emilsoftware-utilities 2.0.0-dev.67 → 2.0.0-dev.68

package/dist/accessi-module/security/serviceTokenGuard.js.map

@@ -1 +1 @@
-{"version":3,"file":"serviceTokenGuard.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenGuard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuBA,wDAMC;AA7BD,2CAOwB;AACxB,uCAAyC;AAEzC,6FAAsI;AACtI,6DAAiE;AACjE,mEAAsE;AAEtE,iEAAiE;AACpD,QAAA,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,2EAA2E;AACpE,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAgB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,qCAA6B,EAAE,MAAM,CAAC,CAAC;AAAxG,QAAA,yBAAyB,6BAA+E;AAIrH,iGAAiG;AACjG,SAAgB,sBAAsB,CAAC,GAAY;IACjD,MAAM,QAAQ,GAAI,GAAkC,CAAC,mBAAmB,CAAC;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,8BAAqB,CAAC,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,mBAAwC,EACxC,SAAoB;QADpB,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEE,WAAW,CAAC,OAAyB;;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;YAC7D,MAAM,EAAE,GAAG,MAAA,MAAA,OAAO,CAAC,EAAE,mCAAI,MAAA,OAAO,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC;YACpE,IAAA,mDAA2B,EAAC,EAAE,CAAC,CAAC;YAEhC,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,8BAAqB,CAAC,mDAAmD,CAAC,CAAC;YACvF,CAAC;YAEA,OAAsC,CAAC,mBAAmB,GAAG,QAAQ,CAAC;YAEvE,MAAM,cAAc,GAAG,MAAA,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,qCAA6B,EAAE;gBAC/F,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,mCAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAA,0CAAoB,EAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,2BAAkB,CAAC,UAAU,YAAY,qCAAqC,CAAC,CAAC;YAC5F,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;CACF,CAAA;AAlCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAG6B,yCAAmB;QAC7B,gBAAS;GAH5B,iBAAiB,CAkC7B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport type { Request } from 'express';\nimport { ServiceTokenService, serviceTokenHasScope, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';\nimport { extractAccessiBearerToken } from './authenticatedToken';\nimport { assertServiceTokenRateLimit } from './serviceTokenRateLimit';\n\n/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */\nexport const SERVICE_TOKEN_SCOPES_METADATA = 'accessi:service-token-scopes';\n\n/** Richiede che il token di servizio presenti tutti gli scope indicati. */\nexport const RequireServiceTokenScopes = (...scopes: string[]) => SetMetadata(SERVICE_TOKEN_SCOPES_METADATA, scopes);\n\nexport type AccessiServiceTokenRequest = Request & { accessiServiceToken?: VerifiedServiceToken };\n\n/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */\nexport function getAccessiServiceToken(req: Request): VerifiedServiceToken {\n  const verified = (req as AccessiServiceTokenRequest).accessiServiceToken;\n  if (!verified) {\n    throw new UnauthorizedException('Token di servizio non verificato.');\n  }\n  return verified;\n}\n\n/**\n * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.\n *\n * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano\n * con `@RequireServiceTokenScopes('ia')`.\n */\n@Injectable()\nexport class ServiceTokenGuard implements CanActivate {\n  constructor(\n    private readonly serviceTokenService: ServiceTokenService,\n    private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest<Request>();\n    const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';\n    assertServiceTokenRateLimit(ip);\n\n    const token = extractAccessiBearerToken(request.headers['authorization']);\n    if (!token) {\n      throw new UnauthorizedException('Token di servizio mancante.');\n    }\n\n    const verified = await this.serviceTokenService.verify(token, { ip });\n    if (!verified) {\n      throw new UnauthorizedException('Token di servizio non valido, scaduto o revocato.');\n    }\n\n    (request as AccessiServiceTokenRequest).accessiServiceToken = verified;\n\n    const requiredScopes = this.reflector.getAllAndOverride<string[]>(SERVICE_TOKEN_SCOPES_METADATA, [\n      context.getHandler(),\n      context.getClass(),\n    ]) ?? [];\n    const missingScope = requiredScopes.find((scope) => !serviceTokenHasScope(verified.scopes, scope));\n    if (missingScope) {\n      throw new ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);\n    }\n\n    return true;\n  }\n}\n"]}
+{"version":3,"file":"serviceTokenGuard.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenGuard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyBA,wDAMC;AA/BD,2CAQwB;AACxB,uCAAyC;AAGzC,6FAAsI;AACtI,6DAAiE;AACjE,mEAAsE;AAEtE,iEAAiE;AACpD,QAAA,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,2EAA2E;AACpE,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAgB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,qCAA6B,EAAE,MAAM,CAAC,CAAC;AAAxG,QAAA,yBAAyB,6BAA+E;AAIrH,iGAAiG;AACjG,SAAgB,sBAAsB,CAAC,GAAY;IACjD,MAAM,QAAQ,GAAI,GAAkC,CAAC,mBAAmB,CAAC;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,8BAAqB,CAAC,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,mBAAwC,EACxC,SAAoB,EACO,cAA8B;QAFzD,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,cAAS,GAAT,SAAS,CAAW;QACO,mBAAc,GAAd,cAAc,CAAgB;IACzE,CAAC;IAEE,WAAW,CAAC,OAAyB;;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;YAC7D,MAAM,EAAE,GAAG,MAAA,MAAA,OAAO,CAAC,EAAE,mCAAI,MAAA,OAAO,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC;YACpE,MAAM,IAAA,mDAA2B,EAAC,EAAE,EAAE,MAAA,IAAI,CAAC,cAAc,CAAC,aAAa,0CAAE,cAAc,CAAC,CAAC;YAEzF,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,8BAAqB,CAAC,mDAAmD,CAAC,CAAC;YACvF,CAAC;YAEA,OAAsC,CAAC,mBAAmB,GAAG,QAAQ,CAAC;YAEvE,MAAM,cAAc,GAAG,MAAA,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,qCAA6B,EAAE;gBAC/F,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,mCAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAA,0CAAoB,EAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,2BAAkB,CAAC,UAAU,YAAY,qCAAqC,CAAC,CAAC;YAC5F,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;CACF,CAAA;AAnCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFY,yCAAmB;QAC7B,gBAAS;GAH5B,iBAAiB,CAmC7B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport type { Request } from 'express';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ServiceTokenService, serviceTokenHasScope, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';\nimport { extractAccessiBearerToken } from './authenticatedToken';\nimport { assertServiceTokenRateLimit } from './serviceTokenRateLimit';\n\n/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */\nexport const SERVICE_TOKEN_SCOPES_METADATA = 'accessi:service-token-scopes';\n\n/** Richiede che il token di servizio presenti tutti gli scope indicati. */\nexport const RequireServiceTokenScopes = (...scopes: string[]) => SetMetadata(SERVICE_TOKEN_SCOPES_METADATA, scopes);\n\nexport type AccessiServiceTokenRequest = Request & { accessiServiceToken?: VerifiedServiceToken };\n\n/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */\nexport function getAccessiServiceToken(req: Request): VerifiedServiceToken {\n  const verified = (req as AccessiServiceTokenRequest).accessiServiceToken;\n  if (!verified) {\n    throw new UnauthorizedException('Token di servizio non verificato.');\n  }\n  return verified;\n}\n\n/**\n * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.