emilsoftware-utilities 2.0.0-dev.67 → 2.0.0-dev.69

package/dist/accessi/resource-server/errors.d.ts

@@ -1,5 +1,5 @@
 /** Codici stabili del resource server, allineati al contratto HTTP Accessi. */
-export type AccessiResourceServerErrorCode = "AUTH_HEADER_MISSING" | "AUTH_TOKEN_MISSING" | "AUTH_TOKEN_INVALID" | "AUTH_USER_CODE_MISSING" | "AUTH_USER_DISABLED" | "AUTH_INSUFFICIENT_PERMISSIONS" | "AUTH_CONFIG_INVALID" | "AUTH_GRANTS_SOURCE_MISSING" | "AUTH_INTROSPECTION_UNAVAILABLE" | "AUTH_INTROSPECTION_UNAUTHORIZED" | "AUTH_JWKS_UNAVAILABLE" | "AUTH_INTERNAL_ERROR";
+export type AccessiResourceServerErrorCode = "AUTH_HEADER_MISSING" | "AUTH_TOKEN_MISSING" | "AUTH_TOKEN_INVALID" | "AUTH_USER_CODE_MISSING" | "AUTH_USER_DISABLED" | "AUTH_TOKEN_REVOKED" | "AUTH_INSUFFICIENT_PERMISSIONS" | "AUTH_CONFIG_INVALID" | "AUTH_GRANTS_SOURCE_MISSING" | "AUTH_INTROSPECTION_UNAVAILABLE" | "AUTH_INTROSPECTION_UNAUTHORIZED" | "AUTH_JWKS_UNAVAILABLE" | "AUTH_INTERNAL_ERROR";
 /** Errore tipizzato del resource server, convertibile in risposta HTTP o eccezione Nest. */
 export declare class AccessiResourceServerError extends Error {
     readonly status: number;

package/dist/accessi/resource-server/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/errors.ts"],"names":[],"mappings":";;;AA4BA,4CAOC;AApBD,4FAA4F;AAC5F,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YACkB,MAAc,EACd,IAAoC,EACpD,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAgC;QAEpC,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAVD,gEAUC;AAED,SAAgB,gBAAgB,CAC9B,MAAc,EACd,IAAoC,EACpC,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,0BAA0B,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC","sourcesContent":["/** Codici stabili del resource server, allineati al contratto HTTP Accessi. */\nexport type AccessiResourceServerErrorCode =\n  | \"AUTH_HEADER_MISSING\"\n  | \"AUTH_TOKEN_MISSING\"\n  | \"AUTH_TOKEN_INVALID\"\n  | \"AUTH_USER_CODE_MISSING\"\n  | \"AUTH_USER_DISABLED\"\n  | \"AUTH_INSUFFICIENT_PERMISSIONS\"\n  | \"AUTH_CONFIG_INVALID\"\n  | \"AUTH_GRANTS_SOURCE_MISSING\"\n  | \"AUTH_INTROSPECTION_UNAVAILABLE\"\n  | \"AUTH_INTROSPECTION_UNAUTHORIZED\"\n  | \"AUTH_JWKS_UNAVAILABLE\"\n  | \"AUTH_INTERNAL_ERROR\";\n\n/** Errore tipizzato del resource server, convertibile in risposta HTTP o eccezione Nest. */\nexport class AccessiResourceServerError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: AccessiResourceServerErrorCode,\n    message: string,\n    public readonly details?: Record<string, unknown>,\n  ) {\n    super(message);\n    this.name = \"AccessiResourceServerError\";\n  }\n}\n\nexport function accessiAuthError(\n  status: number,\n  code: AccessiResourceServerErrorCode,\n  message: string,\n  details?: Record<string, unknown>,\n): AccessiResourceServerError {\n  return new AccessiResourceServerError(status, code, message, details);\n}\n"]}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/errors.ts"],"names":[],"mappings":";;;AA6BA,4CAOC;AApBD,4FAA4F;AAC5F,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YACkB,MAAc,EACd,IAAoC,EACpD,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAgC;QAEpC,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAVD,gEAUC;AAED,SAAgB,gBAAgB,CAC9B,MAAc,EACd,IAAoC,EACpC,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,0BAA0B,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC","sourcesContent":["/** Codici stabili del resource server, allineati al contratto HTTP Accessi. */\nexport type AccessiResourceServerErrorCode =\n  | \"AUTH_HEADER_MISSING\"\n  | \"AUTH_TOKEN_MISSING\"\n  | \"AUTH_TOKEN_INVALID\"\n  | \"AUTH_USER_CODE_MISSING\"\n  | \"AUTH_USER_DISABLED\"\n  | \"AUTH_TOKEN_REVOKED\"\n  | \"AUTH_INSUFFICIENT_PERMISSIONS\"\n  | \"AUTH_CONFIG_INVALID\"\n  | \"AUTH_GRANTS_SOURCE_MISSING\"\n  | \"AUTH_INTROSPECTION_UNAVAILABLE\"\n  | \"AUTH_INTROSPECTION_UNAUTHORIZED\"\n  | \"AUTH_JWKS_UNAVAILABLE\"\n  | \"AUTH_INTERNAL_ERROR\";\n\n/** Errore tipizzato del resource server, convertibile in risposta HTTP o eccezione Nest. */\nexport class AccessiResourceServerError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: AccessiResourceServerErrorCode,\n    message: string,\n    public readonly details?: Record<string, unknown>,\n  ) {\n    super(message);\n    this.name = \"AccessiResourceServerError\";\n  }\n}\n\nexport function accessiAuthError(\n  status: number,\n  code: AccessiResourceServerErrorCode,\n  message: string,\n  details?: Record<string, unknown>,\n): AccessiResourceServerError {\n  return new AccessiResourceServerError(status, code, message, details);\n}\n"]}

package/dist/accessi/resource-server/express.js

@@ -13,6 +13,7 @@ exports.toAccessiResourceServerError = toAccessiResourceServerError;
 exports.sendAccessiResourceServerError = sendAccessiResourceServerError;
 exports.createAccessiAuthMiddleware = createAccessiAuthMiddleware;
 exports.createAccessiAuthMiddlewareFromRuntime = createAccessiAuthMiddlewareFromRuntime;
+const audit_1 = require("../../accessi-module/security/audit");
 const errors_1 = require("./errors");
 const runtime_1 = require("./runtime");
 /** Normalizza un errore sconosciuto nel contratto di errore Accessi. */
@@ -47,6 +48,16 @@ function createAccessiAuthMiddleware(options) {
             next();
         }
         catch (error) {
+            const normalized = toAccessiResourceServerError(error);
+            if (runtime.options.audit !== false) {
+                (0, audit_1.auditAccessi)("auth_failure", {
+                    code: normalized.code,
+                    status: normalized.status,
+                    method: req.method,
+                    path: req.path,
+                    ip: req.ip,
+                });
+            }
             sendAccessiResourceServerError(res, error);
         }
     });
@@ -59,6 +70,16 @@ function createAccessiAuthMiddlewareFromRuntime(runtime) {
             next();
         }
         catch (error) {
+            const normalized = toAccessiResourceServerError(error);
+            if (runtime.options.audit !== false) {
+                (0, audit_1.auditAccessi)("auth_failure", {
+                    code: normalized.code,
+                    status: normalized.status,
+                    method: req.method,
+                    path: req.path,
+                    ip: req.ip,
+                });
+            }
             sendAccessiResourceServerError(res, error);
         }
     });

