emilsoftware-utilities 2.0.0-dev.67 → 2.0.0-dev.69

package/dist/accessi-module/middleware/authenticateGen.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqRA,wEAIC;AAGD,sDAOC;AAGD,sEAKC;AA4DD,4CAiCC;AAvYD,kDAAoC;AACpC,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAMwC;AACxC,iEAAsF;AAEtF,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,GAAa,EAAE,OAA4B;IAC1E,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;YACrB,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,sCAAsC,CAAC;IAE/C,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,sEAAsE;QACtE,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;QAOxB,MAAM,oBAAoB,GAAG,GAA2B,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,IAAI,YAAwE,CAAC;YAC7E,IAAI,CAAC;gBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,cAAc,CAAC,CAAC;YACzE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,gCAAgC,CAAC,CAAC;YACpF,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5E,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,oBAAoB,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5D,CAAC;YAED,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CAAA;AAIM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEL;;;OAGG;IACG,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA5BY,wDAAsB;iCAAtB,sBAAsB;IAFlC,IAAA,mBAAU,GAAE;IACb,gFAAgF;;IAG3E,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CA4BlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED;;;;;;GAMG;AACH,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,IAAI,GAAG,4BAA4B;gBACvC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,8BAA8B,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,CAAC;gBACb,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,sCAAsC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAED,mIAAmI;AACtH,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\nimport * as jwt from \"jsonwebtoken\";\nimport { Inject, Injectable } from \"@nestjs/common\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\nimport { UserService } from \"../Services/UserService/UserService\";\nimport { Logger } from \"../../Logger\";\nimport {\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  GrantsResult,\n  RequirementEvaluationError,\n  buildRequirementTree,\n  evaluateRequirement,\n} from \"./accessiRequirements\";\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../security/authenticatedToken\";\nimport { getAccessiAccessTokenVerificationConfig } from \"../security/jwtTokenOptions\";\n\nconst logger = new Logger(\"AuthenticateGen\");\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\n\ntype Deferred<T> = {\n  promise: Promise<T>;\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n};\n\nclass AuthMiddlewareError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n    public readonly details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = \"AuthMiddlewareError\";\n  }\n}\n\nfunction authError(\n  status: number,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>\n) {\n  return new AuthMiddlewareError(status, code, message, details);\n}\n\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\n  if (error instanceof AuthMiddlewareError) return error;\n  if (error instanceof RequirementEvaluationError) {\n    return authError(500, error.code, error.message);\n  }\n  if (error instanceof Error) {\n    return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\n      originalError: error.name,\n    });\n  }\n  return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\n}\n\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\n  const payload = {\n    code: authErr.code,\n    status: authErr.status,\n    message: authErr.message,\n    details: authErr.details,\n    method: req.method,\n    path: req.originalUrl ?? req.url,\n    ip: req.ip,\n  };\n\n  const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\n  if (authErr.status >= 500) logger.error(message);\n  else logger.warning(message);\n}\n\n/** Sends the documented Accessi error contract from Express middleware. */\nfunction sendAuthenticationError(res: Response, authErr: AuthMiddlewareError): Response {\n  const message =\n    authErr.status === 403\n      ? 'Operazione non autorizzata.'\n      : authErr.status >= 500\n        ? 'Errore interno del modulo Accessi.'\n        : 'Autenticazione non valida o scaduta.';\n\n  return res.status(authErr.status).json({\n    severity: 'error',\n    status: authErr.status,\n    statusCode: 2,\n    code: authErr.code,\n    // Kept for callers of older versions which already inspected `error`.\n    error: authErr.code,\n    message,\n  });\n}\n\nasync function authorizeWithDependencies(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options: AccessiAuthorizationOptions | undefined,\n  accessiOptions: AccessiOptions,\n  permissionService: PermissionService,\n  userService: UserService\n) {\n  type AuthenticatedRequest = Request & {\n    userGrants?: unknown;\n    user?: unknown;\n    data?: unknown;\n  };\n  const authenticatedRequest = req as AuthenticatedRequest;\n\n  try {\n    const authHeader = req.headers.authorization;\n    if (!authHeader) {\n      throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\n    }\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) {\n      throw authError(\n        401,\n        \"AUTH_TOKEN_MISSING\",\n        \"Token not found in Authorization header\"\n      );\n    }\n\n    let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n    try {\n      verification = getAccessiAccessTokenVerificationConfig(accessiOptions);\n    } catch {\n      throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT signing key not configured\");\n    }\n\n    let decoded: unknown;\n    try {\n      decoded = jwt.verify(token, verification.key, verification.verifyOptions);\n    } catch {\n      throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n    if (!codiceUtente) {\n      throw authError(\n        401,\n        \"AUTH_USER_CODE_MISSING\",\n        \"codiceUtente not found in token payload\"\n      );\n    }\n\n    const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw authError(\n        401,\n        \"AUTH_USER_DISABLED\",\n        \"User is no longer authorized\"\n      );\n    }\n\n    const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\n\n    const requirementTree = buildRequirementTree(options);\n    if (requirementTree) {\n      if (!accessiOptions?.databaseOptions) {\n        throw authError(\n          500,\n          \"AUTH_DATABASE_OPTIONS_MISSING\",\n          \"Database options not configured\"\n        );\n      }\n\n      let grantsResultCache: GrantsResult | null = null;\n      const getGrantsResult = async () => {\n        if (!grantsResultCache) {\n          grantsResultCache = await permissionService.getUserRolesAndGrants(\n            codiceUtente\n          );\n        }\n        return grantsResultCache;\n      };\n\n      const requirementContext: AccessiCustomRequirementContext = {\n        req,\n        decodedToken: authenticatedPayload,\n        userCode: codiceUtente,\n        getGrantsResult,\n      };\n\n      const hasPermissions = await evaluateRequirement(\n        requirementTree,\n        requirementContext,\n        options\n      );\n\n      if (!hasPermissions) {\n        throw authError(\n          403,\n          \"AUTH_INSUFFICIENT_PERMISSIONS\",\n          \"User does not have required permissions\"\n        );\n      }\n\n      authenticatedRequest.userGrants = await getGrantsResult();\n    }\n\n    authenticatedRequest.user = authenticatedPayload;\n    authenticatedRequest.data = authenticatedPayload;\n    return next();\n  } catch (error: unknown) {\n    const authErr = normalizeAuthError(error);\n    logAuthFailure(req, authErr);\n    return sendAuthenticationError(res, authErr);\n  }\n}\n\n@Injectable()\n/** Nest service behind the Express-compatible `authorizeAccessi` middleware. */\nexport class AuthenticateGenService {\n  constructor(\n    @Inject(\"ACCESSI_OPTIONS\")\n    private readonly accessiOptions: AccessiOptions,\n    private readonly permissionService: PermissionService,\n    private readonly userService: UserService\n  ) { }\n\n  /**\n   * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.\n   * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.\n   */\n  async authorize(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    options?: AccessiAuthorizationOptions\n  ) {\n    return authorizeWithDependencies(\n      req,\n      res,\n      next,\n      options,\n      this.accessiOptions,\n      this.permissionService,\n      this.userService\n    );\n  }\n}\n\nlet authenticateGenServiceRef: AuthenticateGenService | null = null;\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> | null = null;\n\nfunction createDeferred<T>(): Deferred<T> {\n  let resolve!: (value: T) => void;\n  let reject!: (reason?: unknown) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej;\n  });\n  return { promise, resolve, reject };\n}\n\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\n  return Boolean(\n    value &&\n    typeof (value as { authorize?: unknown }).authorize === \"function\"\n  );\n}\n\n/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */\nexport function beginAccessiAuthInitialization() {\n  if (!authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\n  }\n}\n\n/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */\nexport function setAccessiAuthService(service: AuthenticateGenService) {\n  authenticateGenServiceRef = service;\n  (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.resolve(service);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\n/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */\nexport function failAccessiAuthInitialization(error: unknown) {\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.reject(error);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService | null {\n  const appLocalsService = (req.app?.locals as Record<string, unknown> | undefined)?.[\n    ACCESSI_AUTH_SERVICE_LOCALS_KEY\n  ];\n\n  if (isAuthenticateGenService(appLocalsService)) {\n    return appLocalsService as AuthenticateGenService;\n  }\n\n  const globalService = (globalThis as Record<symbol, unknown>)[\n    ACCESSI_AUTH_SERVICE_GLOBAL_KEY\n  ];\n  if (isAuthenticateGenService(globalService)) {\n    return globalService as AuthenticateGenService;\n  }\n\n  return authenticateGenServiceRef;\n}\n\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService | null> {\n  if (!authServiceBootstrapDeferred) {\n    return null;\n  }\n\n  const bootstrapPromise = authServiceBootstrapDeferred.promise;\n  const timeoutPromise = new Promise<null>((resolve) => {\n    setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\n  });\n\n  try {\n    const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\n    return isAuthenticateGenService(resolved) ? resolved : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService | null> {\n  const immediateService = getAccessiAuthServiceFromRequest(req);\n  if (immediateService) {\n    return immediateService;\n  }\n\n  const bootstrappedService = await waitForBootstrappedService();\n  if (bootstrappedService) {\n    return bootstrappedService;\n  }\n\n  return getAccessiAuthServiceFromRequest(req);\n}\n\n/**\n * Middleware Express pubblico di Accessi.\n *\n * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente\n * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente\n * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.\n */\nexport async function authorizeAccessi(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options?: AccessiAuthorizationOptions\n) {\n  const authService = await resolveAccessiAuthService(req);\n\n  if (!authService) {\n    const status = authServiceBootstrapDeferred ? 503 : 500;\n    const code = authServiceBootstrapDeferred\n      ? 'ACCESSI_AUTH_INITIALIZING'\n      : 'ACCESSI_AUTH_NOT_INITIALIZED';\n    logger.error(\n      `Authentication service not initialized ${JSON.stringify({\n        method: req.method,\n        path: req.originalUrl ?? req.url,\n        status,\n      })}`\n    );\n    return res.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: 2,\n      code,\n      error: code,\n      message: status === 503\n        ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'\n        : 'Il modulo Accessi non e disponibile.',\n    });\n  }\n\n  return authService.authorize(req, res, next, options);\n}\n\n/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */\nexport const authenticateGen = authorizeAccessi;\n"]}