\n *\n * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano\n * con `@RequireServiceTokenScopes('ia')`.\n */\n@Injectable()\nexport class ServiceTokenGuard implements CanActivate {\n  constructor(\n    private readonly serviceTokenService: ServiceTokenService,\n    private readonly reflector: Reflector,\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest<Request>();\n    const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';\n    await assertServiceTokenRateLimit(ip, this.accessiOptions.serviceTokens?.rateLimitStore);\n\n    const token = extractAccessiBearerToken(request.headers['authorization']);\n    if (!token) {\n      throw new UnauthorizedException('Token di servizio mancante.');\n    }\n\n    const verified = await this.serviceTokenService.verify(token, { ip });\n    if (!verified) {\n      throw new UnauthorizedException('Token di servizio non valido, scaduto o revocato.');\n    }\n\n    (request as AccessiServiceTokenRequest).accessiServiceToken = verified;\n\n    const requiredScopes = this.reflector.getAllAndOverride<string[]>(SERVICE_TOKEN_SCOPES_METADATA, [\n      context.getHandler(),\n      context.getClass(),\n    ]) ?? [];\n    const missingScope = requiredScopes.find((scope) => !serviceTokenHasScope(verified.scopes, scope));\n    if (missingScope) {\n      throw new ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);\n    }\n\n    return true;\n  }\n}\n"]}

package/dist/accessi-module/security/serviceTokenRateLimit.d.ts

@@ -1,8 +1,9 @@
-export declare function checkServiceTokenRateLimit(identifier: string): {
+import type { RateLimitStore } from './rateLimitStore';
+export declare function checkServiceTokenRateLimit(identifier: string, store?: RateLimitStore): Promise<{
     allowed: boolean;
     retryAfterSeconds: number;
-};
-/** Svuota i bucket (usato nei test). */
+}>;
+/** Svuota i bucket dello store di default (usato nei test). */
 export declare function resetServiceTokenRateLimit(): void;
 /** Lancia 429 con `Retry-After` quando il limite e superato. */
-export declare function assertServiceTokenRateLimit(identifier: string): void;
+export declare function assertServiceTokenRateLimit(identifier: string, store?: RateLimitStore): Promise<void>;

package/dist/accessi-module/security/serviceTokenRateLimit.js

@@ -1,49 +1,53 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkServiceTokenRateLimit = checkServiceTokenRateLimit;
 exports.resetServiceTokenRateLimit = resetServiceTokenRateLimit;
 exports.assertServiceTokenRateLimit = assertServiceTokenRateLimit;
 const common_1 = require("@nestjs/common");
+const rateLimitStore_1 = require("./rateLimitStore");
 /**
  * Limite anti-abuso per la verifica dei token di servizio.
  *
  * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita
- * che un client difettoso o malevolo martelli l'endpoint. In-memory: in cluster va
- * aggiunto un limite anche al gateway.
+ * che un client difettoso o malevolo martelli l'endpoint. Con `serviceTokens.rateLimitStore`
+ * e possibile usare uno store condiviso in cluster.
  */
 const WINDOW_MS = 60000;
 const MAX_ATTEMPTS = 120;
-const MAX_BUCKETS = 20000;
-const buckets = new Map();
-function checkServiceTokenRateLimit(identifier) {
-    const now = Date.now();
-    const key = identifier && identifier.trim() !== '' ? identifier : 'unknown';
-    const bucket = buckets.get(key);
-    if (!bucket || bucket.resetAt <= now) {
-        if (buckets.size >= MAX_BUCKETS) {
-            const oldestKey = buckets.keys().next().value;
-            if (oldestKey !== undefined) {
-                buckets.delete(oldestKey);
-            }
+function checkServiceTokenRateLimit(identifier_1) {
+    return __awaiter(this, arguments, void 0, function* (identifier, store = (0, rateLimitStore_1.getDefaultRateLimitStore)()) {
+        const key = identifier && identifier.trim() !== '' ? identifier.trim() : 'unknown';
+        try {
+            return yield store.consume(`service-token|${key}`, WINDOW_MS, MAX_ATTEMPTS);
         }
-        buckets.set(key, { count: 1, resetAt: now + WINDOW_MS });
-        return { allowed: true, retryAfterSeconds: 0 };
-    }
-    if (bucket.count >= MAX_ATTEMPTS) {
-        return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil((bucket.resetAt - now) / 1000)) };
-    }
-    bucket.count += 1;
-    return { allowed: true, retryAfterSeconds: 0 };
+        catch (_a) {
+            throw new common_1.HttpException({
+                code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',
+                message: 'Rate limit non disponibile. Riprova piu tardi.',
+            }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+        }
+    });
 }
-/** Svuota i bucket (usato nei test). */
+/** Svuota i bucket dello store di default (usato nei test). */
 function resetServiceTokenRateLimit() {
-    buckets.clear();
+    (0, rateLimitStore_1.getDefaultRateLimitStore)().reset();
 }
 /** Lancia 429 con `Retry-After` quando il limite e superato. */
-function assertServiceTokenRateLimit(identifier) {
-    const decision = checkServiceTokenRateLimit(identifier);
-    if (!decision.allowed) {
-        throw new common_1.HttpException({ code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' }, common_1.HttpStatus.TOO_MANY_REQUESTS);
-    }
+function assertServiceTokenRateLimit(identifier, store) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const decision = yield checkServiceTokenRateLimit(identifier, store);
+        if (!decision.allowed) {
+            throw new common_1.HttpException({ code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' }, common_1.HttpStatus.TOO_MANY_REQUESTS);
+        }
+    });
 }
 //# sourceMappingURL=serviceTokenRateLimit.js.map