package/dist/accessi/resource-server/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/express.ts"],"names":[],"mappings":";;;;;;;;;;;AAOA,oEAGC;AAGD,wEAUC;AAQD,kEAaC;AAGD,wFAWC;AAzDD,qCAAwE;AACxE,uCAAoF;AAIpF,wEAAwE;AACxE,SAAgB,4BAA4B,CAAC,KAAc;IACzD,IAAI,KAAK,YAAY,mCAA0B;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;AAClG,CAAC;AAED,wFAAwF;AACxF,SAAgB,8BAA8B,CAAC,GAAa,EAAE,KAAc;IAC1E,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACxC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,IAAI;QACtB,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAErD,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sCAAsC,CACpD,OAAqC;IAErC,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from \"express\";\nimport { AccessiResourceServerError, accessiAuthError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerRuntime } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\n/** Normalizza un errore sconosciuto nel contratto di errore Accessi. */\nexport function toAccessiResourceServerError(error: unknown): AccessiResourceServerError {\n  if (error instanceof AccessiResourceServerError) return error;\n  return accessiAuthError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n}\n\n/** Invia la risposta di errore Accessi senza esporre stack trace o dettagli interni. */\nexport function sendAccessiResourceServerError(res: Response, error: unknown): Response {\n  const normalized = toAccessiResourceServerError(error);\n  return res.status(normalized.status).json({\n    severity: \"error\",\n    status: normalized.status,\n    statusCode: 2,\n    code: normalized.code,\n    error: normalized.code,\n    message: normalized.message,\n  });\n}\n\n/**\n * Middleware Express per backend che non possiedono il database Accessi.\n *\n * Popola `req.user`, `req.data` e `req.accessi`; con una policy di autorizzazione\n * popola anche `req.userGrants`.\n */\nexport function createAccessiAuthMiddleware(\n  options: AccessiResourceServerOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  const runtime = createAccessiResourceServer(options);\n\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n\n/** Variante con runtime gia creato, utile per test o bootstrap manuale. */\nexport function createAccessiAuthMiddlewareFromRuntime(\n  runtime: AccessiResourceServerRuntime,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n"]}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/express.ts"],"names":[],"mappings":";;;;;;;;;;;AAQA,oEAGC;AAGD,wEAUC;AAQD,kEAuBC;AAGD,wFAqBC;AA9ED,+DAAmE;AACnE,qCAAwE;AACxE,uCAAoF;AAIpF,wEAAwE;AACxE,SAAgB,4BAA4B,CAAC,KAAc;IACzD,IAAI,KAAK,YAAY,mCAA0B;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;AAClG,CAAC;AAED,wFAAwF;AACxF,SAAgB,8BAA8B,CAAC,GAAa,EAAE,KAAc;IAC1E,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACxC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,IAAI;QACtB,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAErD,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;oBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YACD,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sCAAsC,CACpD,OAAqC;IAErC,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;oBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YACD,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from \"express\";\nimport { auditAccessi } from \"../../accessi-module/security/audit\";\nimport { AccessiResourceServerError, accessiAuthError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerRuntime } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\n/** Normalizza un errore sconosciuto nel contratto di errore Accessi. */\nexport function toAccessiResourceServerError(error: unknown): AccessiResourceServerError {\n  if (error instanceof AccessiResourceServerError) return error;\n  return accessiAuthError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n}\n\n/** Invia la risposta di errore Accessi senza esporre stack trace o dettagli interni. */\nexport function sendAccessiResourceServerError(res: Response, error: unknown): Response {\n  const normalized = toAccessiResourceServerError(error);\n  return res.status(normalized.status).json({\n    severity: \"error\",\n    status: normalized.status,\n    statusCode: 2,\n    code: normalized.code,\n    error: normalized.code,\n    message: normalized.message,\n  });\n}\n\n/**\n * Middleware Express per backend che non possiedono il database Accessi.\n *\n * Popola `req.user`, `req.data` e `req.accessi`; con una policy di autorizzazione\n * popola anche `req.userGrants`.\n */\nexport function createAccessiAuthMiddleware(\n  options: AccessiResourceServerOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  const runtime = createAccessiResourceServer(options);\n\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      const normalized = toAccessiResourceServerError(error);\n      if (runtime.options.audit !== false) {\n        auditAccessi(\"auth_failure\", {\n          code: normalized.code,\n          status: normalized.status,\n          method: req.method,\n          path: req.path,\n          ip: req.ip,\n        });\n      }\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n\n/** Variante con runtime gia creato, utile per test o bootstrap manuale. */\nexport function createAccessiAuthMiddlewareFromRuntime(\n  runtime: AccessiResourceServerRuntime,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      const normalized = toAccessiResourceServerError(error);\n      if (runtime.options.audit !== false) {\n        auditAccessi(\"auth_failure\", {\n          code: normalized.code,\n          status: normalized.status,\n          method: req.method,\n          path: req.path,\n          ip: req.ip,\n        });\n      }\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n"]}

package/dist/accessi/resource-server/nest.js

@@ -17,6 +17,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAccessiAuthGuard = createAccessiAuthGuard;
 const common_1 = require("@nestjs/common");
+const audit_1 = require("../../accessi-module/security/audit");
 const errors_1 = require("./errors");
 const runtime_1 = require("./runtime");
 function toNestException(error) {
@@ -49,6 +50,18 @@ function createAccessiAuthGuard(options) {
                     return true;
                 }
                 catch (error) {
+                    const normalized = error instanceof errors_1.AccessiResourceServerError
+                        ? error
+                        : new errors_1.AccessiResourceServerError(500, "AUTH_INTERNAL_ERROR", "Errore interno durante l'autenticazione.");
+                    if (runtime.options.audit !== false) {
+                        (0, audit_1.auditAccessi)("auth_failure", {
+                            code: normalized.code,
+                            status: normalized.status,
+                            method: request.method,
+                            path: request.path,
+                            ip: request.ip,
+                        });
+                    }
                     throw toNestException(error);
                 }
             });

