeen) {
+                    oldestSeen = bucket.lastSeenAt;
+                    oldestKey = key;
+                }
+            }
+            if (oldestKey === undefined)
+                return;
+            buckets.delete(oldestKey);
+        }
+    };
+    return {
+        consume(key, windowMs, maxAttempts) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const limits = normalizeLimits(windowMs, maxAttempts);
+                const now = Date.now();
+                prune(now);
+                const existing = buckets.get(key);
+                if (!existing || existing.resetAt <= now) {
+                    enforceCap();
+                    buckets.set(key, {
+                        count: 1,
+                        resetAt: now + limits.windowMs,
+                        lastSeenAt: now,
+                    });
+                    return { allowed: true, retryAfterSeconds: 0 };
+                }
+                existing.lastSeenAt = now;
+                if (existing.count >= limits.maxAttempts) {
+                    return {
+                        allowed: false,
+                        retryAfterSeconds: Math.max(1, Math.ceil((existing.resetAt - now) / 1000)),
+                    };
+                }
+                existing.count += 1;
+                return { allowed: true, retryAfterSeconds: 0 };
+            });
+        },
+        reset() {
+            buckets.clear();
+        },
+    };
+}
+const defaultStore = createMemoryRateLimitStore();
+/** Store di default in memoria, usato quando non viene configurato uno store condiviso. */
+function getDefaultRateLimitStore() {
+    return defaultStore;
+}
+const REDIS_SCRIPT = `
+local current = redis.call('INCR', KEYS[1])
+if current == 1 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+local ttl = redis.call('PTTL', KEYS[1])
+if current > tonumber(ARGV[2]) then
+  return {0, ttl}
+end
+return {1, ttl}
+`;
+/**
+ * Store Redis per rate limit distribuito.
+ *
+ * Usa `INCR` + `PEXPIRE` atomici. Adatto a login, reset password, 2FA,
+ * console entry e service token in deployment multi-istanza.
+ */
+function createRedisRateLimitStore(options) {
+    var _a;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis rate limit store: client.eval non configurato.');
+    }
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:rate:').replace(/:+$/, ':');
+    return {
+        consume(key, windowMs, maxAttempts) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const limits = normalizeLimits(windowMs, maxAttempts);
+                const raw = yield options.client.eval(REDIS_SCRIPT, 1, `${keyPrefix}${key}`, limits.windowMs, limits.maxAttempts);
+                if (!Array.isArray(raw) || raw.length < 2) {
+                    throw new Error('Redis rate limit store: risposta non valida.');
+                }
+                const allowed = Number(raw[0]) === 1;
+                const ttlMs = Number(raw[1]);
+                return {
+                    allowed,
+                    retryAfterSeconds: allowed
+                        ? 0
+                        : Math.max(1, Number.isFinite(ttlMs) && ttlMs > 0 ? Math.ceil(ttlMs / 1000) : 1),
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=rateLimitStore.js.map