package/dist/accessi-module/security/serviceTokenRateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"serviceTokenRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenRateLimit.ts"],"names":[],"mappings":";;AAgBA,gEAsBC;AAGD,gEAEC;AAGD,kEAQC;AAtDD,2CAA2D;AAI3D;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,KAAM,CAAC;AACzB,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,WAAW,GAAG,KAAM,CAAC;AAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEnD,SAAgB,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;IACtG,CAAC;IAED,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,wCAAwC;AACxC,SAAgB,0BAA0B;IACxC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,gEAAgE;AAChE,SAAgB,2BAA2B,CAAC,UAAkB;IAC5D,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,sBAAa,CACrB,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAC/F,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { HttpException, HttpStatus } from '@nestjs/common';\n\ntype RateLimitBucket = { count: number; resetAt: number };\n\n/**\n * Limite anti-abuso per la verifica dei token di servizio.\n *\n * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita\n * che un client difettoso o malevolo martelli l'endpoint. In-memory: in cluster va\n * aggiunto un limite anche al gateway.\n */\nconst WINDOW_MS = 60_000;\nconst MAX_ATTEMPTS = 120;\nconst MAX_BUCKETS = 20_000;\nconst buckets = new Map<string, RateLimitBucket>();\n\nexport function checkServiceTokenRateLimit(identifier: string): { allowed: boolean; retryAfterSeconds: number } {\n  const now = Date.now();\n  const key = identifier && identifier.trim() !== '' ? identifier : 'unknown';\n  const bucket = buckets.get(key);\n\n  if (!bucket || bucket.resetAt <= now) {\n    if (buckets.size >= MAX_BUCKETS) {\n      const oldestKey = buckets.keys().next().value;\n      if (oldestKey !== undefined) {\n        buckets.delete(oldestKey);\n      }\n    }\n    buckets.set(key, { count: 1, resetAt: now + WINDOW_MS });\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  if (bucket.count >= MAX_ATTEMPTS) {\n    return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil((bucket.resetAt - now) / 1000)) };\n  }\n\n  bucket.count += 1;\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\n/** Svuota i bucket (usato nei test). */\nexport function resetServiceTokenRateLimit(): void {\n  buckets.clear();\n}\n\n/** Lancia 429 con `Retry-After` quando il limite e superato. */\nexport function assertServiceTokenRateLimit(identifier: string): void {\n  const decision = checkServiceTokenRateLimit(identifier);\n  if (!decision.allowed) {\n    throw new HttpException(\n      { code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' },\n      HttpStatus.TOO_MANY_REQUESTS,\n    );\n  }\n}\n"]}
+{"version":3,"file":"serviceTokenRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenRateLimit.ts"],"names":[],"mappings":";;;;;;;;;;;AAcA,gEAgBC;AAGD,gEAEC;AAGD,kEAWC;AAjDD,2CAA2D;AAC3D,qDAA4D;AAG5D;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,KAAM,CAAC;AACzB,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,SAAsB,0BAA0B;yDAC9C,UAAkB,EAClB,QAAwB,IAAA,yCAAwB,GAAE;QAElD,MAAM,GAAG,GAAG,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9E,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,sBAAa,CACrB;gBACE,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,gDAAgD;aAC1D,EACD,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;CAAA;AAED,+DAA+D;AAC/D,SAAgB,0BAA0B;IACxC,IAAA,yCAAwB,GAAE,CAAC,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,gEAAgE;AAChE,SAAsB,2BAA2B,CAC/C,UAAkB,EAClB,KAAsB;;QAEtB,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,sBAAa,CACrB,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAC/F,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { HttpException, HttpStatus } from '@nestjs/common';\nimport { getDefaultRateLimitStore } from './rateLimitStore';\nimport type { RateLimitStore } from './rateLimitStore';\n\n/**\n * Limite anti-abuso per la verifica dei token di servizio.\n *\n * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita\n * che un client difettoso o malevolo martelli l'endpoint. Con `serviceTokens.rateLimitStore`\n * e possibile usare uno store condiviso in cluster.\n */\nconst WINDOW_MS = 60_000;\nconst MAX_ATTEMPTS = 120;\n\nexport async function checkServiceTokenRateLimit(\n  identifier: string,\n  store: RateLimitStore = getDefaultRateLimitStore(),\n): Promise<{ allowed: boolean; retryAfterSeconds: number }> {\n  const key = identifier && identifier.trim() !== '' ? identifier.trim() : 'unknown';\n  try {\n    return await store.consume(`service-token|${key}`, WINDOW_MS, MAX_ATTEMPTS);\n  } catch {\n    throw new HttpException(\n      {\n        code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',\n        message: 'Rate limit non disponibile. Riprova piu tardi.',\n      },\n      HttpStatus.SERVICE_UNAVAILABLE,\n    );\n  }\n}\n\n/** Svuota i bucket dello store di default (usato nei test). */\nexport function resetServiceTokenRateLimit(): void {\n  getDefaultRateLimitStore().reset();\n}\n\n/** Lancia 429 con `Retry-After` quando il limite e superato. */\nexport async function assertServiceTokenRateLimit(\n  identifier: string,\n  store?: RateLimitStore,\n): Promise<void> {\n  const decision = await checkServiceTokenRateLimit(identifier, store);\n  if (!decision.allowed) {\n    throw new HttpException(\n      { code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' },\n      HttpStatus.TOO_MANY_REQUESTS,\n    );\n  }\n}\n"]}

package/dist/initEmilsoftwareModule.js

@@ -24,6 +24,8 @@ const accessiRuntime_1 = require("./accessi-module/accessiRuntime");
 const startupLog_1 = require("./accessi-module/startupLog");
 const accessiValidation_1 = require("./accessi-module/security/accessiValidation");
 const AccessiHttpExceptionFilter_1 = require("./accessi-module/security/AccessiHttpExceptionFilter");
+const jwks_1 = require("./accessi-module/security/jwks");
+const edgeRateLimit_1 = require("./accessi-module/security/edgeRateLimit");
 /**
  * Initializes the unified module that combines Accessi and Allegati functionality
  * @param app Express application instance
@@ -32,7 +34,7 @@ const AccessiHttpExceptionFilter_1 = require("./accessi-module/security/AccessiH
  */
 function initEmilsoftwareModule(app, options) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a;
+        var _a, _b, _c;
         const logger = new Logger_1.Logger(initEmilsoftwareModule.name);
         if (options === null || options === void 0 ? void 0 : options.accessiOptions) {
             (0, authenticateGen_1.beginAccessiAuthInitialization)();
@@ -46,15 +48,31 @@ function initEmilsoftwareModule(app, options) {
             // Precedenza: EmilsoftwareOptions.openapi > AccessiOptions.openapi > default.