package/dist/accessi/resource-server/nest.js.map

@@ -1 +1 @@
-{"version":3,"file":"nest.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/nest.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAiCA,wDAmBC;AApDD,2CASwB;AAExB,qCAAsD;AACtD,uCAAoF;AAGpF,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,UAAU,GAAG,KAAK,YAAY,mCAA0B;QAC5D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,mCAA0B,CAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;IAEvE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,8BAAqB,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,oCAA2B,CAAC,OAAO,CAAC,CAAC;IAC/E,OAAO,IAAI,qCAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAGrD,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;QACxB,WAAW,CAAC,OAAyB;;gBACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,IAAA,oCAA0B,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;SAAA;KACF,CAAA;IAVK,0BAA0B;QAD/B,IAAA,mBAAU,GAAE;OACP,0BAA0B,CAU/B;IAED,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Injectable,\n  InternalServerErrorException,\n  ServiceUnavailableException,\n  Type,\n  UnauthorizedException,\n} from \"@nestjs/common\";\nimport type { Request } from \"express\";\nimport { AccessiResourceServerError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\nfunction toNestException(error: unknown): Error {\n  const normalized = error instanceof AccessiResourceServerError\n    ? error\n    : new AccessiResourceServerError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n  const payload = { code: normalized.code, message: normalized.message };\n\n  if (normalized.status === 401) return new UnauthorizedException(payload);\n  if (normalized.status === 403) return new ForbiddenException(payload);\n  if (normalized.status === 503) return new ServiceUnavailableException(payload);\n  return new InternalServerErrorException(payload);\n}\n\n/**\n * Crea un guard Nest configurato con le opzioni del resource server.\n *\n * Uso:\n * `@UseGuards(createAccessiAuthGuard(options))`\n */\nexport function createAccessiAuthGuard(\n  options: AccessiResourceServerOptions,\n): Type<CanActivate> {\n  const runtime = createAccessiResourceServer(options);\n\n  @Injectable()\n  class ConfiguredAccessiAuthGuard implements CanActivate {\n    async canActivate(context: ExecutionContext): Promise<boolean> {\n      const request = context.switchToHttp().getRequest<Request>();\n      try {\n        await authenticateAccessiRequest(request, runtime);\n        return true;\n      } catch (error) {\n        throw toNestException(error);\n      }\n    }\n  }\n\n  return ConfiguredAccessiAuthGuard;\n}\n"]}
+{"version":3,"file":"nest.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/nest.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAkCA,wDA+BC;AAjED,2CASwB;AAExB,+DAAmE;AACnE,qCAAsD;AACtD,uCAAoF;AAGpF,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,UAAU,GAAG,KAAK,YAAY,mCAA0B;QAC5D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,mCAA0B,CAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;IAEvE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,8BAAqB,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,oCAA2B,CAAC,OAAO,CAAC,CAAC;IAC/E,OAAO,IAAI,qCAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAGrD,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;QACxB,WAAW,CAAC,OAAyB;;gBACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,IAAA,oCAA0B,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,UAAU,GAAG,KAAK,YAAY,mCAA0B;wBAC5D,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,IAAI,mCAA0B,CAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;oBAC3G,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;wBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;4BAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;4BACrB,MAAM,EAAE,UAAU,CAAC,MAAM;4BACzB,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,EAAE,EAAE,OAAO,CAAC,EAAE;yBACf,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;SAAA;KACF,CAAA;IAtBK,0BAA0B;QAD/B,IAAA,mBAAU,GAAE;OACP,0BAA0B,CAsB/B;IAED,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Injectable,\n  InternalServerErrorException,\n  ServiceUnavailableException,\n  Type,\n  UnauthorizedException,\n} from \"@nestjs/common\";\nimport type { Request } from \"express\";\nimport { auditAccessi } from \"../../accessi-module/security/audit\";\nimport { AccessiResourceServerError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\nfunction toNestException(error: unknown): Error {\n  const normalized = error instanceof AccessiResourceServerError\n    ? error\n    : new AccessiResourceServerError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n  const payload = { code: normalized.code, message: normalized.message };\n\n  if (normalized.status === 401) return new UnauthorizedException(payload);\n  if (normalized.status === 403) return new ForbiddenException(payload);\n  if (normalized.status === 503) return new ServiceUnavailableException(payload);\n  return new InternalServerErrorException(payload);\n}\n\n/**\n * Crea un guard Nest configurato con le opzioni del resource server.\n *\n * Uso:\n * `@UseGuards(createAccessiAuthGuard(options))`\n */\nexport function createAccessiAuthGuard(\n  options: AccessiResourceServerOptions,\n): Type<CanActivate> {\n  const runtime = createAccessiResourceServer(options);\n\n  @Injectable()\n  class ConfiguredAccessiAuthGuard implements CanActivate {\n    async canActivate(context: ExecutionContext): Promise<boolean> {\n      const request = context.switchToHttp().getRequest<Request>();\n      try {\n        await authenticateAccessiRequest(request, runtime);\n        return true;\n      } catch (error) {\n        const normalized = error instanceof AccessiResourceServerError\n          ? error\n          : new AccessiResourceServerError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n        if (runtime.options.audit !== false) {\n          auditAccessi(\"auth_failure\", {\n            code: normalized.code,\n            status: normalized.status,\n            method: request.method,\n            path: request.path,\n            ip: request.ip,\n          });\n        }\n        throw toNestException(error);\n      }\n    }\n  }\n\n  return ConfiguredAccessiAuthGuard;\n}\n"]}

package/dist/accessi/resource-server/runtime.js

@@ -48,7 +48,7 @@ function mergeIntrospectionUser(payload, user) {
  */
 function authenticateAccessiRequest(request, runtime) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
+        var _a, _b, _c;
         const token = (0, contracts_1.extractAccessiBearerToken)(request.headers.authorization);
         if (!token) {
             throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_MISSING", "Token Bearer mancante o malformato.");
@@ -83,6 +83,16 @@ function authenticateAccessiRequest(request, runtime) {
         if (!codiceUtente) {
             throw (0, errors_1.accessiAuthError)(401, "AUTH_USER_CODE_MISSING", "Token privo di un utente valido.");
         }
+        if (mode === "local" && ((_c = runtime.options.revocation) === null || _c === void 0 ? void 0 : _c.store)) {
+            const issuedAt = Number(payload === null || payload === void 0 ? void 0 : payload.iat);
+            if (!Number.isFinite(issuedAt)) {
+                throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_INVALID", "Token privo di iat.");
+            }
+            const revokedAt = yield runtime.options.revocation.store.getUserRevocation(codiceUtente);
+            if (revokedAt !== null && issuedAt < Math.floor(revokedAt / 1000)) {
+                throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_REVOKED", "Sessione revocata.");
+            }
+        }
         const requirementTree = (0, contracts_1.buildRequirementTree)(runtime.options.authorization);
         if (requirementTree) {
             if (!grants) {