+{"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyRA,wEAIC;AAGD,sDAOC;AAGD,sEAKC;AA4DD,4CAiCC;AA3YD,kDAAoC;AACpC,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAMwC;AACxC,iEAAsF;AACtF,qEAAsE;AAEtE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,GAAa,EAAE,OAA4B;IAC1E,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;YACrB,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,sCAAsC,CAAC;IAE/C,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,sEAAsE;QACtE,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;QAOxB,MAAM,oBAAoB,GAAG,GAA2B,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,IAAI,YAAwE,CAAC;YAC7E,IAAI,CAAC;gBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,cAAc,CAAC,CAAC;YACzE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,gCAAgC,CAAC,CAAC;YACpF,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5E,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBAClG,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,oBAAoB,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5D,CAAC;YAED,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CAAA;AAIM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEL;;;OAGG;IACG,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA5BY,wDAAsB;iCAAtB,sBAAsB;IAFlC,IAAA,mBAAU,GAAE;IACb,gFAAgF;;IAG3E,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CA4BlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED;;;;;;GAMG;AACH,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,IAAI,GAAG,4BAA4B;gBACvC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,8BAA8B,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,CAAC;gBACb,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,sCAAsC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAED,mIAAmI;AACtH,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\nimport * as jwt from \"jsonwebtoken\";\nimport { Inject, Injectable } from \"@nestjs/common\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\nimport { UserService } from \"../Services/UserService/UserService\";\nimport { Logger } from \"../../Logger\";\nimport {\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  GrantsResult,\n  RequirementEvaluationError,\n  buildRequirementTree,\n  evaluateRequirement,\n} from \"./accessiRequirements\";\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../security/authenticatedToken\";\nimport { getAccessiAccessTokenVerificationConfig } from \"../security/jwtTokenOptions\";\nimport { isAccessiTokenRevoked } from \"../security/sessionRevocation\";\n\nconst logger = new Logger(\"AuthenticateGen\");\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\n\ntype Deferred<T> = {\n  promise: Promise<T>;\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n};\n\nclass AuthMiddlewareError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n    public readonly details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = \"AuthMiddlewareError\";\n  }\n}\n\nfunction authError(\n  status: number,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>\n) {\n  return new AuthMiddlewareError(status, code, message, details);\n}\n\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\n  if (error instanceof AuthMiddlewareError) return error;\n  if (error instanceof RequirementEvaluationError) {\n    return authError(500, error.code, error.message);\n  }\n  if (error instanceof Error) {\n    return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\n      originalError: error.name,\n    });\n  }\n  return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\n}\n\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\n  const payload = {\n    code: authErr.code,\n    status: authErr.status,\n    message: authErr.message,\n    details: authErr.details,\n    method: req.method,\n    path: req.originalUrl ?? req.url,\n    ip: req.ip,\n  };\n\n  const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\n  if (authErr.status >= 500) logger.error(message);\n  else logger.warning(message);\n}\n\n/** Sends the documented Accessi error contract from Express middleware. */\nfunction sendAuthenticationError(res: Response, authErr: AuthMiddlewareError): Response {\n  const message =\n    authErr.status === 403\n      ? 'Operazione non autorizzata.'\n      : authErr.status >= 500\n        ? 'Errore interno del modulo Accessi.'\n        : 'Autenticazione non valida o scaduta.';\n\n  return res.status(authErr.status).json({\n    severity: 'error',\n    status: authErr.status,\n    statusCode: 2,\n    code: authErr.code,\n    // Kept for callers of older versions which already inspected `error`.\n    error: authErr.code,\n    message,\n  });\n}\n\nasync function authorizeWithDependencies(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options: AccessiAuthorizationOptions | undefined,\n  accessiOptions: AccessiOptions,\n  permissionService: PermissionService,\n  userService: UserService\n) {\n  type AuthenticatedRequest = Request & {\n    userGrants?: unknown;\n    user?: unknown;\n    data?: unknown;\n  };\n  const authenticatedRequest = req as AuthenticatedRequest;\n\n  try {\n    const authHeader = req.headers.authorization;\n    if (!authHeader) {\n      throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\n    }\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) {\n      throw authError(\n        401,\n        \"AUTH_TOKEN_MISSING\",\n        \"Token not found in Authorization header\"\n      );\n    }\n\n    let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n    try {\n      verification = getAccessiAccessTokenVerificationConfig(accessiOptions);\n    } catch {\n      throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT signing key not configured\");\n    }\n\n    let decoded: unknown;\n    try {\n      decoded = jwt.verify(token, verification.key, verification.verifyOptions);\n    } catch {\n      throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n    if (!codiceUtente) {\n      throw authError(\n        401,\n        \"AUTH_USER_CODE_MISSING\",\n        \"codiceUtente not found in token payload\"\n      );\n    }\n    if (await isAccessiTokenRevoked(accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n      throw authError(401, \"AUTH_TOKEN_REVOKED\", \"Session revoked\");\n    }\n\n    const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw authError(\n        401,\n        \"AUTH_USER_DISABLED\",\n        \"User is no longer authorized\"\n      );\n    }\n\n    const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\n\n    const requirementTree = buildRequirementTree(options);\n    if (requirementTree) {\n      if (!accessiOptions?.databaseOptions) {\n        throw authError(\n          500,\n          \"AUTH_DATABASE_OPTIONS_MISSING\",\n          \"Database options not configured\"\n        );\n      }\n\n      let grantsResultCache: GrantsResult | null = null;\n      const getGrantsResult = async () => {\n        if (!grantsResultCache) {\n          grantsResultCache = await permissionService.getUserRolesAndGrants(\n            codiceUtente\n          );\n        }\n        return grantsResultCache;\n      };\n\n      const requirementContext: AccessiCustomRequirementContext = {\n        req,\n        decodedToken: authenticatedPayload,\n        userCode: codiceUtente,\n        getGrantsResult,\n      };\n\n      const hasPermissions = await evaluateRequirement(\n        requirementTree,\n        requirementContext,\n        options\n      );\n\n      if (!hasPermissions) {\n        throw authError(\n          403,\n          \"AUTH_INSUFFICIENT_PERMISSIONS\",\n          \"User does not have required permissions\"\n        );\n      }\n\n      authenticatedRequest.userGrants = await getGrantsResult();\n    }\n\n    authenticatedRequest.user = authenticatedPayload;\n    authenticatedRequest.data = authenticatedPayload;\n    return next();\n  } catch (error: unknown) {\n    const authErr = normalizeAuthError(error);\n    logAuthFailure(req, authErr);\n    return sendAuthenticationError(res, authErr);\n  }\n}\n\n@Injectable()\n/** Nest service behind the Express-compatible `authorizeAccessi` middleware. */\nexport class AuthenticateGenService {\n  constructor(\n    @Inject(\"ACCESSI_OPTIONS\")\n    private readonly accessiOptions: AccessiOptions,\n    private readonly permissionService: PermissionService,\n    private readonly userService: UserService\n  ) { }\n\n  /**\n   * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.\n   * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.\n   */\n  async authorize(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    options?: AccessiAuthorizationOptions\n  ) {\n    return authorizeWithDependencies(\n      req,\n      res,\n      next,\n      options,\n      this.accessiOptions,\n      this.permissionService,\n      this.userService\n    );\n  }\n}\n\nlet authenticateGenServiceRef: AuthenticateGenService | null = null;\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> | null = null;\n\nfunction createDeferred<T>(): Deferred<T> {\n  let resolve!: (value: T) => void;\n  let reject!: (reason?: unknown) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej;\n  });\n  return { promise, resolve, reject };\n}\n\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\n  return Boolean(\n    value &&\n    typeof (value as { authorize?: unknown }).authorize === \"function\"\n  );\n}\n\n/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */\nexport function beginAccessiAuthInitialization() {\n  if (!authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\n  }\n}\n\n/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */\nexport function setAccessiAuthService(service: AuthenticateGenService) {\n  authenticateGenServiceRef = service;\n  (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.resolve(service);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\n/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */\nexport function failAccessiAuthInitialization(error: unknown) {\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.reject(error);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService | null {\n  const appLocalsService = (req.app?.locals as Record<string, unknown> | undefined)?.[\n    ACCESSI_AUTH_SERVICE_LOCALS_KEY\n  ];\n\n  if (isAuthenticateGenService(appLocalsService)) {\n    return appLocalsService as AuthenticateGenService;\n  }\n\n  const globalService = (globalThis as Record<symbol, unknown>)[\n    ACCESSI_AUTH_SERVICE_GLOBAL_KEY\n  ];\n  if (isAuthenticateGenService(globalService)) {\n    return globalService as AuthenticateGenService;\n  }\n\n  return authenticateGenServiceRef;\n}\n\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService | null> {\n  if (!authServiceBootstrapDeferred) {\n    return null;\n  }\n\n  const bootstrapPromise = authServiceBootstrapDeferred.promise;\n  const timeoutPromise = new Promise<null>((resolve) => {\n    setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\n  });\n\n  try {\n    const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\n    return isAuthenticateGenService(resolved) ? resolved : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService | null> {\n  const immediateService = getAccessiAuthServiceFromRequest(req);\n  if (immediateService) {\n    return immediateService;\n  }\n\n  const bootstrappedService = await waitForBootstrappedService();\n  if (bootstrappedService) {\n    return bootstrappedService;\n  }\n\n  return getAccessiAuthServiceFromRequest(req);\n}\n\n/**\n * Middleware Express pubblico di Accessi.\n *\n * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente\n * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente\n * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.\n */\nexport async function authorizeAccessi(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options?: AccessiAuthorizationOptions\n) {\n  const authService = await resolveAccessiAuthService(req);\n\n  if (!authService) {\n    const status = authServiceBootstrapDeferred ? 503 : 500;\n    const code = authServiceBootstrapDeferred\n      ? 'ACCESSI_AUTH_INITIALIZING'\n      : 'ACCESSI_AUTH_NOT_INITIALIZED';\n    logger.error(\n      `Authentication service not initialized ${JSON.stringify({\n        method: req.method,\n        path: req.originalUrl ?? req.url,\n        status,\n      })}`\n    );\n    return res.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: 2,\n      code,\n      error: code,\n      message: status === 503\n        ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'\n        : 'Il modulo Accessi non e disponibile.',\n    });\n  }\n\n  return authService.authorize(req, res, next, options);\n}\n\n/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */\nexport const authenticateGen = authorizeAccessi;\n"]}