package/dist/accessi-module/security/rateLimitStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimitStore.js","sourceRoot":"","sources":["../../../src/accessi-module/security/rateLimitStore.ts"],"names":[],"mappings":";;;;;;;;;;;AA+BA,gEA4DC;AAKD,4DAEC;AA+BD,8DAkCC;AA9ID,MAAM,mBAAmB,GAAG,KAAM,CAAC;AAEnC,SAAS,eAAe,CAAC,QAAgB,EAAE,WAAmB;IAC5D,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3C,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,0BAA0B,CACxC,aAAqB,mBAAmB;IAExC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,IAAI,OAAO,CAAC,IAAI,GAAG,cAAc;YAAE,OAAO;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,OAAO,OAAO,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,SAA6B,CAAC;YAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACpC,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;oBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;oBAC/B,SAAS,GAAG,GAAG,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO;YACpC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACC,OAAO,CAAC,GAAW,EAAE,QAAgB,EAAE,WAAmB;;gBAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,CAAC;gBAEX,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;oBACzC,UAAU,EAAE,CAAC;oBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;wBACf,KAAK,EAAE,CAAC;wBACR,OAAO,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ;wBAC9B,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;oBACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;gBACjD,CAAC;gBAED,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACzC,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;qBAC3E,CAAC;gBACJ,CAAC;gBAED,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACjD,CAAC;SAAA;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;AAElD,2FAA2F;AAC3F,SAAgB,wBAAwB;IACtC,OAAO,YAAY,CAAC;AACtB,CAAC;AAaD,MAAM,YAAY,GAAG;;;;;;;;;;CAUpB,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,yBAAyB,CACvC,OAAmC;;IAEnC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,eAAe,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE7E,OAAO;QACC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW;;gBACtC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACnC,YAAY,EACZ,CAAC,EACD,GAAG,SAAS,GAAG,GAAG,EAAE,EACpB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,WAAW,CACnB,CAAC;gBAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,OAAO;oBACL,OAAO;oBACP,iBAAiB,EAAE,OAAO;wBACxB,CAAC,CAAC,CAAC;wBACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;iBACnF,CAAC;YACJ,CAAC;SAAA;KACF,CAAC;AACJ,CAAC","sourcesContent":["/** Esito di un controllo di rate limit. */\nexport interface RateLimitDecision {\n  allowed: boolean;\n  retryAfterSeconds: number;\n}\n\n/** Store pluggable per rate limit: memoria per singola istanza, Redis per cluster. */\nexport interface RateLimitStore {\n  consume(key: string, windowMs: number, maxAttempts: number): Promise<RateLimitDecision>;\n}\n\nexport interface MemoryRateLimitStore extends RateLimitStore {\n  reset(): void;\n}\n\ninterface RateLimitBucket {\n  count: number;\n  resetAt: number;\n  lastSeenAt: number;\n}\n\nconst DEFAULT_MAX_BUCKETS = 20_000;\n\nfunction normalizeLimits(windowMs: number, maxAttempts: number): { windowMs: number; maxAttempts: number } {\n  return {\n    windowMs: Math.max(1, Math.trunc(windowMs)),\n    maxAttempts: Math.max(1, Math.trunc(maxAttempts)),\n  };\n}\n\n/** Store in memoria con finestra fissa e limite di bucket. */\nexport function createMemoryRateLimitStore(\n  maxBuckets: number = DEFAULT_MAX_BUCKETS,\n): MemoryRateLimitStore {\n  const buckets = new Map<string, RateLimitBucket>();\n  const safeMaxBuckets = Math.max(1, Math.trunc(maxBuckets));\n\n  const prune = (now: number): void => {\n    if (buckets.size < safeMaxBuckets) return;\n    for (const [key, bucket] of buckets) {\n      if (bucket.resetAt <= now) buckets.delete(key);\n    }\n  };\n\n  const enforceCap = (): void => {\n    while (buckets.size >= safeMaxBuckets) {\n      let oldestKey: string | undefined;\n      let oldestSeen = Number.POSITIVE_INFINITY;\n      for (const [key, bucket] of buckets) {\n        if (bucket.lastSeenAt < oldestSeen) {\n          oldestSeen = bucket.lastSeenAt;\n          oldestKey = key;\n        }\n      }\n      if (oldestKey === undefined) return;\n      buckets.delete(oldestKey);\n    }\n  };\n\n  return {\n    async consume(key: string, windowMs: number, maxAttempts: number): Promise<RateLimitDecision> {\n      const limits = normalizeLimits(windowMs, maxAttempts);\n      const now = Date.now();\n      prune(now);\n\n      const existing = buckets.get(key);\n      if (!existing || existing.resetAt <= now) {\n        enforceCap();\n        buckets.set(key, {\n          count: 1,\n          resetAt: now + limits.windowMs,\n          lastSeenAt: now,\n        });\n        return { allowed: true, retryAfterSeconds: 0 };\n      }\n\n      existing.lastSeenAt = now;\n      if (existing.count >= limits.maxAttempts) {\n        return {\n          allowed: false,\n          retryAfterSeconds: Math.max(1, Math.ceil((existing.resetAt - now) / 1000)),\n        };\n      }\n\n      existing.count += 1;\n      return { allowed: true, retryAfterSeconds: 0 };\n    },\n    reset() {\n      buckets.clear();\n    },\n  };\n}\n\nconst defaultStore = createMemoryRateLimitStore();\n\n/** Store di default in memoria, usato quando non viene configurato uno store condiviso. */\nexport function getDefaultRateLimitStore(): MemoryRateLimitStore {\n  return defaultStore;\n}\n\n/** Client Redis minimale: compatibile con ioredis (`redis.eval(script, numKeys, ...args)`). */\nexport interface RateLimitRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisRateLimitStoreOptions {\n  client: RateLimitRedisClient;\n  /** Default: `accessi:rate:`. */\n  keyPrefix?: string;\n}\n\nconst REDIS_SCRIPT = `\nlocal current = redis.call('INCR', KEYS[1])\nif current == 1 then\n  redis.call('PEXPIRE', KEYS[1], ARGV[1])\nend\nlocal ttl = redis.call('PTTL', KEYS[1])\nif current > tonumber(ARGV[2]) then\n  return {0, ttl}\nend\nreturn {1, ttl}\n`;\n\n/**\n * Store Redis per rate limit distribuito.\n *\n * Usa `INCR` + `PEXPIRE` atomici. Adatto a login, reset password, 2FA,\n * console entry e service token in deployment multi-istanza.\n */\nexport function createRedisRateLimitStore(\n  options: RedisRateLimitStoreOptions,\n): RateLimitStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis rate limit store: client.eval non configurato.');\n  }\n\n  const keyPrefix = (options.keyPrefix ?? 'accessi:rate:').replace(/:+$/, ':');\n\n  return {\n    async consume(key, windowMs, maxAttempts) {\n      const limits = normalizeLimits(windowMs, maxAttempts);\n      const raw = await options.client.eval(\n        REDIS_SCRIPT,\n        1,\n        `${keyPrefix}${key}`,\n        limits.windowMs,\n        limits.maxAttempts,\n      );\n\n      if (!Array.isArray(raw) || raw.length < 2) {\n        throw new Error('Redis rate limit store: risposta non valida.');\n      }\n\n      const allowed = Number(raw[0]) === 1;\n      const ttlMs = Number(raw[1]);\n      return {\n        allowed,\n        retryAfterSeconds: allowed\n          ? 0\n          : Math.max(1, Number.isFinite(ttlMs) && ttlMs > 0 ? Math.ceil(ttlMs / 1000) : 1),\n      };\n    },\n  };\n}\n"]}