package/dist/accessi/resource-server/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/runtime.ts"],"names":[],"mappings":";;;;;;;;;;;AA+CA,kEAkBC;AAoBD,gEAkGC;AAtLD,4CAIsB;AAKtB,qCAA4C;AAC5C,mDAAmE;AAEnE,mCAAqD;AAsBrD,SAAS,WAAW,CAAC,OAAqC;IACxD,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC;IAClD,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,8DAA8D,CAC/D,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,2BAA2B,CACzC,OAAqC;IAErC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACnG,CAAC;IAED,qCACE,OAAO,kCAAO,OAAO,KAAE,IAAI,OACxB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAA,kCAA0B,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC1E,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAA,gDAAgC,EAAC,OAAO,CAAC,aAAa,CAAC,EAAE;QAClF,CAAC,CAAC,EAAE,CAAC,EACP;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA8C,EAC9C,IAA6B;IAE7B,qDACK,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,GAC9B,IAAI,KACP,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,IAAI,IACZ;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAsB,0BAA0B,CAC9C,OAAgB,EAChB,OAAqC;;;QAErC,MAAM,KAAK,GAAG,IAAA,qCAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,qCAAqC,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,IAAI,mCAAI,OAAO,CAAC;QAC7C,IAAI,OAA8C,CAAC;QACnD,IAAI,IAAI,GAA4B,EAAE,CAAC;QACvC,IAAI,YAAgC,CAAC;QACrC,IAAI,MAAgC,CAAC;QAErC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,mCAAmC,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;YAC/B,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;YACzB,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBACjC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,GAAG,MAAA,aAAa,CAAC,IAAI,mCAAI,EAAE,CAAC;YAChC,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;YAC1C,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;YAC9B,OAAO,GAAG,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,eAAe,GAAG,IAAA,gCAAoB,EAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5E,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;oBACjC,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,4BAA4B,EAC5B,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;gBACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC1E,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;oBAC1B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;gBAC7F,CAAC;gBACD,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;gBAC9B,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;oBACvB,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;oBAC1B,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAmB,EAC9C,eAAe,EACf;gBACE,GAAG,EAAE,OAAO;gBACZ,YAAY,EAAE,OAAO;gBACrB,QAAQ,EAAE,YAAY;gBACtB,eAAe,EAAE,GAAS,EAAE,gDAAC,OAAA,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAA,GAAA;aAC1C,EACD,OAAO,CAAC,OAAO,CAAC,aAAa,CAC9B,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,+BAA+B,EAC/B,+CAA+C,CAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAG,OAAsC,CAAC;QACpE,MAAM,WAAW,GAA4B,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI;YACtD,GAAG,EAAE,QAAQ;YACb,YAAY;YACZ,MAAM,EAAE,IAAI;SACb,CAAC;QACF,oBAAoB,CAAC,IAAI,GAAG,WAAW,CAAC;QACxC,oBAAoB,CAAC,IAAI,GAAG,WAAW,CAAC;QACxC,IAAI,MAAM;YAAE,oBAAoB,CAAC,UAAU,GAAG,MAAM,CAAC;QACrD,oBAAoB,CAAC,OAAO,iCAC1B,KAAK;YACL,IAAI;YACJ,YAAY,IACT,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7B,OAAO,EAAE,WAAW,GACrB,CAAC;QACF,OAAO,oBAAoB,CAAC,OAAO,CAAC;IACtC,CAAC;CAAA","sourcesContent":["import type { Request } from \"express\";\nimport {\n  buildRequirementTree,\n  evaluateRequirement,\n  extractAccessiBearerToken,\n} from \"../contracts\";\nimport type {\n  AccessiAccessTokenPayload,\n  GrantsResult,\n} from \"../contracts\";\nimport { accessiAuthError } from \"./errors\";\nimport { createAccessiIntrospectionClient } from \"./introspection\";\nimport type { AccessiIntrospectionClient } from \"./introspection\";\nimport { createAccessiTokenVerifier } from \"./token\";\nimport type { AccessiTokenVerifier } from \"./token\";\nimport type {\n  AccessiRequestContext,\n  AccessiResourceServerOptions,\n} from \"./types\";\n\n/** Request Express arricchita dal resource server. */\nexport interface AccessiAuthenticatedRequest extends Request {\n  user?: Record<string, unknown>;\n  data?: Record<string, unknown>;\n  userGrants?: GrantsResult;\n  accessi?: AccessiRequestContext;\n}\n\n/** Runtime creato una volta al bootstrap e riutilizzato a ogni richiesta. */\nexport interface AccessiResourceServerRuntime {\n  options: AccessiResourceServerOptions;\n  verifier?: AccessiTokenVerifier;\n  introspectionClient?: AccessiIntrospectionClient;\n}\n\nfunction resolveMode(options: AccessiResourceServerOptions): \"local\" | \"introspection\" {\n  if (options.mode) return options.mode;\n  if (options.jwt) return \"local\";\n  if (options.introspection) return \"introspection\";\n  throw accessiAuthError(\n    500,\n    \"AUTH_CONFIG_INVALID\",\n    \"Configurare jwt o introspection nel resource server Accessi.\",\n  );\n}\n\n/** Valida la configurazione e prepara verificatore e client di introspection. */\nexport function createAccessiResourceServer(\n  options: AccessiResourceServerOptions,\n): AccessiResourceServerRuntime {\n  const mode = resolveMode(options);\n  if (mode === \"local\" && !options.jwt) {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"mode local richiede jwt.\");\n  }\n  if (mode === \"introspection\" && !options.introspection) {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"mode introspection richiede introspection.\");\n  }\n\n  return {\n    options: { ...options, mode },\n    ...(options.jwt ? { verifier: createAccessiTokenVerifier(options.jwt) } : {}),\n    ...(options.introspection\n      ? { introspectionClient: createAccessiIntrospectionClient(options.introspection) }\n      : {}),\n  };\n}\n\nfunction mergeIntrospectionUser(\n  payload: AccessiAccessTokenPayload | undefined,\n  user: Record<string, unknown>,\n): AccessiAccessTokenPayload {\n  return {\n    ...(payload ?? { typ: \"access\" }),\n    ...user,\n    typ: \"access\",\n    utente: user,\n  };\n}\n\n/**\n * Autentica la request e applica l'eventuale policy di autorizzazione.\n *\n * Non accede mai al database Accessi: la verifica e locale oppure delegata\n * all'introspection di Accessi Service.\n */\nexport async function authenticateAccessiRequest(\n  request: Request,\n  runtime: AccessiResourceServerRuntime,\n): Promise<AccessiRequestContext> {\n  const token = extractAccessiBearerToken(request.headers.authorization);\n  if (!token) {\n    throw accessiAuthError(401, \"AUTH_TOKEN_MISSING\", \"Token Bearer mancante o malformato.\");\n  }\n\n  const mode = runtime.options.mode ?? \"local\";\n  let payload: AccessiAccessTokenPayload | undefined;\n  let user: Record<string, unknown> = {};\n  let codiceUtente: number | undefined;\n  let grants: GrantsResult | undefined;\n\n  if (mode === \"local\") {\n    if (!runtime.verifier) {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"Verificatore JWT non configurato.\");\n    }\n    const verification = await runtime.verifier.verify(token);\n    payload = verification.payload;\n    user = verification.user;\n    codiceUtente = verification.codiceUtente;\n  } else {\n    if (!runtime.introspectionClient) {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"Client introspection non configurato.\");\n    }\n    const introspection = await runtime.introspectionClient.introspect(token);\n    if (!introspection.active) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido, scaduto o revocato.\");\n    }\n    user = introspection.user ?? {};\n    codiceUtente = introspection.codiceUtente;\n    grants = introspection.grants;\n    payload = mergeIntrospectionUser(undefined, user);\n  }\n\n  if (!codiceUtente) {\n    throw accessiAuthError(401, \"AUTH_USER_CODE_MISSING\", \"Token privo di un utente valido.\");\n  }\n\n  const requirementTree = buildRequirementTree(runtime.options.authorization);\n  if (requirementTree) {\n    if (!grants) {\n      if (!runtime.introspectionClient) {\n        throw accessiAuthError(\n          500,\n          \"AUTH_GRANTS_SOURCE_MISSING\",\n          \"La policy richiede grant ma introspection non e configurata.\",\n        );\n      }\n      const introspection = await runtime.introspectionClient.introspect(token);\n      if (!introspection.active) {\n        throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido, scaduto o revocato.\");\n      }\n      grants = introspection.grants;\n      if (introspection.user) {\n        user = introspection.user;\n        payload = mergeIntrospectionUser(payload, user);\n      }\n    }\n\n    const hasPermissions = await evaluateRequirement(\n      requirementTree,\n      {\n        req: request,\n        decodedToken: payload,\n        userCode: codiceUtente,\n        getGrantsResult: async () => grants ?? {},\n      },\n      runtime.options.authorization,\n    );\n    if (!hasPermissions) {\n      throw accessiAuthError(\n        403,\n        \"AUTH_INSUFFICIENT_PERMISSIONS\",\n        \"Permessi insufficienti per questa operazione.\",\n      );\n    }\n  }\n\n  const authenticatedRequest = request as AccessiAuthenticatedRequest;\n  const authPayload: Record<string, unknown> = payload ?? {\n    typ: \"access\",\n    codiceUtente,\n    utente: user,\n  };\n  authenticatedRequest.user = authPayload;\n  authenticatedRequest.data = authPayload;\n  if (grants) authenticatedRequest.userGrants = grants;\n  authenticatedRequest.accessi = {\n    token,\n    user,\n    codiceUtente,\n    ...