package/dist/accessi-module/security/audit.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Audit strutturato degli eventi di sicurezza Accessi.
+ *
+ * Il Logger redige gia campi come token, password, secret e authorization.
+ * Non inserire mai payload completi o segreti nei dettagli.
+ */
+export declare function auditAccessi(event: string, details?: Record<string, unknown>): void;

package/dist/accessi-module/security/audit.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditAccessi = auditAccessi;
+const Logger_1 = require("../../Logger");
+/**
+ * Audit strutturato degli eventi di sicurezza Accessi.
+ *
+ * Il Logger redige gia campi come token, password, secret e authorization.
+ * Non inserire mai payload completi o segreti nei dettagli.
+ */
+function auditAccessi(event, details = {}) {
+    new Logger_1.Logger('AccessiAudit').warning(JSON.stringify(Object.assign({ event, timestamp: new Date().toISOString() }, details)));
+}
+//# sourceMappingURL=audit.js.map

package/dist/accessi-module/security/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/audit.ts"],"names":[],"mappings":";;AAQA,oCAQC;AAhBD,yCAAsC;AAEtC;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAa,EAAE,UAAmC,EAAE;IAC/E,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAChC,IAAI,CAAC,SAAS,iBACZ,KAAK,EACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAChC,OAAO,EACV,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { Logger } from '../../Logger';\n\n/**\n * Audit strutturato degli eventi di sicurezza Accessi.\n *\n * Il Logger redige gia campi come token, password, secret e authorization.\n * Non inserire mai payload completi o segreti nei dettagli.\n */\nexport function auditAccessi(event: string, details: Record<string, unknown> = {}): void {\n  new Logger('AccessiAudit').warning(\n    JSON.stringify({\n      event,\n      timestamp: new Date().toISOString(),\n      ...details,\n    }),\n  );\n}\n"]}

package/dist/accessi-module/security/authenticatedToken.d.ts

@@ -13,7 +13,7 @@ export interface AccessiAuthenticatedUserSnapshot {
 /** Shared, strict Bearer parsing for the Nest guard and Express middleware. */
 export declare function extractAccessiBearerToken(header: unknown): string | undefined;
 /** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */
-export declare function resolveCodiceUtenteFromTokenPayload(decoded: unknown): number | undefined;
+export declare function resolveCodiceUtenteFromTokenPayload(decoded: unknown, expectedType?: 'access' | 'refresh'): number | undefined;
 /**
  * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.
  * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.

package/dist/accessi-module/security/authenticatedToken.js

@@ -21,10 +21,10 @@ function extractAccessiBearerToken(header) {
     return (_a = /^Bearer[ \t]+([^\s]+)$/i.exec(header.trim())) === null || _a === void 0 ? void 0 : _a[1];
 }
 /** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */
-function resolveCodiceUtenteFromTokenPayload(decoded) {
+function resolveCodiceUtenteFromTokenPayload(decoded, expectedType = 'access') {
     var _a;
-    // `typ` obbligatorio: un token senza tipo non e un access token Accessi.
-    if (!isRecord(decoded) || decoded.typ !== 'access') {
+    // `typ` obbligatorio: un token senza tipo non e un token Accessi valido.
+    if (!isRecord(decoded) || decoded.typ !== expectedType) {
         return undefined;
     }
     const userData = isRecord(decoded.userData) ? decoded.userData : undefined;