             const resolvedOpenApi = (0, OpenApiConfig_1.resolveAccessiOpenApiOptions)((_a = options === null || options === void 0 ? void 0 : options.accessiOptions) === null || _a === void 0 ? void 0 : _a.openapi, options === null || options === void 0 ? void 0 : options.openapi);
             const nestHostApp = (0, express_1.default)();
+            const jwksPath = (options === null || options === void 0 ? void 0 : options.accessiOptions)
+                ? (0, jwks_1.getAccessiJwksPath)(options.accessiOptions)
+                : undefined;
             const isNestRoute = (path) => path === "/api" ||
                 path.startsWith("/api/") ||
-                (0, OpenApiConfig_1.isOpenApiRequestPath)(path, resolvedOpenApi);
+                (0, OpenApiConfig_1.isOpenApiRequestPath)(path, resolvedOpenApi) ||
+                (jwksPath !== undefined && path === jwksPath);
+            const edgeRateLimit = ((_b = options === null || options === void 0 ? void 0 : options.accessiOptions) === null || _b === void 0 ? void 0 : _b.edgeRateLimit)
+                ? (0, edgeRateLimit_1.createAccessiEdgeRateLimitMiddleware)(Object.assign(Object.assign({}, options.accessiOptions.edgeRateLimit), { match: (_c = options.accessiOptions.edgeRateLimit.match) !== null && _c !== void 0 ? _c : ((path) => isNestRoute(path)) }))
+                : undefined;
+            if (edgeRateLimit) {
+                app.use(edgeRateLimit);
+            }
             app.use((req, res, next) => {
                 if (!isNestRoute(req.path)) {
                     return next();
                 }
                 return nestHostApp(req, res, next);
             });
+            if (options === null || options === void 0 ? void 0 : options.accessiOptions) {
+                (0, jwks_1.setupAccessiJwks)(app, options.accessiOptions);
+                if (jwksPath) {
+                    logger.info(`JWKS accessi disponibile su: ${jwksPath}`);
+                }
+            }
             const nestExpressInstance = new platform_express_1.ExpressAdapter(nestHostApp);
             const nestApp = yield core_1.NestFactory.create(EmilsoftwareModule_1.EmilsoftwareModule.forRoot(options), nestExpressInstance, Object.assign({ bufferLogs: (options === null || options === void 0 ? void 0 : options.bufferLogs) !== false }, ((options === null || options === void 0 ? void 0 : options.logger) ? { logger: options.logger } : {})));
             nestApp.enableCors();

package/dist/initEmilsoftwareModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"initEmilsoftwareModule.js","sourceRoot":"","sources":["../src/initEmilsoftwareModule.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAqCA,wDAwEC;AA7GD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAG1D,2DAKiC;AACjC,qCAAkC;AAClC,6DAA+E;AAC/E,iFAIqD;AACrD,oEAAgF;AAChF,4DAAgE;AAChE,mFAA0F;AAC1F,qGAAkG;AAUlG;;;;;GAKG;AACH,SAAsB,sBAAsB,CACxC,GAAgB,EAChB,OAA4B;;;QAE5B,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,EAAE,CAAC;YAC1B,IAAA,gDAA8B,GAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC;YACD,gFAAgF;YAChF,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,wBAAwB;YACxB,8EAA8E;YAC9E,MAAM,eAAe,GAAG,IAAA,4CAA4B,EAChD,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,0CAAE,OAAO,EAChC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CACnB,CAAC;YAEF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,MAAM;gBACf,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACxB,IAAA,oCAAoB,EAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAEhD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBACD,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,uCAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,kBAC7F,UAAU,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,MAAK,KAAK,IACtC,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,EAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACxD,CAAC;YAEH,OAAO,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,EAAE,CAAC;gBAC1B,iFAAiF;gBACjF,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;gBACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,IAAA,wCAAwB,EAAC,eAAe,CAAC;aACrD,CAAC,CAAC;YAEH,oEAAoE;YACpE,MAAM,QAAQ,GAAG,IAAA,4BAAY,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAExD,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,EAAE,CAAC;gBAC1B,MAAM,eAAe,GAAG,IAAA,8CAA6B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACpE,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,eAAe,CAAC,sBAAsB,CAAC;gBACvE,IAAA,uCAAqB,EAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;gBAC9D,IAAA,8BAAiB,EAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAE5D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,EAAE,CAAC;gBAC1B,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport type { INestApplication } from \"@nestjs/common\";\nimport type { OpenAPIObject } from \"@nestjs/swagger\";\nimport {\n    buildOpenApiExcludePaths,\n    isOpenApiRequestPath,\n    resolveAccessiOpenApiOptions,\n    setupOpenApi\n} from \"./openapi/OpenApiConfig\";\nimport { Logger } from \"./Logger\";\nimport { EmilsoftwareModule, EmilsoftwareOptions } from \"./EmilsoftwareModule\";\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    setAccessiAuthService\n} from \"./accessi-module/middleware/authenticateGen\";\nimport { registerAccessiModuleServices } from \"./accessi-module/accessiRuntime\";\nimport { logAccessiStartup } from \"./accessi-module/startupLog\";\nimport { createAccessiValidationPipe } from './accessi-module/security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './accessi-module/security/AccessiHttpExceptionFilter';\n\n/** Esito del bootstrap del modulo unificato. */\nexport interface EmilsoftwareModuleInitializationResult {\n    /** Sotto-app Nest che serve Accessi, Allegati e la documentazione. */\n    nestApp: INestApplication;\n    /** Documento OpenAPI generato, mergiabile nel documento unico dell'host. */\n    document: OpenAPIObject;\n}\n\n/**\n * Initializes the unified module that combines Accessi and Allegati functionality\n * @param app Express application instance\n * @param options Configuration options for both modules\n * @returns Il sotto-app Nest e il documento OpenAPI generato.\n */\nexport async function initEmilsoftwareModule(\n    app: Application,\n    options: EmilsoftwareOptions\n): Promise<EmilsoftwareModuleInitializationResult> {\n    const logger: Logger = new Logger(initEmilsoftwareModule.name);\n    if (options?.accessiOptions) {\n        beginAccessiAuthInitialization();\n    }\n\n    try {\n        // Isolate Nest on a dedicated Express instance and dispatch only module routes.