(grants ? { grants } : {}),\n    payload: authPayload,\n  };\n  return authenticatedRequest.accessi;\n}\n"]}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/runtime.ts"],"names":[],"mappings":";;;;;;;;;;;AA+CA,kEAkBC;AAoBD,gEA6GC;AAjMD,4CAIsB;AAKtB,qCAA4C;AAC5C,mDAAmE;AAEnE,mCAAqD;AAsBrD,SAAS,WAAW,CAAC,OAAqC;IACxD,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC;IAClD,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,8DAA8D,CAC/D,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,2BAA2B,CACzC,OAAqC;IAErC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACnG,CAAC;IAED,qCACE,OAAO,kCAAO,OAAO,KAAE,IAAI,OACxB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAA,kCAA0B,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC1E,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAA,gDAAgC,EAAC,OAAO,CAAC,aAAa,CAAC,EAAE;QAClF,CAAC,CAAC,EAAE,CAAC,EACP;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA8C,EAC9C,IAA6B;IAE7B,qDACK,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,GAC9B,IAAI,KACP,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,IAAI,IACZ;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAsB,0BAA0B,CAC9C,OAAgB,EAChB,OAAqC;;;QAErC,MAAM,KAAK,GAAG,IAAA,qCAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,qCAAqC,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,IAAI,mCAAI,OAAO,CAAC;QAC7C,IAAI,OAA8C,CAAC;QACnD,IAAI,IAAI,GAA4B,EAAE,CAAC;QACvC,IAAI,YAAgC,CAAC;QACrC,IAAI,MAAgC,CAAC;QAErC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,mCAAmC,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;YAC/B,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;YACzB,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBACjC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,GAAG,MAAA,aAAa,CAAC,IAAI,mCAAI,EAAE,CAAC;YAChC,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;YAC1C,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;YAC9B,OAAO,GAAG,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,IAAI,KAAK,OAAO,KAAI,MAAA,OAAO,CAAC,OAAO,CAAC,UAAU,0CAAE,KAAK,CAAA,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzF,IAAI,SAAS,KAAK,IAAI,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,IAAA,gCAAoB,EAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5E,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;oBACjC,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,4BAA4B,EAC5B,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;gBACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC1E,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;oBAC1B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;gBAC7F,CAAC;gBACD,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;gBAC9B,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;oBACvB,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;oBAC1B,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAmB,EAC9C,eAAe,EACf;gBACE,GAAG,EAAE,OAAO;gBACZ,YAAY,EAAE,OAAO;gBACrB,QAAQ,EAAE,YAAY;gBACtB,eAAe,EAAE,GAAS,EAAE,gDAAC,OAAA,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAA,GAAA;aAC1C,EACD,OAAO,CAAC,OAAO,CAAC,aAAa,CAC9B,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,+BAA+B,EAC/B,+CAA+C,CAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAG,OAAsC,CAAC;QACpE,MAAM,WAAW,GAA4B,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI;YACtD,GAAG,EAAE,QAAQ;YACb,YAAY;YACZ,MAAM,EAAE,IAAI;SACb,CAAC;QACF,oBAAoB,CAAC,IAAI,GAAG,WAAW,CAAC;QACxC,oBAAoB,CAAC,IAAI,GAAG,WAAW,CAAC;QACxC,IAAI,MAAM;YAAE,oBAAoB,CAAC,UAAU,GAAG,MAAM,CAAC;QACrD,oBAAoB,CAAC,OAAO,iCAC1B,KAAK;YACL,IAAI;YACJ,YAAY,IACT,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7B,OAAO,EAAE,WAAW,GACrB,CAAC;QACF,OAAO,oBAAoB,CAAC,OAAO,CAAC;IACtC,CAAC;CAAA","sourcesContent":["import type { Request } from \"express\";\nimport {\n  buildRequirementTree,\n  evaluateRequirement,\n  extractAccessiBearerToken,\n} from \"../contracts\";\nimport type {\n  AccessiAccessTokenPayload,\n  GrantsResult,\n} from \"../contracts\";\nimport { accessiAuthError } from \"./errors\";\nimport { createAccessiIntrospectionClient } from \"./introspection\";\nimport type { AccessiIntrospectionClient } from \"./introspection\";\nimport { createAccessiTokenVerifier } from \"./token\";\nimport type { AccessiTokenVerifier } from \"./token\";\nimport type {\n  AccessiRequestContext,\n  AccessiResourceServerOptions,\n} from \"./types\";\n\n/** Request Express arricchita dal resource server. */\nexport interface AccessiAuthenticatedRequest extends Request {\n  user?: Record<string, unknown>;\n  data?: Record<string, unknown>;\n  userGrants?: GrantsResult;\n  accessi?: AccessiRequestContext;\n}\n\n/** Runtime creato una volta al bootstrap e riutilizzato a ogni richiesta. */\nexport interface AccessiResourceServerRuntime {\n  options: AccessiResourceServerOptions;\n  verifier?: AccessiTokenVerifier;\n  introspectionClient?: AccessiIntrospectionClient;\n}\n\nfunction resolveMode(options: AccessiResourceServerOptions): \"local\" | \"introspection\" {\n  if (options.mode) return options.mode;\n  if (options.jwt) return \"local\";\n  if (options.introspection) return \"introspection\";\n  throw accessiAuthError(\n    500,\n    \"AUTH_CONFIG_INVALID\",\n    \"Configurare jwt o introspection nel resource server Accessi.\",\n  );\n}\n\n/** Valida la configurazione e prepara verificatore e client di introspection. */\nexport function createAccessiResourceServer(\n  options: AccessiResourceServerOptions,\n): AccessiResourceServerRuntime {\n  const mode = resolveMode(options);\n  if (mode === \"local\" && !options.jwt) {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"mode local richiede jwt.\");\n  }\n  if (mode === \"introspection\" && !options.introspection) {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"mode introspection richiede introspection.\");\n  }\n\n  return {\n    options: { ...options, mode },\n    ...(options.jwt ? { verifier: createAccessiTokenVerifier(options.jwt) } : {}),\n    ...(options.introspection\n      ? { introspectionClient: createAccessiIntrospectionClient(options.introspection) }\n      : {}),\n  };\n}\n\nfunction mergeIntrospectionUser(\n  payload: AccessiAccessTokenPayload | undefined,\n  user: Record<string, unknown>,\n): AccessiAccessTokenPayload {\n  return {\n    ...(payload ?? { typ: \"access\" }),\n    ...user,\n    typ: \"access\",\n    utente: user,\n  };\n}\n\n/**\n * Autentica la request e applica l'eventuale policy di autorizzazione.\n *\n * Non accede mai al database Accessi: la verifica e locale oppure delegata\n * all'introspection di Accessi Service.\n */\nexport async function authenticateAccessiRequest(\n  request: Request,\n  runtime: AccessiResourceServerRuntime,\n): Promise<AccessiRequestContext> {\n  const token = extractAccessiBearerToken(request.headers.authorization);\n  if (!token) {\n    throw accessiAuthError(401, \"AUTH_TOKEN_MISSING\", \"Token Bearer mancante o malformato.\");\n  }\n\n  const mode = runtime.options.mode ?? \"local\";\n  let payload: AccessiAccessTokenPayload | undefined;\n  let user: Record<string, unknown> = {};\n  let codiceUtente: number | undefined;\n  let grants: GrantsResult | undefined;\n\n  if (mode === \"local\") {\n    if (!runtime.verifier) {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"Verificatore JWT non configurato.\");\n    }\n    const verification = await runtime.verifier.verify(token);\n    payload = verification.payload;\n    user = verification.user;\n    codiceUtente = verification.codiceUtente;\n  } else {\n    if (!runtime.introspectionClient) {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"Client introspection non configurato.\");\n    }\n    const introspection = await runtime.introspectionClient.introspect(token);\n    if (!introspection.active) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido, scaduto o revocato.\");\n    }\n    user = introspection.user ?? {};\n    codiceUtente = introspection.codiceUtente;\n    grants = introspection.grants;\n    payload = mergeIntrospectionUser(undefined, user);\n  }\n\n  if (!codiceUtente) {\n    throw accessiAuthError(401, \"AUTH_USER_CODE_MISSING\", \"Token privo di un utente valido.\");\n  }\n\n  if (mode === \"local\" && runtime.options.revocation?.store) {\n    const issuedAt = Number(payload?.iat);\n    if (!Number.isFinite(issuedAt)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token privo di iat.\");\n    }\n    const revokedAt = await runtime.options.revocation.store.getUserRevocation(codiceUtente);\n    if (revokedAt !== null && issuedAt < Math.floor(revokedAt / 1000)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_REVOKED\", \"Sessione revocata.\");\n    }\n  }\n\n  const requirementTree = buildRequirementTree(runtime.options.authorization);\n  if (requirementTree) {\n    if (!grants) {\n      if (!runtime.introspectionClient) {\n        throw accessiAuthError(\n          500,\n          \"AUTH_GRANTS_SOURCE_MISSING\",\n          \"La policy richiede grant ma introspection non e configurata.\",\n        );\n      }\n      const introspection = await runtime.introspectionClient.introspect(token);\n      if (!introspection.active) {\n        throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido, scaduto o revocato.\");\n      }\n      grants = introspection.grants;\n      if (introspection.user) {\n        user = introspection.user;\n        payload = mergeIntrospectionUser(payload, user);\n      }\n    }\n\n    const hasPermissions = await evaluateRequirement(\n      requirementTree,\n      {\n        req: request,\n        decodedToken: payload,\n        userCode: codiceUtente,\n        getGrantsResult: async () => grants ?? {},\n      },\n      runtime.options.authorization,\n    );\n    if (!hasPermissions) {\n      throw accessiAuthError(\n        403,\n        \"AUTH_INSUFFICIENT_PERMISSIONS\",\n        \"Permessi insufficienti per questa operazione.\",\n      );\n    }\n  }\n\n  const authenticatedRequest = request as AccessiAuthenticatedRequest;\n  const authPayload: Record<string, unknown> = payload ?? {\n    typ: \"access\",\n    codiceUtente,\n    utente: user,\n  };\n  authenticatedRequest.user = authPayload;\n  authenticatedRequest.data = authPayload;\n  if (grants) authenticatedRequest.userGrants = grants;\n  authenticatedRequest.accessi = {\n    token,\n    user,\n    codiceUtente,\n    ...(grants ? { grants } : {}),\n    payload: authPayload,\n  };\n  return authenticatedRequest.accessi;\n}\n"]}