package/dist/accessi-module/security/authenticatedToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticatedToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/authenticatedToken.ts"],"names":[],"mappings":";;AAuBA,8DAGC;AAGD,kFAmBC;AAMD,wEAgCC;AAOD,sDAGC;AAGD,oEAOC;AAGD,4EAIC;AAjHD,mEAAgE;AAchE,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,SAAgB,yBAAyB,CAAC,MAAe;;IACvD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,MAAA,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,0CAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,8FAA8F;AAC9F,SAAgB,mCAAmC,CAAC,OAAgB;;IAClE,yEAAyE;IACzE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,QAAQ,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,mCAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,8BAA8B,CAC5C,OAAgB,EAChB,MAAwC;IAExC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAM,OAAO,EAAG,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAM,WAAW,CAAC,QAAQ,EAAG,CAAC,CAAC,EAAE,CAAC;IAEnF,MAAM,cAAc,mCACf,MAAM,KACT,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,EACjD,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,EACjD,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,EAC3D,wBAAwB,EAAE,oBAAoB,CAAC,MAAM,CAAC,wBAAwB,CAAC,GAChF,CAAC;IAEF,uCACK,WAAW,KACd,YAAY,EAAE,cAAc,CAAC,YAAY,EACzC,KAAK,EAAE,cAAc,CAAC,KAAK,EAC3B,kBAAkB,EAAE,cAAc,CAAC,kBAAkB,EACrD,SAAS,EAAE,cAAc,CAAC,SAAS,EACnC,SAAS,EAAE,cAAc,CAAC,SAAS,EACnC,cAAc,EAAE,cAAc,CAAC,cAAc,EAC7C,wBAAwB,EAAE,cAAc,CAAC,wBAAwB,EACjE,oBAAoB,EAAE,cAAc,CAAC,oBAAoB,EACzD,MAAM,EAAE,cAAc,EACtB,QAAQ,kCACH,QAAQ,KACX,MAAM,EAAE,cAAc,KAExB,YAAY,EAAE,OAAO,IACrB;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACxE,CAAC;AAED,4FAA4F;AAC5F,SAAgB,4BAA4B,CAAC,OAAgB,EAAE,IAAsC;IACnG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,qBAAqB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+GAA+G;AAC/G,SAAgB,gCAAgC,CAC9C,MAA2D;IAE3D,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,kBAAkB,MAAK,uCAAkB,CAAC,IAAI,CAAC;AAChE,CAAC","sourcesContent":["import { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\n\n/** Stato autorevole minimo riletto dal database per ogni verifica JWT. */\nexport interface AccessiAuthenticatedUserSnapshot {\n  codiceUtente: number;\n  email?: string;\n  statoRegistrazione: StatoRegistrazione;\n  flagSuper: boolean;\n  flagAdmin: boolean;\n  flagDueFattori?: boolean;\n  passwordlessLoginEnabled?: boolean;\n  passwordLoginEnabled?: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\n/** Shared, strict Bearer parsing for the Nest guard and Express middleware. */\nexport function extractAccessiBearerToken(header: unknown): string | undefined {\n  if (typeof header !== 'string') return undefined;\n  return /^Bearer[ \\t]+([^\\s]+)$/i.exec(header.trim())?.[1];\n}\n\n/** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */\nexport function resolveCodiceUtenteFromTokenPayload(decoded: unknown): number | undefined {\n  // `typ` obbligatorio: un token senza tipo non e un access token Accessi.\n  if (!isRecord(decoded) || decoded.typ !== 'access') {\n    return undefined;\n  }\n\n  const userData = isRecord(decoded.userData) ? decoded.userData : undefined;\n  const utente = isRecord(decoded.utente)\n    ? decoded.utente\n    : isRecord(userData?.utente)\n      ? userData.utente\n      : undefined;\n\n  const codiceUtente = Number(utente?.codiceUtente ?? decoded.codiceUtente);\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n    return undefined;\n  }\n\n  return codiceUtente;\n}\n\n/**\n * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.\n * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.\n */\nexport function buildAuthenticatedTokenPayload(\n  decoded: unknown,\n  utente: AccessiAuthenticatedUserSnapshot,\n): Record<string, unknown> {\n  const basePayload = isRecord(decoded) ? { ...decoded } : {};\n  const userData = isRecord(basePayload.userData) ? { ...basePayload.userData } : {};\n\n  const normalizedUser = {\n    ...utente,\n    flagSuper: normalizeBooleanFlag(utente.flagSuper),\n    flagAdmin: normalizeBooleanFlag(utente.flagAdmin),\n    flagDueFattori: normalizeBooleanFlag(utente.flagDueFattori),\n    passwordlessLoginEnabled: normalizeBooleanFlag(utente.passwordlessLoginEnabled),\n  };\n\n  return {\n    ...basePayload,\n    codiceUtente: normalizedUser.codiceUtente,\n    email: normalizedUser.email,\n    statoRegistrazione: normalizedUser.statoRegistrazione,\n    flagSuper: normalizedUser.flagSuper,\n    flagAdmin: normalizedUser.flagAdmin,\n    flagDueFattori: normalizedUser.flagDueFattori,\n    passwordlessLoginEnabled: normalizedUser.passwordlessLoginEnabled,\n    passwordLoginEnabled: normalizedUser.passwordLoginEnabled,\n    utente: normalizedUser,\n    userData: {\n      ...userData,\n      utente: normalizedUser,\n    },\n    tokenPayload: decoded,\n  };\n}\n\n/**\n * Riconosce i token emessi dalla console per l'accesso temporaneo \"Login as\".\n * L'attore ha gia completato l'autenticazione amministrativa, quindi il token\n * non richiede un ulteriore codice email anche se il target ha la 2FA attiva.\n */\nexport function isLoginAsTokenPayload(decoded: unknown): boolean {\n  if (!isRecord(decoded) || decoded.loginAs !== true) return false;\n  return Array.isArray(decoded.amr) && decoded.amr.includes('login_as');\n}\n\n/** Enabling 2FA invalidates sessions which have not completed the required verification. */\nexport function isAccessiTokenAllowedForUser(decoded: unknown, user: AccessiAuthenticatedUserSnapshot): boolean {\n  if (!isRecord(decoded)) return false;\n  if (isLoginAsTokenPayload(decoded)) return true;\n  const methods = Array.isArray(decoded.amr) ? decoded.amr : [];\n  if (user.flagDueFattori && !methods.includes('otp')) return false;\n  if (methods.includes('passwordless') && (!user.flagDueFattori || !user.passwordlessLoginEnabled)) return false;\n  return true;\n}\n\n/** Un JWT puo essere usato soltanto da utenti nello stato confermato, indipendentemente dalla sua scadenza. */\nexport function isAuthenticatedUserEnabledForJwt(\n  utente: AccessiAuthenticatedUserSnapshot | null | undefined,\n): utente is AccessiAuthenticatedUserSnapshot {\n  return utente?.statoRegistrazione === StatoRegistrazione.CONF;\n}\n"]}
+{"version":3,"file":"authenticatedToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/authenticatedToken.ts"],"names":[],"mappings":";;AAuBA,8DAGC;AAGD,kFAsBC;AAMD,wEAgCC;AAOD,sDAGC;AAGD,oEAOC;AAGD,4EAIC;AApHD,mEAAgE;AAchE,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,SAAgB,yBAAyB,CAAC,MAAe;;IACvD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,MAAA,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,0CAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,8FAA8F;AAC9F,SAAgB,mCAAmC,CACjD,OAAgB,EAChB,eAAqC,QAAQ;;IAE7C,yEAAyE;IACzE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,QAAQ,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,mCAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,8BAA8B,CAC5C,OAAgB,EAChB,MAAwC;IAExC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAM,OAAO,EAAG,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAM,WAAW,CAAC,QAAQ,EAAG,CAAC,CAAC,EAAE,CAAC;IAEnF,MAAM,cAAc,mCACf,MAAM,KACT,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,EACjD,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,EACjD,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,EAC3D,wBAAwB,EAAE,oBAAoB,CAAC,MAAM,CAAC,wBAAwB,CAAC,GAChF,CAAC;IAEF,uCACK,WAAW,KACd,YAAY,EAAE,cAAc,CAAC,YAAY,EACzC,KAAK,EAAE,cAAc,CAAC,KAAK,EAC3B,kBAAkB,EAAE,cAAc,CAAC,kBAAkB,EACrD,SAAS,EAAE,cAAc,CAAC,SAAS,EACnC,SAAS,EAAE,cAAc,CAAC,SAAS,EACnC,cAAc,EAAE,cAAc,CAAC,cAAc,EAC7C,wBAAwB,EAAE,cAAc,CAAC,wBAAwB,EACjE,oBAAoB,EAAE,cAAc,CAAC,oBAAoB,EACzD,MAAM,EAAE,cAAc,EACtB,QAAQ,kCACH,QAAQ,KACX,MAAM,EAAE,cAAc,KAExB,YAAY,EAAE,OAAO,IACrB;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACxE,CAAC;AAED,4FAA4F;AAC5F,SAAgB,4BAA4B,CAAC,OAAgB,EAAE,IAAsC;IACnG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,qBAAqB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+GAA+G;AAC/G,SAAgB,gCAAgC,CAC9C,MAA2D;IAE3D,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,kBAAkB,MAAK,uCAAkB,CAAC,IAAI,CAAC;AAChE,CAAC","sourcesContent":["import { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\n\n/** Stato autorevole minimo riletto dal database per ogni verifica JWT. */\nexport interface AccessiAuthenticatedUserSnapshot {\n  codiceUtente: number;\n  email?: string;\n  statoRegistrazione: StatoRegistrazione;\n  flagSuper: boolean;\n  flagAdmin: boolean;\n  flagDueFattori?: boolean;\n  passwordlessLoginEnabled?: boolean;\n  passwordLoginEnabled?: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\n/** Shared, strict Bearer parsing for the Nest guard and Express middleware. */\nexport function extractAccessiBearerToken(header: unknown): string | undefined {\n  if (typeof header !== 'string') return undefined;\n  return /^Bearer[ \\t]+([^\\s]+)$/i.exec(header.trim())?.[1];\n}\n\n/** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */\nexport function resolveCodiceUtenteFromTokenPayload(\n  decoded: unknown,\n  expectedType: 'access' | 'refresh' = 'access',\n): number | undefined {\n  // `typ` obbligatorio: un token senza tipo non e un token Accessi valido.\n  if (!isRecord(decoded) || decoded.typ !== expectedType) {\n    return undefined;\n  }\n\n  const userData = isRecord(decoded.userData) ? decoded.userData : undefined;\n  const utente = isRecord(decoded.utente)\n    ? decoded.utente\n    : isRecord(userData?.utente)\n      ? userData.utente\n      : undefined;\n\n  const codiceUtente = Number(utente?.codiceUtente ?? decoded.codiceUtente);\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n    return undefined;\n  }\n\n  return codiceUtente;\n}\n\n/**\n * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.\n * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.\n */\nexport function buildAuthenticatedTokenPayload(\n  decoded: unknown,\n  utente: AccessiAuthenticatedUserSnapshot,\n): Record<string, unknown> {\n  const basePayload = isRecord(decoded) ? { ...decoded } : {};\n  const userData = isRecord(basePayload.userData) ? { ...basePayload.userData } : {};\n\n  const normalizedUser = {\n    ...utente,\n    flagSuper: normalizeBooleanFlag(utente.flagSuper),\n    flagAdmin: normalizeBooleanFlag(utente.flagAdmin),\n    flagDueFattori: normalizeBooleanFlag(utente.flagDueFattori),\n    passwordlessLoginEnabled: normalizeBooleanFlag(utente.passwordlessLoginEnabled),\n  };\n\n  return {\n    ...basePayload,\n    codiceUtente: normalizedUser.codiceUtente,\n    email: normalizedUser.email,\n    statoRegistrazione: normalizedUser.statoRegistrazione,\n    flagSuper: normalizedUser.flagSuper,\n    flagAdmin: normalizedUser.flagAdmin,\n    flagDueFattori: normalizedUser.flagDueFattori,\n    passwordlessLoginEnabled: normalizedUser.passwordlessLoginEnabled,\n    passwordLoginEnabled: normalizedUser.passwordLoginEnabled,\n    utente: normalizedUser,\n    userData: {\n      ...userData,\n      utente: normalizedUser,\n    },\n    tokenPayload: decoded,\n  };\n}\n\n/**\n * Riconosce i token emessi dalla console per l'accesso temporaneo \"Login as\".\n * L'attore ha gia completato l'autenticazione amministrativa, quindi il token\n * non richiede un ulteriore codice email anche se il target ha la 2FA attiva.\n */\nexport function isLoginAsTokenPayload(decoded: unknown): boolean {\n  if (!isRecord(decoded) || decoded.loginAs !== true) return false;\n  return Array.isArray(decoded.amr) && decoded.amr.includes('login_as');\n}\n\n/** Enabling 2FA invalidates sessions which have not completed the required verification. */\nexport function isAccessiTokenAllowedForUser(decoded: unknown, user: AccessiAuthenticatedUserSnapshot): boolean {\n  if (!isRecord(decoded)) return false;\n  if (isLoginAsTokenPayload(decoded)) return true;\n  const methods = Array.isArray(decoded.amr) ? decoded.amr : [];\n  if (user.flagDueFattori && !methods.includes('otp')) return false;\n  if (methods.includes('passwordless') && (!user.flagDueFattori || !user.passwordlessLoginEnabled)) return false;\n  return true;\n}\n\n/** Un JWT puo essere usato soltanto da utenti nello stato confermato, indipendentemente dalla sua scadenza. */\nexport function isAuthenticatedUserEnabledForJwt(\n  utente: AccessiAuthenticatedUserSnapshot | null | undefined,\n): utente is AccessiAuthenticatedUserSnapshot {\n  return utente?.statoRegistrazione === StatoRegistrazione.CONF;\n}\n"]}