\n        // This keeps pre-existing routes/middlewares on the host app untouched.\n        // Prefisso OpenAPI configurabile (default `accessi/openapi`), cosi' piu'\n        // documentazioni possono convivere (backend su `/openapi`, moduli sotto\n        // `/<modulo>/openapi`).\n        // Precedenza: EmilsoftwareOptions.openapi > AccessiOptions.openapi > default.\n        const resolvedOpenApi = resolveAccessiOpenApiOptions(\n            options?.accessiOptions?.openapi,\n            options?.openapi\n        );\n\n        const nestHostApp = express();\n        const isNestRoute = (path: string) =>\n            path === \"/api\" ||\n            path.startsWith(\"/api/\") ||\n            isOpenApiRequestPath(path, resolvedOpenApi);\n\n        app.use((req: Request, res, next) => {\n            if (!isNestRoute(req.path)) {\n                return next();\n            }\n            return nestHostApp(req, res, next);\n        });\n\n        const nestExpressInstance = new ExpressAdapter(nestHostApp);\n        const nestApp = await NestFactory.create(EmilsoftwareModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: options?.bufferLogs !== false,\n            ...(options?.logger ? { logger: options.logger } : {})\n        });\n\n        nestApp.enableCors();\n        if (options?.accessiOptions) {\n            // Keep the Accessi API contract identical for standalone and unified bootstraps.\n            nestApp.useGlobalPipes(createAccessiValidationPipe());\n            nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n        }\n\n        nestApp.setGlobalPrefix('api', {\n            exclude: buildOpenApiExcludePaths(resolvedOpenApi)\n        });\n\n        // Documentazione OpenAPI del modulo unificato (Accessi + Allegati).\n        const document = setupOpenApi(nestApp, resolvedOpenApi);\n\n        await nestApp.init();\n        if (options?.accessiOptions) {\n            const accessiServices = registerAccessiModuleServices(app, nestApp);\n            app.locals.accessiAuthService = accessiServices.authenticateGenService;\n            setAccessiAuthService(accessiServices.authenticateGenService);\n            logAccessiStartup(options.accessiOptions, resolvedOpenApi);\n        }\n\n        logger.info(\"Emilsoftware module initialized successfully\");\n\n        return { nestApp, document };\n    } catch (error) {\n        if (options?.accessiOptions) {\n            failAccessiAuthInitialization(error);\n        }\n        logger.error(\"Error initializing Emilsoftware Module:\", error);\n        throw error;\n    }\n}\n"]}
+{"version":3,"file":"initEmilsoftwareModule.js","sourceRoot":"","sources":["../src/initEmilsoftwareModule.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAuCA,wDA4FC;AAnID,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAG1D,2DAKiC;AACjC,qCAAkC;AAClC,6DAA+E;AAC/E,iFAIqD;AACrD,oEAAgF;AAChF,4DAAgE;AAChE,mFAA0F;AAC1F,qGAAkG;AAClG,yDAAsF;AACtF,2EAA+F;AAU/F;;;;;GAKG;AACH,SAAsB,sBAAsB,CACxC,GAAgB,EAChB,OAA4B;;;QAE5B,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,EAAE,CAAC;YAC1B,IAAA,gDAA8B,GAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC;YACD,gFAAgF;YAChF,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,wBAAwB;YACxB,8EAA8E;YAC9E,MAAM,eAAe,GAAG,IAAA,4CAA4B,EAChD,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,0CAAE,OAAO,EAChC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CACnB,CAAC;YAEF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc;gBACpC,CAAC,CAAC,IAAA,yBAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,MAAM;gBACf,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACxB,IAAA,oCAAoB,EAAC,IAAI,EAAE,eAAe,CAAC;gBAC3C,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,0CAAE,aAAa;gBACxD,CAAC,CAAC,IAAA,oDAAoC,kCAC/B,OAAO,CAAC,cAAc,CAAC,aAAa,KACvC,KAAK,EAAE,MAAA,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,mCAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IACpF;gBACF,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,aAAa,EAAE,CAAC;gBAChB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBACD,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,EAAE,CAAC;gBAC1B,IAAA,uBAAgB,EAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;gBAC9C,IAAI,QAAQ,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACL,CAAC;YAED,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,uCAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,kBAC7F,UAAU,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,MAAK,KAAK,IACtC,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,EAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACxD,CAAC;YAEH,OAAO,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,EAAE,CAAC;gBAC1B,iFAAiF;gBACjF,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;gBACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,IAAA,wCAAwB,EAAC,eAAe,CAAC;aACrD,CAAC,CAAC;YAEH,oEAAoE;YACpE,MAAM,QAAQ,GAAG,IAAA,4BAAY,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAExD,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,EAAE,CAAC;gBAC1B,MAAM,eAAe,GAAG,IAAA,8CAA6B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACpE,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,eAAe,CAAC,sBAAsB,CAAC;gBACvE,IAAA,uCAAqB,EAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;gBAC9D,IAAA,8BAAiB,EAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAE5D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,EAAE,CAAC;gBAC1B,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport type { INestApplication } from \"@nestjs/common\";\nimport type { OpenAPIObject } from \"@nestjs/swagger\";\nimport {\n    buildOpenApiExcludePaths,\n    isOpenApiRequestPath,\n    resolveAccessiOpenApiOptions,\n    setupOpenApi\n} from \"./openapi/OpenApiConfig\";\nimport { Logger } from \"./Logger\";\nimport { EmilsoftwareModule, EmilsoftwareOptions } from \"./EmilsoftwareModule\";\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    setAccessiAuthService\n} from \"./accessi-module/middleware/authenticateGen\";\nimport { registerAccessiModuleServices } from \"./accessi-module/accessiRuntime\";\nimport { logAccessiStartup } from \"./accessi-module/startupLog\";\nimport { createAccessiValidationPipe } from './accessi-module/security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './accessi-module/security/AccessiHttpExceptionFilter';\nimport { getAccessiJwksPath, setupAccessiJwks } from './accessi-module/security/jwks';\nimport { createAccessiEdgeRateLimitMiddleware } from './accessi-module/security/edgeRateLimit';\n\n/** Esito del bootstrap del modulo unificato. */\nexport interface EmilsoftwareModuleInitializationResult {\n    /** Sotto-app Nest che serve Accessi, Allegati e la documentazione. */\n    nestApp: INestApplication;\n    /** Documento OpenAPI generato, mergiabile nel documento unico dell'host. */\n    document: OpenAPIObject;\n}\n\n/**\n * Initializes the unified module that combines Accessi and Allegati functionality\n * @param app Express application instance\n * @param options Configuration options for both modules\n * @returns Il sotto-app Nest e il documento OpenAPI generato.