package/dist/accessi-module/security/serviceTokenGuard.d.ts

@@ -1,6 +1,7 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import type { Request } from 'express';
+import type { AccessiOptions } from '../AccessiModule';
 import { ServiceTokenService, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';
 /** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */
 export declare const SERVICE_TOKEN_SCOPES_METADATA = "accessi:service-token-scopes";
@@ -20,6 +21,7 @@ export declare function getAccessiServiceToken(req: Request): VerifiedServiceTok
 export declare class ServiceTokenGuard implements CanActivate {
     private readonly serviceTokenService;
     private readonly reflector;
-    constructor(serviceTokenService: ServiceTokenService, reflector: Reflector);
+    private readonly accessiOptions;
+    constructor(serviceTokenService: ServiceTokenService, reflector: Reflector, accessiOptions: AccessiOptions);
     canActivate(context: ExecutionContext): Promise<boolean>;
 }

package/dist/accessi-module/security/serviceTokenGuard.js

@@ -8,6 +8,9 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -45,16 +48,17 @@ function getAccessiServiceToken(req) {
  * con `@RequireServiceTokenScopes('ia')`.
  */
 let ServiceTokenGuard = class ServiceTokenGuard {
-    constructor(serviceTokenService, reflector) {
+    constructor(serviceTokenService, reflector, accessiOptions) {
         this.serviceTokenService = serviceTokenService;
         this.reflector = reflector;
+        this.accessiOptions = accessiOptions;
     }
     canActivate(context) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d;
+            var _a, _b, _c, _d, _e;
             const request = context.switchToHttp().getRequest();
             const ip = (_c = (_a = request.ip) !== null && _a !== void 0 ? _a : (_b = request.socket) === null || _b === void 0 ? void 0 : _b.remoteAddress) !== null && _c !== void 0 ? _c : 'unknown';
-            (0, serviceTokenRateLimit_1.assertServiceTokenRateLimit)(ip);
+            yield (0, serviceTokenRateLimit_1.assertServiceTokenRateLimit)(ip, (_d = this.accessiOptions.serviceTokens) === null || _d === void 0 ? void 0 : _d.rateLimitStore);
             const token = (0, authenticatedToken_1.extractAccessiBearerToken)(request.headers['authorization']);
             if (!token) {
                 throw new common_1.UnauthorizedException('Token di servizio mancante.');
@@ -64,10 +68,10 @@ let ServiceTokenGuard = class ServiceTokenGuard {
                 throw new common_1.UnauthorizedException('Token di servizio non valido, scaduto o revocato.');
             }
             request.accessiServiceToken = verified;
-            const requiredScopes = (_d = this.reflector.getAllAndOverride(exports.SERVICE_TOKEN_SCOPES_METADATA, [
+            const requiredScopes = (_e = this.reflector.getAllAndOverride(exports.SERVICE_TOKEN_SCOPES_METADATA, [
                 context.getHandler(),
                 context.getClass(),
-            ])) !== null && _d !== void 0 ? _d : [];
+            ])) !== null && _e !== void 0 ? _e : [];
             const missingScope = requiredScopes.find((scope) => !(0, ServiceTokenService_1.serviceTokenHasScope)(verified.scopes, scope));
             if (missingScope) {
                 throw new common_1.ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);
@@ -79,7 +83,8 @@ let ServiceTokenGuard = class ServiceTokenGuard {
 exports.ServiceTokenGuard = ServiceTokenGuard;
 exports.ServiceTokenGuard = ServiceTokenGuard = __decorate([
     (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)('ACCESSI_OPTIONS')),
     __metadata("design:paramtypes", [ServiceTokenService_1.ServiceTokenService,
-        core_1.Reflector])
+        core_1.Reflector, Object])
 ], ServiceTokenGuard);
 //# sourceMappingURL=serviceTokenGuard.js.map