package/dist/accessi-module/security/consoleEntry.d.ts

@@ -1,16 +1,63 @@
+/**
+ * Ticket di ingresso alla console, monouso e a breve scadenza.
+ *
+ * Serve a passare una sessione gia autenticata (frontend che possiede un JWT Accessi)
+ * alla console amministrativa senza reinserire le credenziali e senza mettere il JWT
+ * nell'URL: il frontend scambia il proprio JWT con un ticket opaco, apre la console
+ * con `#entry=<ticket>` e la console lo scambia con il token originale.
+ *
+ * Il ticket e valido una sola volta, per pochi secondi, ed e legato all'utente che
+ * lo ha richiesto (che deve avere accesso alla console). Lo store di default e in
+ * memoria; in multi-istanza usare `createRedisConsoleEntryStore`.
+ */
+export interface ConsoleEntryRecord {
+    token: string;
+    codiceUtente: number;
+}
 export interface ConsoleEntryTicket {
     ticket: string;
     expiresInSeconds: number;
 }
-/** Emette un ticket monouso per l'utente indicato, conservando il suo JWT per lo scambio. */
-export declare function issueConsoleEntryTicket(record: {
-    token: string;
-    codiceUtente: number;
-}, ttlMs?: number): ConsoleEntryTicket;
-/** Consuma (monouso) un ticket e restituisce il JWT collegato, oppure null se scaduto/assente/invalido. */
-export declare function consumeConsoleEntryTicket(ticket: unknown): {
-    token: string;
-    codiceUtente: number;
-} | null;
-/** Solo per i test: azzera lo store in memoria. */
+/** Store pluggable: memoria per single instance, Redis per multi-istanza. */
+export interface ConsoleEntryStore {
+    issue(record: ConsoleEntryRecord, ttlMs: number): Promise<ConsoleEntryTicket>;
+    consume(ticket: string): Promise<ConsoleEntryRecord | null>;
+    /** Health check opzionale per readiness del servizio. */
+    healthCheck?(): Promise<boolean>;
+}
+/** Store in memoria con API sincrona per retrocompatibilita e API async per l'interfaccia. */
+export interface MemoryConsoleEntryStore extends ConsoleEntryStore {
+    issueSync(record: ConsoleEntryRecord, ttlMs?: number): ConsoleEntryTicket;
+    consumeSync(ticket: string): ConsoleEntryRecord | null;
+    clear(): void;
+}
+/** Store in memoria: adatto a sviluppo e a una singola istanza. */
+export declare function createMemoryConsoleEntryStore(maxEntries?: number): MemoryConsoleEntryStore;
+/** Store di default in memoria, usato quando `AccessiOptions.consoleEntry.store` non e configurato. */
+export declare function getDefaultConsoleEntryStore(): ConsoleEntryStore;
+export declare function issueConsoleEntryTicket(record: ConsoleEntryRecord, ttlMs?: number): ConsoleEntryTicket;
+export declare function consumeConsoleEntryTicket(ticket: unknown): ConsoleEntryRecord | null;
+/** Solo per i test: azzera lo store in memoria di default. */
 export declare function clearConsoleEntryTickets(): void;
+/** Client Redis minimale: compatibile con ioredis (`redis.eval(script, numKeys, ...args)`). */
+export interface ConsoleEntryRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+export interface RedisConsoleEntryStoreOptions {
+    client: ConsoleEntryRedisClient;
+    /** Segreto per cifrare il JWT nel Redis. Non usare il JWT in chiaro. */
+    encryptionKey: string | Buffer;
+    /** Default: `accessi:console-entry:`. */
+    keyPrefix?: string;
+    /** Tentativi in caso di collisione del ticket. Default: 5. */
+    maxIssueAttempts?: number;
+}
+/**
+ * Store Redis per ticket console.
+ *
+ * - il JWT viene cifrato con AES-256-GCM prima di essere scritto;
+ * - `SET ... PX ... NX` evita collisioni;
+ * - il consume usa `GET` + `DEL` atomici in Lua, quindi il ticket e monouso
+ *   anche con piu istanze.
+ */
+export declare function createRedisConsoleEntryStore(options: RedisConsoleEntryStoreOptions): ConsoleEntryStore;