\n */\nexport async function initEmilsoftwareModule(\n    app: Application,\n    options: EmilsoftwareOptions\n): Promise<EmilsoftwareModuleInitializationResult> {\n    const logger: Logger = new Logger(initEmilsoftwareModule.name);\n    if (options?.accessiOptions) {\n        beginAccessiAuthInitialization();\n    }\n\n    try {\n        // Isolate Nest on a dedicated Express instance and dispatch only module routes.\n        // This keeps pre-existing routes/middlewares on the host app untouched.\n        // Prefisso OpenAPI configurabile (default `accessi/openapi`), cosi' piu'\n        // documentazioni possono convivere (backend su `/openapi`, moduli sotto\n        // `/<modulo>/openapi`).\n        // Precedenza: EmilsoftwareOptions.openapi > AccessiOptions.openapi > default.\n        const resolvedOpenApi = resolveAccessiOpenApiOptions(\n            options?.accessiOptions?.openapi,\n            options?.openapi\n        );\n\n        const nestHostApp = express();\n        const jwksPath = options?.accessiOptions\n            ? getAccessiJwksPath(options.accessiOptions)\n            : undefined;\n        const isNestRoute = (path: string) =>\n            path === \"/api\" ||\n            path.startsWith(\"/api/\") ||\n            isOpenApiRequestPath(path, resolvedOpenApi) ||\n            (jwksPath !== undefined && path === jwksPath);\n        const edgeRateLimit = options?.accessiOptions?.edgeRateLimit\n            ? createAccessiEdgeRateLimitMiddleware({\n                ...options.accessiOptions.edgeRateLimit,\n                match: options.accessiOptions.edgeRateLimit.match ?? ((path) => isNestRoute(path)),\n            })\n            : undefined;\n        if (edgeRateLimit) {\n            app.use(edgeRateLimit);\n        }\n\n        app.use((req: Request, res, next) => {\n            if (!isNestRoute(req.path)) {\n                return next();\n            }\n            return nestHostApp(req, res, next);\n        });\n\n        if (options?.accessiOptions) {\n            setupAccessiJwks(app, options.accessiOptions);\n            if (jwksPath) {\n                logger.info(`JWKS accessi disponibile su: ${jwksPath}`);\n            }\n        }\n\n        const nestExpressInstance = new ExpressAdapter(nestHostApp);\n        const nestApp = await NestFactory.create(EmilsoftwareModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: options?.bufferLogs !== false,\n            ...(options?.logger ? { logger: options.logger } : {})\n        });\n\n        nestApp.enableCors();\n        if (options?.accessiOptions) {\n            // Keep the Accessi API contract identical for standalone and unified bootstraps.\n            nestApp.useGlobalPipes(createAccessiValidationPipe());\n            nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n        }\n\n        nestApp.setGlobalPrefix('api', {\n            exclude: buildOpenApiExcludePaths(resolvedOpenApi)\n        });\n\n        // Documentazione OpenAPI del modulo unificato (Accessi + Allegati).\n        const document = setupOpenApi(nestApp, resolvedOpenApi);\n\n        await nestApp.init();\n        if (options?.accessiOptions) {\n            const accessiServices = registerAccessiModuleServices(app, nestApp);\n            app.locals.accessiAuthService = accessiServices.authenticateGenService;\n            setAccessiAuthService(accessiServices.authenticateGenService);\n            logAccessiStartup(options.accessiOptions, resolvedOpenApi);\n        }\n\n        logger.info(\"Emilsoftware module initialized successfully\");\n\n        return { nestApp, document };\n    } catch (error) {\n        if (options?.accessiOptions) {\n            failAccessiAuthInitialization(error);\n        }\n        logger.error(\"Error initializing Emilsoftware Module:\", error);\n        throw error;\n    }\n}\n"]}

package/docs/gateway-rate-limit.md

@@ -0,0 +1,98 @@
+# Gateway rate limit per Accessi Service
+
+Il rate limit applicativo di Accessi protegge login, 2FA, reset password, console entry e service token. Il gateway/API gateway resta utile per una protezione per IP, connessioni e bot prima che la richiesta raggiunga Node.
+
+Regole consigliate:
+
+- `/api/accessi/auth/*`: soglia bassa, burst contenuto
+- `/api/accessi/console/entry/exchange`: soglia bassa
+- `/api/accessi/*`: soglia media
+- `/accessi/openapi*` e `/accessi/.well-known/jwks.json`: soglia alta o cache CDN
+
+## Nginx
+
+```nginx
+limit_req_zone $binary_remote_addr zone=accessi_auth:10m rate=2r/s;
+limit_req_zone $binary_remote_addr zone=accessi_api:10m rate=10r/s;
+limit_conn_zone $binary_remote_addr zone=accessi_conn:10m;
+
+server {
+    # Se Accessi e dietro un proxy/load balancer, configura real_ip
+    # prima di usare $binary_remote_addr.
+
+    location /api/accessi/auth/ {
+        limit_req zone=accessi_auth burst=10 nodelay;
+        limit_conn accessi_conn 20;
+        proxy_pass http://accessi_service;
+    }
+
+    location /api/accessi/ {
+        limit_req zone=accessi_api burst=50 nodelay;
+        limit_conn accessi_conn 20;
+        proxy_pass http://accessi_service;
+    }
+
+    location /accessi/ {
+        limit_req zone=accessi_api burst=50 nodelay;
+        proxy_pass http://accessi_service;
+    }
+}
+```
+
+## Traefik
+
+```yaml
+http:
+  middlewares:
+    accessi-auth-ratelimit:
+      rateLimit:
+        average: 2
+        burst: 10
+        period: 1s
+    accessi-api-ratelimit:
+      rateLimit:
+        average: 10
+        burst: 50
+        period: 1s
+  routers:
+    accessi-auth:
+      rule: PathPrefix(`/api/accessi/auth/`)
+      middlewares: [accessi-auth-ratelimit]
+      service: accessi
+    accessi-api:
+      rule: PathPrefix(`/api/accessi/`) || PathPrefix(`/accessi/`)
+      middlewares: [accessi-api-ratelimit]
+      service: accessi
+```
+
+## Cloudflare
+
+Regole di rate limiting:
+
+- path `/api/accessi/auth/*`: 10 richieste/minuto per IP, azione `managed challenge`
+- path `/api/accessi/console/entry/exchange`: 30 richieste/5 minuti per IP
+- path `/api/accessi/*`: 300 richieste/minuto per IP, azione `block`
+- path `/accessi/.well-known/jwks.json`: cache CDN, limite alto
+
+Aggiungere bot fight mode/WAF secondo il piano disponibile.