package/dist/accessi/resource-server/types.d.ts

@@ -1,4 +1,5 @@
 import type { AccessiAuthorizationOptions, AccessiGrant, GrantsResult } from "../contracts";
+import type { SessionRevocationStore } from "../../accessi-module/security/sessionRevocation";
 /** Algoritmi JWT supportati dal resource server. */
 export type AccessiJwtAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512";
 /** Opzioni di verifica locale del JWT. Almeno una tra `secret`, `publicKey` e `jwks` e obbligatoria. */
@@ -65,6 +66,12 @@ export interface AccessiResourceServerOptions {
     introspection?: AccessiIntrospectionOptions;
     /** Policy di autorizzazione opzionale applicata dopo l'autenticazione. */
     authorization?: AccessiAuthorizationOptions;
+    /** Store condiviso di revoca sessioni. Opzionale. */
+    revocation?: {
+        store: SessionRevocationStore;
+    };
+    /** Audit strutturato degli errori di autenticazione. Default: true. */
+    audit?: boolean;
 }
 /** Dati allegati alla request dopo l'autenticazione. */
 export interface AccessiRequestContext {

package/dist/accessi/resource-server/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AccessiAuthorizationOptions,\n  AccessiGrant,\n  GrantsResult,\n} from \"../contracts\";\n\n/** Algoritmi JWT supportati dal resource server. */\nexport type AccessiJwtAlgorithm =\n  | \"HS256\"\n  | \"HS384\"\n  | \"HS512\"\n  | \"RS256\"\n  | \"RS384\"\n  | \"RS512\"\n  | \"ES256\"\n  | \"ES384\"\n  | \"ES512\";\n\n/** Opzioni di verifica locale del JWT. Almeno una tra `secret`, `publicKey` e `jwks` e obbligatoria. */\nexport interface AccessiResourceServerJwtOptions {\n  /** Chiave HMAC gia derivata (access key). Alternativa a `serverSecret`. */\n  secret?: string;\n  /**\n   * Segreto Accessi grezzo (`ACCESSI_JWT_SECRET`).\n   *\n   * Il resource server deriva automaticamente la chiave access con la stessa\n   * KDF del server: e il modo consigliato quando si condivide il segreto HS256.\n   */\n  serverSecret?: string;\n  /** Chiave pubblica PEM per algoritmi RS ed ES. */\n  publicKey?: string | Buffer;\n  /** JWKS remoto per verificare token firmati con chiavi asimmetriche. */\n  jwks?: {\n    url: string;\n    cacheTtlMs?: number;\n    timeoutMs?: number;\n    fetch?: typeof fetch;\n  };\n  /** Default: HS256 con `secret`, altrimenti RS/ES con `publicKey`/`jwks`. */\n  algorithms?: AccessiJwtAlgorithm[];\n  /** Issuer atteso (`iss`). */\n  issuer?: string;\n  /** Audience attesa (`aud`). */\n  audience?: string | string[];\n  /** Tolleranza orologio in secondi. Default: 5. */\n  clockToleranceSeconds?: number;\n}\n\n/** Configurazione del client di introspection verso Accessi Service. */\nexport interface AccessiIntrospectionOptions {\n  /** URL completo, es. `https://accessi.example.com/api/accessi/auth/introspect`. */\n  url: string;\n  /** Service token Accessi con scope `accessi:introspect`. */\n  serviceToken: string;\n  /** TTL della cache locale dei risultati attivi. Default: 30000 ms. */\n  cacheTtlMs?: number;\n  /** Timeout HTTP. Default: 3000 ms. */\n  timeoutMs?: number;\n  /** Fetch iniettabile per test o runtime non-Node. */\n  fetch?: typeof fetch;\n}\n\n/** Risultato dell'introspection. */\nexport interface AccessiIntrospectionResult {\n  active: boolean;\n  user?: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n}\n\n/** Modalita di autenticazione del resource server. */\nexport type AccessiResourceServerMode = \"local\" | \"introspection\";\n\n/**\n * Configurazione di un backend fratello che non possiede il database Accessi.\n *\n * - `mode: \"local\"` verifica il JWT con chiave locale e, se servono grant, usa\n *   l'introspection per leggerli.\n * - `mode: \"introspection\"` delega la verifica del token ad Accessi Service.\n */\nexport interface AccessiResourceServerOptions {\n  mode?: AccessiResourceServerMode;\n  jwt?: AccessiResourceServerJwtOptions;\n  introspection?: AccessiIntrospectionOptions;\n  /** Policy di autorizzazione opzionale applicata dopo l'autenticazione. */\n  authorization?: AccessiAuthorizationOptions;\n}\n\n/** Dati allegati alla request dopo l'autenticazione. */\nexport interface AccessiRequestContext {\n  token: string;\n  user: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n  payload?: Record<string, unknown>;\n}\n\n/** Grant esposto per compatibilita con il middleware storico. */\nexport type AccessiRequestGrants = AccessiGrant[];\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AccessiAuthorizationOptions,\n  AccessiGrant,\n  GrantsResult,\n} from \"../contracts\";\nimport type { SessionRevocationStore } from \"../../accessi-module/security/sessionRevocation\";\n\n/** Algoritmi JWT supportati dal resource server. */\nexport type AccessiJwtAlgorithm =\n  | \"HS256\"\n  | \"HS384\"\n  | \"HS512\"\n  | \"RS256\"\n  | \"RS384\"\n  | \"RS512\"\n  | \"ES256\"\n  | \"ES384\"\n  | \"ES512\";\n\n/** Opzioni di verifica locale del JWT. Almeno una tra `secret`, `publicKey` e `jwks` e obbligatoria. */\nexport interface AccessiResourceServerJwtOptions {\n  /** Chiave HMAC gia derivata (access key). Alternativa a `serverSecret`. */\n  secret?: string;\n  /**\n   * Segreto Accessi grezzo (`ACCESSI_JWT_SECRET`).\n   *\n   * Il resource server deriva automaticamente la chiave access con la stessa\n   * KDF del server: e il modo consigliato quando si condivide il segreto HS256.\n   */\n  serverSecret?: string;\n  /** Chiave pubblica PEM per algoritmi RS ed ES. */\n  publicKey?: string | Buffer;\n  /** JWKS remoto per verificare token firmati con chiavi asimmetriche. */\n  jwks?: {\n    url: string;\n    cacheTtlMs?: number;\n    timeoutMs?: number;\n    fetch?: typeof fetch;\n  };\n  /** Default: HS256 con `secret`, altrimenti RS/ES con `publicKey`/`jwks`. */\n  algorithms?: AccessiJwtAlgorithm[];\n  /** Issuer atteso (`iss`). */\n  issuer?: string;\n  /** Audience attesa (`aud`). */\n  audience?: string | string[];\n  /** Tolleranza orologio in secondi. Default: 5. */\n  clockToleranceSeconds?: number;\n}\n\n/** Configurazione del client di introspection verso Accessi Service. */\nexport interface AccessiIntrospectionOptions {\n  /** URL completo, es. `https://accessi.example.com/api/accessi/auth/introspect`. */\n  url: string;\n  /** Service token Accessi con scope `accessi:introspect`. */\n  serviceToken: string;\n  /** TTL della cache locale dei risultati attivi. Default: 30000 ms. */\n  cacheTtlMs?: number;\n  /** Timeout HTTP. Default: 3000 ms. */\n  timeoutMs?: number;\n  /** Fetch iniettabile per test o runtime non-Node. */\n  fetch?: typeof fetch;\n}\n\n/** Risultato dell'introspection. */\nexport interface AccessiIntrospectionResult {\n  active: boolean;\n  user?: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n}\n\n/** Modalita di autenticazione del resource server. */\nexport type AccessiResourceServerMode = \"local\" | \"introspection\";\n\n/**\n * Configurazione di un backend fratello che non possiede il database Accessi.\n *\n * - `mode: \"local\"` verifica il JWT con chiave locale e, se servono grant, usa\n *   l'introspection per leggerli.\n * - `mode: \"introspection\"` delega la verifica del token ad Accessi Service.\n */\nexport interface AccessiResourceServerOptions {\n  mode?: AccessiResourceServerMode;\n  jwt?: AccessiResourceServerJwtOptions;\n  introspection?: AccessiIntrospectionOptions;\n  /** Policy di autorizzazione opzionale applicata dopo l'autenticazione. */\n  authorization?: AccessiAuthorizationOptions;\n  /** Store condiviso di revoca sessioni. Opzionale. */\n  revocation?: {\n    store: SessionRevocationStore;\n  };\n  /** Audit strutturato degli errori di autenticazione. Default: true. */\n  audit?: boolean;\n}\n\n/** Dati allegati alla request dopo l'autenticazione. */\nexport interface AccessiRequestContext {\n  token: string;\n  user: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n  payload?: Record<string, unknown>;\n}\n\n/** Grant esposto per compatibilita con il middleware storico. */\nexport type AccessiRequestGrants = AccessiGrant[];\n"]}