package/dist/accessi-module/security/consoleEntry.js

@@ -1,50 +1,200 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemoryConsoleEntryStore = createMemoryConsoleEntryStore;
+exports.getDefaultConsoleEntryStore = getDefaultConsoleEntryStore;
 exports.issueConsoleEntryTicket = issueConsoleEntryTicket;
 exports.consumeConsoleEntryTicket = consumeConsoleEntryTicket;
 exports.clearConsoleEntryTickets = clearConsoleEntryTickets;
+exports.createRedisConsoleEntryStore = createRedisConsoleEntryStore;
 const crypto_1 = require("crypto");
 const DEFAULT_TTL_MS = 60000;
-const MAX_ENTRIES = 5000;
-const entries = new Map();
-function sweep(now) {
-    for (const [ticket, record] of entries) {
-        if (record.expiresAt <= now)
-            entries.delete(ticket);
-    }
+const DEFAULT_MAX_ENTRIES = 5000;
+const TICKET_PATTERN = /^[a-f0-9]{64}$/i;
+function createTicket() {
+    return (0, crypto_1.randomBytes)(32).toString('hex');
+}
+function normalizeTtl(ttlMs) {
+    return Math.max(1, Math.trunc(ttlMs));
+}
+/** Store in memoria: adatto a sviluppo e a una singola istanza. */
+function createMemoryConsoleEntryStore(maxEntries = DEFAULT_MAX_ENTRIES) {
+    const entries = new Map();
+    const sweep = (now) => {
+        for (const [ticket, record] of entries) {
+            if (record.expiresAt <= now)
+                entries.delete(ticket);
+        }
+    };
+    const issueSync = (record, ttlMs = DEFAULT_TTL_MS) => {
+        // Il TTL negativo resta supportato per test e per il comportamento storico:
+        // il ticket e immediatamente scaduto.
+        const ttl = Math.trunc(ttlMs);
+        const now = Date.now();
+        sweep(now);
+        while (entries.size >= maxEntries) {
+            const oldest = entries.keys().next().value;
+            if (oldest === undefined)
+                break;
+            entries.delete(oldest);
+        }
+        const ticket = createTicket();
+        entries.set(ticket, Object.assign(Object.assign({}, record), { expiresAt: now + ttl }));
+        return { ticket, expiresInSeconds: Math.max(0, Math.ceil(ttl / 1000)) };
+    };
+    const consumeSync = (ticket) => {
+        if (typeof ticket !== 'string' || !TICKET_PATTERN.test(ticket)) {
+            return null;
+        }
+        const record = entries.get(ticket);
+        if (!record)
+            return null;
+        entries.delete(ticket);
+        if (record.expiresAt <= Date.now())
+            return null;
+        return { token: record.token, codiceUtente: record.codiceUtente };
+    };
+    return {
+        issueSync,
+        consumeSync,
+        clear: () => entries.clear(),
+        issue(record, ttlMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                return issueSync(record, ttlMs);
+            });
+        },
+        consume(ticket) {
+            return __awaiter(this, void 0, void 0, function* () {
+                return consumeSync(ticket);
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                return true;
+            });
+        },
+    };
+}
+const defaultStore = createMemoryConsoleEntryStore();
+/** Store di default in memoria, usato quando `AccessiOptions.consoleEntry.store` non e configurato. */
+function getDefaultConsoleEntryStore() {
+    return defaultStore;
 }
-/** Emette un ticket monouso per l'utente indicato, conservando il suo JWT per lo scambio. */
+// Funzioni storiche sincrone: mantengono il comportamento per test e consumer esistenti.
 function issueConsoleEntryTicket(record, ttlMs = DEFAULT_TTL_MS) {
-    const now = Date.now();
-    sweep(now);
-    // Limita la memoria anche sotto attacco: rimuove la voce piu vecchia.
-    while (entries.size >= MAX_ENTRIES) {
-        const oldest = entries.keys().next().value;
-        if (oldest === undefined)
-            break;
-        entries.delete(oldest);
-    }
-    const ticket = (0, crypto_1.randomBytes)(32).toString('hex');
-    entries.set(ticket, Object.assign(Object.assign({}, record), { expiresAt: now + ttlMs }));
-    return { ticket, expiresInSeconds: Math.ceil(ttlMs / 1000) };
+    return defaultStore.issueSync(record, ttlMs);
 }
-/** Consuma (monouso) un ticket e restituisce il JWT collegato, oppure null se scaduto/assente/invalido. */
 function consumeConsoleEntryTicket(ticket) {
-    if (typeof ticket !== 'string' || !/^[a-f0-9]{64}$/i.test(ticket)) {
-        return null;
+    return typeof ticket === 'string' ? defaultStore.consumeSync(ticket) : null;
+}
+/** Solo per i test: azzera lo store in memoria di default. */
+function clearConsoleEntryTickets() {
+    defaultStore.clear();
+}
+const SET_SCRIPT = "return redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2], 'NX')";
+const CONSUME_SCRIPT = "local value = redis.call('GET', KEYS[1]) if value then redis.call('DEL', KEYS[1]) end return value";
+function deriveEncryptionKey(secret) {
+    const source = Buffer.isBuffer(secret) ? secret : Buffer.from(secret, 'utf8');
+    if (source.length === 0) {
+        throw new Error('Redis console entry encryptionKey non configurata.');
     }
-    const record = entries.get(ticket);
-    if (!record) {
+    return source.length === 32 ? source : (0, crypto_1.createHash)('sha256').update(source).digest();
+}
+function encryptRecord(record, key) {
+    const iv = (0, crypto_1.randomBytes)(12);
+    const cipher = (0, crypto_1.createCipheriv)('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(JSON.stringify(record), 'utf8'),
+        cipher.final(),
+    ]);
+    const tag = cipher.getAuthTag();
+    return [iv, tag, ciphertext].map((part) => part.toString('base64url')).join('.');
+}
+function decryptRecord(value, key) {
+    const [ivPart, tagPart, ciphertextPart] = value.split('.');
+    if (!ivPart || !tagPart || !ciphertextPart)
         return null;
+    try {
+        const decipher = (0, crypto_1.createDecipheriv)('aes-256-gcm', key, Buffer.from(ivPart, 'base64url'));
+        decipher.setAuthTag(Buffer.from(tagPart, 'base64url'));
+        const plaintext = Buffer.concat([
+            decipher.update(Buffer.from(ciphertextPart, 'base64url')),
+            decipher.final(),
+        ]).toString('utf8');
+        const parsed = JSON.parse(plaintext);
+        if (!parsed ||
+            typeof parsed !== 'object' ||
+            typeof parsed.token !== 'string' ||
+            typeof parsed.codiceUtente !== 'number') {
+            return null;
+        }
+        return parsed;
     }
-    entries.delete(ticket);
-    if (record.expiresAt <= Date.now()) {
+    catch (_a) {
         return null;
     }
-    return { token: record.token, codiceUtente: record.codiceUtente };
 }
-/** Solo per i test: azzera lo store in memoria. */
-function clearConsoleEntryTickets() {
-    entries.clear();
+/**
+ * Store Redis per ticket console.
+ *
+ * - il JWT viene cifrato con AES-256-GCM prima di essere scritto;
+ * - `SET ... PX ... NX` evita collisioni;
+ * - il consume usa `GET` + `DEL` atomici in Lua, quindi il ticket e monouso
+ *   anche con piu istanze.
+ */
+function createRedisConsoleEntryStore(options) {
+    var _a, _b;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis console entry store: client.eval non configurato.');
+    }
+    const key = deriveEncryptionKey(options.encryptionKey);
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:console-entry:').replace(/:+$/, ':');
+    const maxAttempts = Math.max(1, (_b = options.maxIssueAttempts) !== null && _b !== void 0 ? _b : 5);
+    return {
+        issue(record, ttlMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const safeTtl = normalizeTtl(ttlMs);
+                const value = encryptRecord(record, key);
+                for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+                    const ticket = createTicket();
+                    const result = yield options.client.eval(SET_SCRIPT, 1, `${keyPrefix}${ticket}`, value, safeTtl);
+                    if (result) {
+                        return { ticket, expiresInSeconds: Math.ceil(safeTtl / 1000) };
+                    }
+                }
+                throw new Error('Impossibile emettere un ticket console univoco.');
+            });
+        },
+        consume(ticket) {
+            return __awaiter(this, void 0, void 0, function* () {
+                if (typeof ticket !== 'string' || !TICKET_PATTERN.test(ticket)) {
+                    return null;
+                }
+                const value = yield options.client.eval(CONSUME_SCRIPT, 1, `${keyPrefix}${ticket}`);
+                if (typeof value !== 'string')
+                    return null;
+                return decryptRecord(value, key);
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const result = yield options.client.eval("return redis.call('PING')", 0);
+                    return String(result).toUpperCase() === 'PONG';
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+    };
 }
 //# sourceMappingURL=consoleEntry.js.map