+
+## AWS WAF / API Gateway
+
+- rate-based rule: 300 richieste/5 minuti per IP
+- scope-down statement: `URI starts with /api/accessi`
+- regola più severa su `/api/accessi/auth/*`
+- AWS Shield/WAF Bot Control se disponibile
+
+## Rapporto con `edgeRateLimit` della libreria
+
+`edgeRateLimit` e un ultimo livello applicativo:
+
+- usa lo stesso `RateLimitStore` Redis dei rate limit per account;
+- copre Accessi anche se il gateway non ha regole specifiche;
+- non sostituisce WAF, bot protection, limiti di connessione o protezione DDoS.
+
+In produzione usare entrambi:
+
+```text
+Client -> CDN/WAF -> API gateway -> edgeRateLimit Accessi -> rate limit per account
+```

package/integration-prompt.md

@@ -150,6 +150,127 @@ const merged = mergeOpenApiDocuments(hostDocument, accessiDocument, {
 });
 ```
 
+### JWKS e rotazione chiavi
+
+Con RS256/ES256 Accessi pubblica automaticamente:
+
+```text
+GET /accessi/.well-known/jwks.json
+```
+
+Configurazione:
+
+```ts
+jwtOptions: {
+  algorithm: "RS256",
+  privateKey: process.env.ACCESSI_JWT_PRIVATE_KEY,
+  publicKey: process.env.ACCESSI_JWT_PUBLIC_KEY,
+  keyId: "accessi-2026-02",
+  jwksPath: "accessi/.well-known/jwks.json",
+  previousPublicKeys: [
+    {
+      publicKey: process.env.ACCESSI_JWT_PUBLIC_KEY_2026_01!,
+      keyId: "accessi-2026-01",
+      algorithm: "RS256",
+    },
+  ],
+}
+```
+
+Rotazione:
+
+1. generare la nuova coppia
+2. pubblicare la nuova chiave mantenendo la precedente in `previousPublicKeys`
+3. firmare con la nuova `keyId`
+4. attendere la scadenza massima dei token + il TTL cache della JWKS (default 5 minuti)
+5. rimuovere la chiave precedente
+
+Per un'app Nest esistente si può usare `setupAccessiJwks(app.getHttpAdapter().getInstance(), options)`.
+
+### Store ticket console
+
+Il default è in memoria, adatto a una sola istanza. In multi-istanza configurare uno store condiviso:
+
+```ts
+import { createRedisConsoleEntryStore } from "emilsoftware-utilities/accessi/server";
+
+consoleEntry: {
+  ttlMs: 60_000,
+  store: createRedisConsoleEntryStore({
+    client: redis, // ioredis o client compatibile con eval(script, numKeys, ...args)
+    encryptionKey: process.env.ACCESSI_CONSOLE_ENTRY_KEY!,
+    keyPrefix: "accessi:console-entry:",
+  }),
+}
+```
+
+Lo store Redis:
+
+- cifra il JWT con AES-256-GCM
+- usa `SET ... PX ... NX` con TTL
+- consuma con `GET` + `DEL` atomici in Lua
+- rende il ticket monouso anche tra istanze diverse
+
+Se lo store condiviso non è raggiungibile, la console deve fallire chiusa.
+
+### Rate limit condiviso
+
+Con più istanze anche i rate limit devono usare uno store condiviso:
+
+```ts
+import { createRedisRateLimitStore } from "emilsoftware-utilities/accessi/server";
+
+const rateLimitStore = createRedisRateLimitStore({
+  client: redis, // ioredis o client compatibile con eval(script, numKeys, ...args)
+  keyPrefix: "accessi:rate:",
+});
+
+publicAuthRateLimit: {
+  enabled: true,
+  store: rateLimitStore,
+  login: { windowMs: 15 * 60_000, maxAttempts: 10 },
+  twoFactorVerify: { windowMs: 15 * 60_000, maxAttempts: 20 },
+},
+
+serviceTokens: {
+  enabled: true,
+  rateLimitStore: rateLimitStore,
+},
+```
+
+Lo store Redis usa `INCR` + `PEXPIRE` atomici:
+
+- conta tentativi per IP e per soggetto (email, challenge, ticket, tokenId);
+- il limite è globale tra le istanze;
+- non viene azzerato da un restart;
+- se Redis non è raggiungibile il controllo fallisce chiuso: l’endpoint risponde con errore, non autorizza.
+
+Default: store in memoria. Va bene per una singola istanza o per ambienti di sviluppo.
+
+### Edge rate limit per IP
+
+Per una soglia grossolana davanti alle rotte Accessi:
+
+```ts
+edgeRateLimit: {
+  enabled: true,
+  windowMs: 60_000,
+  maxAttempts: 300,
+  store: rateLimitStore, // stesso store Redis, opzionale
+}
+```
+
+Viene applicato prima del dispatcher Accessi e copre `/api/accessi/*`, OpenAPI e JWKS. In caso di store non disponibile risponde `503 ACCESSI_RATE_LIMIT_UNAVAILABLE`; quando la soglia è superata risponde `429 ACCESSI_EDGE_RATE_LIMITED` con `Retry-After`.
+
+Il gateway/API gateway resta consigliato per:
+
+- limiti di connessione e burst;
+- bot protection e WAF;
+- rate limit per IP a livello di rete;
+- blocco geografico o reputazionale.
+
+Configurazioni di riferimento: `docs/gateway-rate-limit.md`.
+
 ---
 
 ## 4. Backend fratello — Express
@@ -190,7 +311,9 @@ Dopo il middleware:
 - **HS256**: usare `jwt.serverSecret` con `ACCESSI_JWT_SECRET`. Il resource server deriva la chiave access con la stessa KDF del server.
 - **RS256/ES256**: usare `jwt.publicKey` PEM oppure `jwt.jwks.url`. Consigliato in multi-servizio.
 - Il server Accessi supporta `jwtOptions.algorithm`, `privateKey`, `publicKey`, `keyId`.
-- Accessi non espone ancora un endpoint JWKS integrato: pubblicare la chiave pubblica con il proprio hosting/reverse proxy oppure usare `publicKey` PEM.