package/dist/accessi/server/index.d.ts

@@ -6,5 +6,6 @@
  * `accessi/resource-server` e `accessi/client`.
  */
 export * from "../../accessi-module";
+export * from "./standalone";
 export type { AccessiOptions as AccessiServerOptions } from "../../accessi-module";
 export { createAccessiOptionsFromEnv, createCatalogScriptsOptionsFromEnv, } from "../../accessi-module/database-updates/accessiOptionsFromEnv";

package/dist/accessi/server/index.js

@@ -23,6 +23,7 @@ exports.createCatalogScriptsOptionsFromEnv = exports.createAccessiOptionsFromEnv
  * `accessi/resource-server` e `accessi/client`.
  */
 __exportStar(require("../../accessi-module"), exports);
+__exportStar(require("./standalone"), exports);
 var accessiOptionsFromEnv_1 = require("../../accessi-module/database-updates/accessiOptionsFromEnv");
 Object.defineProperty(exports, "createAccessiOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createAccessiOptionsFromEnv; } });
 Object.defineProperty(exports, "createCatalogScriptsOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createCatalogScriptsOptionsFromEnv; } });

package/dist/accessi/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,uDAAqC;AAErC,qGAGqE;AAFnE,oIAAA,2BAA2B,OAAA;AAC3B,2IAAA,kCAAkC,OAAA","sourcesContent":["/**\n * Entry point server Accessi.\n *\n * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,\n * console e servizi Nest completi. I backend fratelli devono usare\n * `accessi/resource-server` e `accessi/client`.\n */\nexport * from \"../../accessi-module\";\nexport type { AccessiOptions as AccessiServerOptions } from \"../../accessi-module\";\nexport {\n  createAccessiOptionsFromEnv,\n  createCatalogScriptsOptionsFromEnv,\n} from \"../../accessi-module/database-updates/accessiOptionsFromEnv\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,uDAAqC;AACrC,+CAA6B;AAE7B,qGAGqE;AAFnE,oIAAA,2BAA2B,OAAA;AAC3B,2IAAA,kCAAkC,OAAA","sourcesContent":["/**\n * Entry point server Accessi.\n *\n * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,\n * console e servizi Nest completi. I backend fratelli devono usare\n * `accessi/resource-server` e `accessi/client`.\n */\nexport * from \"../../accessi-module\";\nexport * from \"./standalone\";\nexport type { AccessiOptions as AccessiServerOptions } from \"../../accessi-module\";\nexport {\n  createAccessiOptionsFromEnv,\n  createCatalogScriptsOptionsFromEnv,\n} from \"../../accessi-module/database-updates/accessiOptionsFromEnv\";\n"]}

package/dist/accessi/server/standalone.d.ts

@@ -0,0 +1,41 @@
+import type { Application } from 'express';
+import type { Server } from 'http';
+import type { AccessiModuleInitializationResult } from '../../accessi-module';
+import type { AccessiOptions } from '../../accessi-module/AccessiModule';
+export interface AccessiReadinessCheck {
+    name: string;
+    check: () => boolean | Promise<boolean>;
+}
+export interface AccessiServiceOptions {
+    /** Applicazione Express gia esistente. Default: nuova app. */
+    app?: Application;
+    /** Configurazione completa. Default: `createAccessiOptionsFromEnv()`. */
+    accessiOptions?: AccessiOptions;
+    port?: number;
+    host?: string;
+    /** Path base degli endpoint health. Default: `/health`. */
+    healthPath?: string;
+    /** Espone `/health/metrics` in formato Prometheus. Default: true. */
+    metrics?: boolean;
+    /** Check aggiuntivi per la readiness. */
+    readinessChecks?: AccessiReadinessCheck[];
+    /** Timeout chiusura server. Default: 10000 ms. */
+    shutdownTimeoutMs?: number;
+}
+export interface AccessiService {
+    app: Application;
+    nestApp: AccessiModuleInitializationResult['nestApp'];
+    document: AccessiModuleInitializationResult['document'];
+    start(): Promise<Server>;
+    stop(): Promise<void>;
+}
+/**
+ * Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.
+ *
+ * Non apre la porta finche non viene chiamato `start()`.
+ */
+export declare function createAccessiService(options?: AccessiServiceOptions): Promise<AccessiService>;
+/**
+ * Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.
+ */
+export declare function startAccessiService(options?: AccessiServiceOptions): Promise<AccessiService>;