package/dist/accessi-module/security/consoleEntry.js.map

@@ -1 +1 @@
-{"version":3,"file":"consoleEntry.js","sourceRoot":"","sources":["../../../src/accessi-module/security/consoleEntry.ts"],"names":[],"mappings":";;AAqCA,0DAiBC;AAGD,8DAeC;AAGD,4DAEC;AA7ED,mCAAqC;AAqBrC,MAAM,cAAc,GAAG,KAAM,CAAC;AAC9B,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;AAOtD,SAAS,KAAK,CAAC,GAAW;IACxB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,uBAAuB,CACrC,MAA+C,EAC/C,QAAgB,cAAc;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,CAAC,GAAG,CAAC,CAAC;IAEX,sEAAsE;IACtE,OAAO,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC3C,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,kCAAO,MAAM,KAAE,SAAS,EAAE,GAAG,GAAG,KAAK,IAAG,CAAC;IAC3D,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,2GAA2G;AAC3G,SAAgB,yBAAyB,CACvC,MAAe;IAEf,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AACpE,CAAC;AAED,mDAAmD;AACnD,SAAgB,wBAAwB;IACtC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC","sourcesContent":["import { randomBytes } from 'crypto';\n\n/**\n * Ticket di ingresso alla console, monouso e a breve scadenza.\n *\n * Serve a passare una sessione gia autenticata (frontend che possiede un JWT Accessi)\n * alla console amministrativa senza reinserire le credenziali e senza mettere il JWT\n * nell'URL: il frontend scambia il proprio JWT con un ticket opaco, apre la console\n * con `#entry=<ticket>` e la console lo scambia con il token originale.\n *\n * Il ticket e' valido una sola volta, per pochi secondi, ed e' legato all'utente che\n * lo ha richiesto (che deve avere accesso alla console). Resta in memoria del processo:\n * con piu istanze del backend il ticket va consumato dalla stessa istanza che lo emette.\n */\n\ninterface ConsoleEntryRecord {\n  token: string;\n  codiceUtente: number;\n  expiresAt: number;\n}\n\nconst DEFAULT_TTL_MS = 60_000;\nconst MAX_ENTRIES = 5000;\nconst entries = new Map<string, ConsoleEntryRecord>();\n\nexport interface ConsoleEntryTicket {\n  ticket: string;\n  expiresInSeconds: number;\n}\n\nfunction sweep(now: number): void {\n  for (const [ticket, record] of entries) {\n    if (record.expiresAt <= now) entries.delete(ticket);\n  }\n}\n\n/** Emette un ticket monouso per l'utente indicato, conservando il suo JWT per lo scambio. */\nexport function issueConsoleEntryTicket(\n  record: { token: string; codiceUtente: number },\n  ttlMs: number = DEFAULT_TTL_MS,\n): ConsoleEntryTicket {\n  const now = Date.now();\n  sweep(now);\n\n  // Limita la memoria anche sotto attacco: rimuove la voce piu vecchia.\n  while (entries.size >= MAX_ENTRIES) {\n    const oldest = entries.keys().next().value;\n    if (oldest === undefined) break;\n    entries.delete(oldest);\n  }\n\n  const ticket = randomBytes(32).toString('hex');\n  entries.set(ticket, { ...record, expiresAt: now + ttlMs });\n  return { ticket, expiresInSeconds: Math.ceil(ttlMs / 1000) };\n}\n\n/** Consuma (monouso) un ticket e restituisce il JWT collegato, oppure null se scaduto/assente/invalido. */\nexport function consumeConsoleEntryTicket(\n  ticket: unknown,\n): { token: string; codiceUtente: number } | null {\n  if (typeof ticket !== 'string' || !/^[a-f0-9]{64}$/i.test(ticket)) {\n    return null;\n  }\n  const record = entries.get(ticket);\n  if (!record) {\n    return null;\n  }\n  entries.delete(ticket);\n  if (record.expiresAt <= Date.now()) {\n    return null;\n  }\n  return { token: record.token, codiceUtente: record.codiceUtente };\n}\n\n/** Solo per i test: azzera lo store in memoria. */\nexport function clearConsoleEntryTickets(): void {\n  entries.clear();\n}\n"]}
+{"version":3,"file":"consoleEntry.js","sourceRoot":"","sources":["../../../src/accessi-module/security/consoleEntry.ts"],"names":[],"mappings":";;;;;;;;;;;AAyDA,sEAsDC;AAKD,kEAEC;AAGD,0DAKC;AAED,8DAEC;AAGD,4DAEC;AAyED,oEAuDC;AAvQD,mCAAmF;AAiCnF,MAAM,cAAc,GAAG,KAAM,CAAC;AAC9B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAazC,SAAS,YAAY;IACnB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,SAAgB,6BAA6B,CAC3C,aAAqB,mBAAmB;IAExC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE/C,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,MAA0B,EAAE,QAAgB,cAAc,EAAsB,EAAE;QACnG,4EAA4E;QAC5E,sCAAsC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,CAAC,GAAG,CAAC,CAAC;QAEX,OAAO,OAAO,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC3C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,kCAAO,MAAM,KAAE,SAAS,EAAE,GAAG,GAAG,GAAG,IAAG,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,MAAc,EAA6B,EAAE;QAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IACpE,CAAC,CAAC;IAEF,OAAO;QACL,SAAS;QACT,WAAW;QACX,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;QACtB,KAAK,CAAC,MAAM,EAAE,KAAK;;gBACvB,OAAO,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;SAAA;QACK,OAAO,CAAC,MAAM;;gBAClB,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,6BAA6B,EAAE,CAAC;AAErD,uGAAuG;AACvG,SAAgB,2BAA2B;IACzC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,yFAAyF;AACzF,SAAgB,uBAAuB,CACrC,MAA0B,EAC1B,QAAgB,cAAc;IAE9B,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,yBAAyB,CAAC,MAAe;IACvD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED,8DAA8D;AAC9D,SAAgB,wBAAwB;IACtC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAiBD,MAAM,UAAU,GAAG,iEAAiE,CAAC;AACrF,MAAM,cAAc,GAClB,oGAAoG,CAAC;AAEvG,SAAS,mBAAmB,CAAC,MAAuB;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,MAA0B,EAAE,GAAW;IAC5D,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAC7C,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,GAAW;IAC/C,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QACxF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YACzD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IACE,CAAC,MAAM;YACP,OAAO,MAAM,KAAK,QAAQ;YAC1B,OAAQ,MAA6B,CAAC,KAAK,KAAK,QAAQ;YACxD,OAAQ,MAA6B,CAAC,YAAY,KAAK,QAAQ,EAC/D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAA4B,CAAC;IACtC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,4BAA4B,CAC1C,OAAsC;;IAEtC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAA,OAAO,CAAC,gBAAgB,mCAAI,CAAC,CAAC,CAAC;IAE/D,OAAO;QACC,KAAK,CAAC,MAAM,EAAE,KAAK;;gBACvB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpC,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAEzC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;oBAC1D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;oBAC9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACtC,UAAU,EACV,CAAC,EACD,GAAG,SAAS,GAAG,MAAM,EAAE,EACvB,KAAK,EACL,OAAO,CACR,CAAC;oBACF,IAAI,MAAM,EAAE,CAAC;wBACX,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;oBACjE,CAAC;gBACH,CAAC;gBAED,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;SAAA;QAEK,OAAO,CAAC,MAAM;;gBAClB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACrC,cAAc,EACd,CAAC,EACD,GAAG,SAAS,GAAG,MAAM,EAAE,CACxB,CAAC;gBACF,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAC3C,OAAO,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC;SAAA;QAEK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'crypto';\n\n/**\n * Ticket di ingresso alla console, monouso e a breve scadenza.\n *\n * Serve a passare una sessione gia autenticata (frontend che possiede un JWT Accessi)\n * alla console amministrativa senza reinserire le credenziali e senza mettere il JWT\n * nell'URL: il frontend scambia il proprio JWT con un ticket opaco, apre la console\n * con `#entry=<ticket>` e la console lo scambia con il token originale.\n *\n * Il ticket e valido una sola volta, per pochi secondi, ed e legato all'utente che\n * lo ha richiesto (che deve avere accesso alla console). Lo store di default e in\n * memoria; in multi-istanza usare `createRedisConsoleEntryStore`.\n */\n\nexport interface ConsoleEntryRecord {\n  token: string;\n  codiceUtente: number;\n}\n\nexport interface ConsoleEntryTicket {\n  ticket: string;\n  expiresInSeconds: number;\n}\n\n/** Store pluggable: memoria per single instance, Redis per multi-istanza. */\nexport interface ConsoleEntryStore {\n  issue(record: ConsoleEntryRecord, ttlMs: number): Promise<ConsoleEntryTicket>;\n  consume(ticket: string): Promise<ConsoleEntryRecord | null>;\n  /** Health check opzionale per readiness del servizio. */\n  healthCheck?(): Promise<boolean>;\n}\n\nconst DEFAULT_TTL_MS = 60_000;\nconst DEFAULT_MAX_ENTRIES = 5000;\nconst TICKET_PATTERN = /^[a-f0-9]{64}$/i;\n\ninterface StoredEntry extends ConsoleEntryRecord {\n  expiresAt: number;\n}\n\n/** Store in memoria con API sincrona per retrocompatibilita e API async per l'interfaccia. */\nexport interface MemoryConsoleEntryStore extends ConsoleEntryStore {\n  issueSync(record: ConsoleEntryRecord, ttlMs?: number): ConsoleEntryTicket;\n  consumeSync(ticket: string): ConsoleEntryRecord | null;\n  clear(): void;\n}\n\nfunction createTicket(): string {\n  return randomBytes(32).toString('hex');\n}\n\nfunction normalizeTtl(ttlMs: number): number {\n  return Math.max(1, Math.trunc(ttlMs));\n}\n\n/** Store in memoria: adatto a sviluppo e a una singola istanza. */\nexport function createMemoryConsoleEntryStore(\n  maxEntries: number = DEFAULT_MAX_ENTRIES,\n): MemoryConsoleEntryStore {\n  const entries = new Map<string, StoredEntry>();\n\n  const sweep = (now: number): void => {\n    for (const [ticket, record] of entries) {\n      if (record.expiresAt <= now) entries.delete(ticket);\n    }\n  };\n\n  const issueSync = (record: ConsoleEntryRecord, ttlMs: number = DEFAULT_TTL_MS): ConsoleEntryTicket => {\n    // Il TTL negativo resta supportato per test e per il comportamento storico:\n    // il ticket e immediatamente scaduto.\n    const ttl = Math.trunc(ttlMs);\n    const now = Date.now();\n    sweep(now);\n\n    while (entries.size >= maxEntries) {\n      const oldest = entries.keys().next().value;\n      if (oldest === undefined) break;\n      entries.delete(oldest);\n    }\n\n    const ticket = createTicket();\n    entries.set(ticket, { ...record, expiresAt: now + ttl });\n    return { ticket, expiresInSeconds: Math.max(0, Math.ceil(ttl / 1000)) };\n  };\n\n  const consumeSync = (ticket: string): ConsoleEntryRecord | null => {\n    if (typeof ticket !== 'string' || !TICKET_PATTERN.test(ticket)) {\n      return null;\n    }\n    const record = entries.get(ticket);\n    if (!record) return null;\n    entries.delete(ticket);\n    if (record.expiresAt <= Date.now()) return null;\n    return { token: record.token, codiceUtente: record.codiceUtente };\n  };\n\n  return {\n    issueSync,\n    consumeSync,\n    clear: () => entries.clear(),\n    async issue(record, ttlMs) {\n      return issueSync(record, ttlMs);\n    },\n    async consume(ticket) {\n      return consumeSync(ticket);\n    },\n    async healthCheck() {\n      return true;\n    },\n  };\n}\n\nconst defaultStore = createMemoryConsoleEntryStore();\n\n/** Store di default in memoria, usato quando `AccessiOptions.consoleEntry.store` non e configurato. */\nexport function getDefaultConsoleEntryStore(): ConsoleEntryStore {\n  return defaultStore;\n}\n\n// Funzioni storiche sincrone: mantengono il comportamento per test e consumer esistenti.\nexport function issueConsoleEntryTicket(\n  record: ConsoleEntryRecord,\n  ttlMs: number = DEFAULT_TTL_MS,\n): ConsoleEntryTicket {\n  return defaultStore.issueSync(record, ttlMs);\n}\n\nexport function consumeConsoleEntryTicket(ticket: unknown): ConsoleEntryRecord | null {\n  return typeof ticket === 'string' ? defaultStore.consumeSync(ticket) : null;\n}\n\n/** Solo per i test: azzera lo store in memoria di default. */\nexport function clearConsoleEntryTickets(): void {\n  defaultStore.clear();\n}\n\n/** Client Redis minimale: compatibile con ioredis (`redis.eval(script, numKeys, ...args)`). */\nexport interface ConsoleEntryRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisConsoleEntryStoreOptions {\n  client: ConsoleEntryRedisClient;\n  /** Segreto per cifrare il JWT nel Redis. Non usare il JWT in chiaro. */\n  encryptionKey: string | Buffer;\n  /** Default: `accessi:console-entry:`. */\n  keyPrefix?: string;\n  /** Tentativi in caso di collisione del ticket. Default: 5. */\n  maxIssueAttempts?: number;\n}\n\nconst SET_SCRIPT = \"return redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2], 'NX')\";\nconst CONSUME_SCRIPT =\n  \"local value = redis.call('GET', KEYS[1]) if value then redis.call('DEL', KEYS[1]) end return value\";\n\nfunction deriveEncryptionKey(secret: string | Buffer): Buffer {\n  const source = Buffer.isBuffer(secret) ? secret : Buffer.from(secret, 'utf8');\n  if (source.length === 0) {\n    throw new Error('Redis console entry encryptionKey non configurata.');\n  }\n  return source.length === 32 ? source : createHash('sha256').update(source).digest();\n}\n\nfunction encryptRecord(record: ConsoleEntryRecord, key: Buffer): string {\n  const iv = randomBytes(12);\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  const ciphertext = Buffer.concat([\n    cipher.update(JSON.stringify(record), 'utf8'),\n    cipher.final(),\n  ]);\n  const tag = cipher.getAuthTag();\n  return [iv, tag, ciphertext].map((part) => part.toString('base64url')).join('.');\n}\n\nfunction decryptRecord(value: string, key: Buffer): ConsoleEntryRecord | null {\n  const [ivPart, tagPart, ciphertextPart] = value.split('.');\n  if (!ivPart || !tagPart || !ciphertextPart) return null;\n  try {\n    const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(ivPart, 'base64url'));\n    decipher.setAuthTag(Buffer.from(tagPart, 'base64url'));\n    const plaintext = Buffer.concat([\n      decipher.update(Buffer.from(ciphertextPart, 'base64url')),\n      decipher.final(),\n    ]).toString('utf8');\n    const parsed: unknown = JSON.parse(plaintext);\n    if (\n      !parsed ||\n      typeof parsed !== 'object' ||\n      typeof (parsed as ConsoleEntryRecord).token !== 'string' ||\n      typeof (parsed as ConsoleEntryRecord).codiceUtente !== 'number'\n    ) {\n      return null;\n    }\n    return parsed as ConsoleEntryRecord;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Store Redis per ticket console.\n *\n * - il JWT viene cifrato con AES-256-GCM prima di essere scritto;\n * - `SET ... PX ... NX` evita collisioni;\n * - il consume usa `GET` + `DEL` atomici in Lua, quindi il ticket e monouso\n *   anche con piu istanze.\n */\nexport function createRedisConsoleEntryStore(\n  options: RedisConsoleEntryStoreOptions,\n): ConsoleEntryStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis console entry store: client.eval non configurato.');\n  }\n\n  const key = deriveEncryptionKey(options.encryptionKey);\n  const keyPrefix = (options.keyPrefix ?? 'accessi:console-entry:').replace(/:+$/, ':');\n  const maxAttempts = Math.max(1, options.maxIssueAttempts ?? 5);\n\n  return {\n    async issue(record, ttlMs) {\n      const safeTtl = normalizeTtl(ttlMs);\n      const value = encryptRecord(record, key);\n\n      for (let attempt = 0; attempt < maxAttempts; attempt += 1) {\n        const ticket = createTicket();\n        const result = await options.client.eval(\n          SET_SCRIPT,\n          1,\n          `${keyPrefix}${ticket}`,\n          value,\n          safeTtl,\n        );\n        if (result) {\n          return { ticket, expiresInSeconds: Math.ceil(safeTtl / 1000) };\n        }\n      }\n\n      throw new Error('Impossibile emettere un ticket console univoco.');\n    },\n\n    async consume(ticket) {\n      if (typeof ticket !== 'string' || !TICKET_PATTERN.test(ticket)) {\n        return null;\n      }\n      const value = await options.client.eval(\n        CONSUME_SCRIPT,\n        1,\n        `${keyPrefix}${ticket}`,\n      );\n      if (typeof value !== 'string') return null;\n      return decryptRecord(value, key);\n    },\n\n    async healthCheck() {\n      try {\n        const result = await options.client.eval(\"return redis.call('PING')\", 0);\n        return String(result).toUpperCase() === 'PONG';\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n"]}