+- Accessi espone la JWKS su `jwtOptions.jwksPath` (default `accessi/.well-known/jwks.json`) quando usa RS/ES.
+- La JWKS include la chiave corrente e le `previousPublicKeys`, per la rotazione senza downtime.
+- Configurare il resource server con `jwks: { url: "https://accessi.example.com/accessi/.well-known/jwks.json" }`.
 
 ### Errori
 
@@ -404,6 +527,9 @@ ACCESSI_JWT_ALGORITHM=RS256
 ACCESSI_JWT_PRIVATE_KEY=
 ACCESSI_JWT_PUBLIC_KEY=
 ACCESSI_JWT_KEY_ID=
+ACCESSI_JWKS_PATH=accessi/.well-known/jwks.json
+ACCESSI_CONSOLE_ENTRY_TTL_MS=60000
+ACCESSI_CONSOLE_ENTRY_KEY=
 SMTP_HOST=
 SMTP_PORT=587
 SMTP_USER=
@@ -428,6 +554,7 @@ Frontend:
 ```env
 ACCESSI_API_BASE_URL=https://accessi.example.com
 ACCESSI_CONSOLE_URL=https://accessi.example.com/api/accessi/console
+ACCESSI_JWKS_URL=https://accessi.example.com/accessi/.well-known/jwks.json
 ```
 
 ---
@@ -443,16 +570,20 @@ Checklist:
 5. Spostare la console una sola volta.
 6. Passare i backend fratelli a `resource-server`.
 7. Configurare un service token con `accessi:introspect`.
-8. Testare:
+8. Pubblicare la JWKS e configurare i resource server su `jwks.url`.
+9. In multi-istanza configurare `consoleEntry.store`, `publicAuthRateLimit.store` e `serviceTokens.rateLimitStore` con Redis.
+10. Testare:
    - login
    - token valido
    - token scaduto
    - utente disabilitato
    - revoca grants
    - Accessi Service spento (fail closed)
-   - console entry ticket
-9. Aggiornare CORS se i frontend cambiano dominio.
-10. Aggiornare monitoraggio e log senza includere token.
+   - console entry ticket su istanze diverse
+   - rate limit condiviso tra istanze
+   - rotazione JWKS con vecchia chiave ancora valida
+11. Aggiornare CORS se i frontend cambiano dominio.
+12. Aggiornare monitoraggio e log senza includere token.
 
 ---
 
@@ -474,8 +605,8 @@ Checklist:
 
 ## 14. Limiti attuali da conoscere
 
-- I ticket di ingresso console sono in memoria del processo: con piu istanze di Accessi Service servono sticky session o uno store condiviso.
-- I rate limit pubblici e dei service token sono in memoria.
-- Accessi non espone ancora un endpoint JWKS pronto: il resource server sa verificare una JWKS, ma la chiave pubblica va pubblicata dall'host.
+- I ticket di ingresso console usano lo store in memoria per default: in multi-istanza configurare `consoleEntry.store` con Redis. Lo store Redis e cifrato e monouso, ma richiede un client Redis compatibile.
+- I rate limit usano lo store in memoria per default: in multi-istanza configurare `publicAuthRateLimit.store` e `serviceTokens.rateLimitStore` con Redis. Il gateway resta comunque consigliato per i limiti grossolani per IP.
 - Il client generato e completo (include endpoint amministrativi): non distribuirlo a frontend non amministrativi senza valutare gli endpoint esposti. Per un client pubblico ridotto, generare un sottoinsieme per tag con Orval.
 - I DTO in `accessi/contracts/dtos` dipendono da Nest/class-validator: non sono pensati per bundle frontend minimali.
+- La JWKS viene pubblicata solo con algoritmi asimmetrici: con HS256 non esiste una chiave pubblica da distribuire.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "emilsoftware-utilities",
-  "version": "2.0.0-dev.67",
+  "version": "2.0.0-dev.68",
   "description": "Utilities for EmilSoftware",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -101,8 +101,8 @@
     "typecheck": "tsc --noEmit",
     "lint": "node scripts/lint.cjs",
     "test": "npm run typecheck && npm run lint && npm run test:unit",
-    "test:unit": "node --test test/angular-components.cjs test/menus-catalog.mjs test/menu-scopes.cjs test/accessi-regressions.cjs test/password-reset-regressions.cjs test/two-factor.cjs test/accessi-schema.cjs test/utilities-regressions.cjs test/service-token-regressions.cjs test/accessi-email-config.cjs test/accessi-catalog-scripts.cjs test/openapi-config.cjs test/resource-server.cjs",
-    "test:coverage": "node --experimental-test-coverage --test-coverage-lines=50 --test-coverage-functions=60 --test-coverage-branches=60 --test test/angular-components.cjs test/menus-catalog.mjs test/menu-scopes.cjs test/accessi-regressions.cjs test/password-reset-regressions.cjs test/two-factor.cjs test/accessi-schema.cjs test/utilities-regressions.cjs test/service-token-regressions.cjs test/accessi-email-config.cjs test/accessi-catalog-scripts.cjs test/openapi-config.cjs test/resource-server.cjs",
+    "test:unit": "node --test test/angular-components.cjs test/menus-catalog.mjs test/menu-scopes.cjs test/accessi-regressions.cjs test/password-reset-regressions.cjs test/two-factor.cjs test/accessi-schema.cjs test/utilities-regressions.cjs test/service-token-regressions.cjs test/accessi-email-config.cjs test/accessi-catalog-scripts.cjs test/openapi-config.cjs test/resource-server.cjs test/accessi-security-standards.cjs",
+    "test:coverage": "node --experimental-test-coverage --test-coverage-lines=50 --test-coverage-functions=60 --test-coverage-branches=60 --test test/angular-components.cjs test/menus-catalog.mjs test/menu-scopes.cjs test/accessi-regressions.cjs test/password-reset-regressions.cjs test/two-factor.cjs test/accessi-schema.cjs test/utilities-regressions.cjs test/service-token-regressions.cjs test/accessi-email-config.cjs test/accessi-catalog-scripts.cjs test/openapi-config.cjs test/resource-server.cjs test/accessi-security-standards.cjs",
     "test:accessi": "npm run test:unit",
     "test:all": "npm test && npm run test:integration",
     "test:integration": "node test/integration/run-firebird.cjs 5",
@@ -183,7 +183,8 @@
   },
   "files": [
     "dist",
-    "integration-prompt.md"
+    "integration-prompt.md",
+    "docs"
   ],
   "config": {
     "commitizen": {