package/dist/accessi/server/standalone.js

@@ -0,0 +1,264 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiService = createAccessiService;
+exports.startAccessiService = startAccessiService;
+const express_1 = __importDefault(require("express"));
+const Logger_1 = require("../../Logger");
+const Orm_1 = require("../../Orm");
+const accessi_module_1 = require("../../accessi-module");
+const accessiOptionsFromEnv_1 = require("../../accessi-module/database-updates/accessiOptionsFromEnv");
+const accessiSchema_1 = require("../../accessi-module/database-updates/accessiSchema");
+const AccessiDatabaseUpdater_1 = require("../../accessi-module/database-updates/AccessiDatabaseUpdater");
+const validateOptions_1 = require("../../accessi-module/security/validateOptions");
+function normalizePath(value) {
+    return `/${value.replace(/^\/+|\/+$/g, '')}`;
+}
+function createMetrics() {
+    const startedAt = Date.now();
+    let requests = 0;
+    let inFlight = 0;
+    const statuses = new Map();
+    const middleware = (_req, res, next) => {
+        requests += 1;
+        inFlight += 1;
+        res.on('finish', () => {
+            var _a;
+            inFlight = Math.max(0, inFlight - 1);
+            const status = String(res.statusCode);
+            statuses.set(status, ((_a = statuses.get(status)) !== null && _a !== void 0 ? _a : 0) + 1);
+        });
+        next();
+    };
+    const render = () => {
+        const memory = process.memoryUsage();
+        const lines = [
+            '# HELP accessi_http_requests_total Richieste HTTP totali.',
+            '# TYPE accessi_http_requests_total counter',
+            ...[...statuses.entries()].map(([status, count]) => `accessi_http_requests_total{status="${status}"} ${count}`),
+            '# HELP accessi_http_in_flight Richieste HTTP in corso.',
+            '# TYPE accessi_http_in_flight gauge',
+            `accessi_http_in_flight ${inFlight}`,
+            '# HELP accessi_process_uptime_seconds Uptime del processo.',
+            '# TYPE accessi_process_uptime_seconds gauge',
+            `accessi_process_uptime_seconds ${Math.floor((Date.now() - startedAt) / 1000)}`,
+            '# HELP accessi_process_memory_bytes Memoria del processo.',
+            '# TYPE accessi_process_memory_bytes gauge',
+            `accessi_process_memory_bytes{type="rss"} ${memory.rss}`,
+            `accessi_process_memory_bytes{type="heapUsed"} ${memory.heapUsed}`,
+            `accessi_process_memory_bytes{type="heapTotal"} ${memory.heapTotal}`,
+            '# HELP accessi_http_requests_started_total Richieste HTTP avviate.',
+            '# TYPE accessi_http_requests_started_total counter',
+            `accessi_http_requests_started_total ${requests}`,
+        ];
+        return `${lines.join('\n')}\n`;
+    };
+    return { middleware, render };
+}
+function collectHealthStores(options) {
+    var _a, _b, _c, _d, _e, _f;
+    const stores = [];
+    const seen = new Set();
+    const add = (name, store) => {
+        if (!store || seen.has(store) || typeof store.healthCheck !== 'function')
+            return;
+        seen.add(store);
+        stores.push({ name, store });
+    };
+    add('publicAuthRateLimit', (_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.store);
+    add('serviceTokenRateLimit', (_b = options.serviceTokens) === null || _b === void 0 ? void 0 : _b.rateLimitStore);
+    add('consoleEntry', (_c = options.consoleEntry) === null || _c === void 0 ? void 0 : _c.store);
+    add('edgeRateLimit', (_d = options.edgeRateLimit) === null || _d === void 0 ? void 0 : _d.store);
+    add('sessionRevocation', (_e = options.sessionRevocation) === null || _e === void 0 ? void 0 : _e.store);
+    add('refreshTokenRotation', (_f = options.refreshTokenRotation) === null || _f === void 0 ? void 0 : _f.store);
+    return stores;
+}
+function checkDatabase(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const version = yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.getCurrentVersion(options);
+            if (!version) {
+                return { ok: false, detail: 'schema Accessi non inizializzato' };
+            }
+            return {
+                ok: true,
+                detail: version === accessiSchema_1.ACCESSI_SCHEMA_VERSION
+                    ? version
+                    : `${version} (atteso ${accessiSchema_1.ACCESSI_SCHEMA_VERSION})`,
+            };
+        }
+        catch (error) {
+            return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+        }
+    });
+}
+/**
+ * Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.
+ *
+ * Non apre la porta finche non viene chiamato `start()`.
+ */
+function createAccessiService() {
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        var _a, _b, _c, _d;
+        const logger = new Logger_1.Logger('AccessiService');
+        const accessiOptions = (_a = options.accessiOptions) !== null && _a !== void 0 ? _a : (0, accessiOptionsFromEnv_1.createAccessiOptionsFromEnv)();
+        (0, validateOptions_1.assertValidAccessiOptions)(accessiOptions);
+        for (const warning of (0, validateOptions_1.validateAccessiOptions)(accessiOptions).warnings) {
+            logger.warning(`Configurazione Accessi: ${warning.code} - ${warning.message}`);
+        }
+        const app = (_b = options.app) !== null && _b !== void 0 ? _b : (0, express_1.default)();
+        const healthPath = normalizePath((_c = options.healthPath) !== null && _c !== void 0 ? _c : '/health');
+        const metrics = createMetrics();
+        const readinessChecks = (_d = options.readinessChecks) !== null && _d !== void 0 ? _d : [];
+        let initialized = false;
+        let nestApp;
+        let document;
+        let server;
+        let stopping = false;
+        app.use(metrics.middleware);
+        app.get(`${healthPath}/live`, (_req, res) => {
+            res.status(200).json({
+                status: 'ok',
+                uptimeSeconds: Math.floor(process.uptime()),
+            });
+        });
+        app.get(`${healthPath}/ready`, (_req, res) => __awaiter(this, void 0, void 0, function* () {
+            if (!initialized || !nestApp) {
+                res.status(503).json({
+                    status: 'error',
+                    checks: { bootstrap: { ok: false, detail: 'bootstrap non completato' } },
+                });
+                return;
+            }
+            const checks = {
+                bootstrap: { ok: true },
+                database: yield checkDatabase(accessiOptions),
+            };
+            const stores = collectHealthStores(accessiOptions);
+            yield Promise.all(stores.map((_a) => __awaiter(this, [_a], void 0, function* ({ name, store }) {
+                var _b;
+                try {
+                    checks[name] = { ok: Boolean(yield ((_b = store.healthCheck) === null || _b === void 0 ? void 0 : _b.call(store))) };
+                }
+                catch (error) {
+                    checks[name] = {
+                        ok: false,
+                        detail: error instanceof Error ? error.message : String(error),
+                    };
+                }
+            })));
+            for (const check of readinessChecks) {
+                try {
+                    const ok = yield check.check();
+                    checks[check.name] = { ok: Boolean(ok) };
+                }
+                catch (error) {
+                    checks[check.name] = {
+                        ok: false,
+                        detail: error instanceof Error ? error.message : String(error),
+                    };
+                }
+            }
+            const ok = Object.values(checks).every((check) => check.ok);
+            res.status(ok ? 200 : 503).json({
+                status: ok ? 'ok' : 'error',
+                checks,
+                timestamp: new Date().toISOString(),
+            });
+        }));
+        if (options.metrics !== false) {
+            app.get(`${healthPath}/metrics`, (_req, res) => {
+                res.setHeader('Content-Type', 'text/plain; version=0.0.4');
+                res.status(200).send(metrics.render());
+            });
+        }
+        const result = yield (0, accessi_module_1.initializeAccessiModule)(app, accessiOptions);
+        nestApp = result.nestApp;
+        document = result.document;
+        initialized = true;
+        const stop = () => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (stopping)
+                return;
+            stopping = true;
+            const timeout = Math.max(1000, (_a = options.shutdownTimeoutMs) !== null && _a !== void 0 ? _a : 10000);
+            yield Promise.race([
+                new Promise((resolve) => {
+                    if (!server)
+                        return resolve();
+                    server.close(() => resolve());
+                }),
+                new Promise((resolve) => setTimeout(resolve, timeout)),
+            ]);
+            try {
+                yield (nestApp === null || nestApp === void 0 ? void 0 : nestApp.close());
+            }
+            finally {
+                yield Orm_1.Orm.closePools();
+            }
+        });
+        const start = () => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            if (server)
+                return server;
+            const port = (_a = options.port) !== null && _a !== void 0 ? _a : Number((_b = process.env.PORT) !== null && _b !== void 0 ? _b : 3000);
+            server = yield new Promise((resolve, reject) => {
+                const listener = options.host
+                    ? app.listen(port, options.host, () => resolve(listener))
+                    : app.listen(port, () => resolve(listener));
+                listener.once('error', reject);
+            });
+            const address = server.address();
+            const actualPort = typeof address === 'object' && address ? address.port : port;
+            logger.info(`Accessi Service in ascolto su http://${(_c = options.host) !== null && _c !== void 0 ? _c : '0.0.0.0'}:${actualPort}`);
+            return server;
+        });
+        return {
+            app,
+            get nestApp() {
+                if (!nestApp)
+                    throw new Error('Accessi Service non inizializzato.');
+                return nestApp;
+            },
+            get document() {
+                if (!document)
+                    throw new Error('Documento OpenAPI non disponibile.');
+                return document;
+            },
+            start,
+            stop,
+        };
+    });
+}
+/**
+ * Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.
+ */
+function startAccessiService() {
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        const service = yield createAccessiService(options);
+        yield service.start();
+        let shuttingDown = false;
+        const shutdown = (signal) => __awaiter(this, void 0, void 0, function* () {
+            if (shuttingDown)
+                return;
+            shuttingDown = true;
+            new Logger_1.Logger('AccessiService').info(`Ricevuto ${signal}: arresto in corso.`);
+            yield service.stop();
+        });
+        process.once('SIGTERM', () => { void shutdown('SIGTERM'); });
+        process.once('SIGINT', () => { void shutdown('SIGINT'); });
+        return service;
+    });
+}
+//# sourceMappingURL=standalone.js.map