package/dist/accessi-module/security/edgeRateLimit.d.ts

@@ -0,0 +1,33 @@
+import type { NextFunction, Request, Response } from 'express';
+import type { RateLimitStore } from './rateLimitStore';
+/** Opzioni del limite grossolano per IP applicato davanti alle rotte Accessi. */
+export interface AccessiEdgeRateLimitOptions {
+    /** Default: true quando l'oggetto viene configurato. */
+    enabled?: boolean;
+    /** Finestra del limite. Default: 60000 ms. */
+    windowMs?: number;
+    /** Richieste consentite per IP nella finestra. Default: 300. */
+    maxAttempts?: number;
+    /** Store condiviso. Default: memoria. */
+    store?: RateLimitStore;
+    /** Prefisso delle chiavi. Default: `edge`. */
+    keyPrefix?: string;
+    /** Audit strutturato degli eventi di blocco. Default: true. */
+    audit?: boolean;
+    /**
+     * Decide se applicare il limite alla richiesta.
+     *
+     * Default: `/api` e `/api/*`. Il bootstrap Accessi passa un matcher che include
+     * anche OpenAPI e JWKS.
+     */
+    match?: (path: string, req: Request) => boolean;
+}
+export type AccessiEdgeRateLimitMiddleware = (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/**
+ * Middleware edge per Accessi Service.
+ *
+ * Non sostituisce il rate limit applicativo per account: aggiunge una soglia
+ * grossolana per IP, utile contro bot e floods prima che la richiesta raggiunga
+ * controller, database o introspection.
+ */
+export declare function createAccessiEdgeRateLimitMiddleware(options?: AccessiEdgeRateLimitOptions): AccessiEdgeRateLimitMiddleware | undefined;