emilsoftware-utilities 2.0.0-dev.67 → 2.0.0-dev.69

package/dist/accessi-module/security/edgeRateLimit.js

@@ -0,0 +1,81 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiEdgeRateLimitMiddleware = createAccessiEdgeRateLimitMiddleware;
+const audit_1 = require("./audit");
+const rateLimitStore_1 = require("./rateLimitStore");
+const DEFAULT_WINDOW_MS = 60000;
+const DEFAULT_MAX_ATTEMPTS = 300;
+function defaultMatch(path) {
+    return path === '/api' || path.startsWith('/api/');
+}
+/**
+ * Middleware edge per Accessi Service.
+ *
+ * Non sostituisce il rate limit applicativo per account: aggiunge una soglia
+ * grossolana per IP, utile contro bot e floods prima che la richiesta raggiunga
+ * controller, database o introspection.
+ */
+function createAccessiEdgeRateLimitMiddleware(options = {}) {
+    var _a, _b, _c, _d, _e;
+    if (options.enabled === false)
+        return undefined;
+    const windowMs = Math.max(1, Math.trunc((_a = options.windowMs) !== null && _a !== void 0 ? _a : DEFAULT_WINDOW_MS));
+    const maxAttempts = Math.max(1, Math.trunc((_b = options.maxAttempts) !== null && _b !== void 0 ? _b : DEFAULT_MAX_ATTEMPTS));
+    const store = (_c = options.store) !== null && _c !== void 0 ? _c : (0, rateLimitStore_1.getDefaultRateLimitStore)();
+    const keyPrefix = ((_d = options.keyPrefix) !== null && _d !== void 0 ? _d : 'edge').replace(/\|+$/, '');
+    const match = (_e = options.match) !== null && _e !== void 0 ? _e : defaultMatch;
+    return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        if (!match(req.path, req)) {
+            next();
+            return;
+        }
+        const ip = (_c = (_a = req.ip) !== null && _a !== void 0 ? _a : (_b = req.socket) === null || _b === void 0 ? void 0 : _b.remoteAddress) !== null && _c !== void 0 ? _c : 'unknown';
+        try {
+            const decision = yield store.consume(`${keyPrefix}|ip|${ip}`, windowMs, maxAttempts);
+            if (!decision.allowed) {
+                if (options.audit !== false) {
+                    (0, audit_1.auditAccessi)('edge_rate_limited', {
+                        ip,
+                        path: req.path,
+                        retryAfterSeconds: decision.retryAfterSeconds,
+                    });
+                }
+                res.setHeader('Retry-After', String(decision.retryAfterSeconds));
+                res.status(429).json({
+                    severity: 'error',
+                    status: 429,
+                    statusCode: 2,
+                    code: 'ACCESSI_EDGE_RATE_LIMITED',
+                    error: 'ACCESSI_EDGE_RATE_LIMITED',
+                    message: 'Troppe richieste. Riprova piu tardi.',
+                });
+                return;
+            }
+            next();
+        }
+        catch (_d) {
+            if (options.audit !== false) {
+                (0, audit_1.auditAccessi)('rate_limit_unavailable', { ip, path: req.path });
+            }
+            res.status(503).json({
+                severity: 'error',
+                status: 503,
+                statusCode: 2,
+                code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',
+                error: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',
+                message: 'Rate limit non disponibile. Riprova piu tardi.',
+            });
+        }
+    });
+}
+//# sourceMappingURL=edgeRateLimit.js.map

package/dist/accessi-module/security/edgeRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edgeRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/edgeRateLimit.ts"],"names":[],"mappings":";;;;;;;;;;;AAgDA,oFA0DC;AAzGD,mCAAuC;AACvC,qDAA4D;AAgC5D,MAAM,iBAAiB,GAAG,KAAM,CAAC;AACjC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oCAAoC,CAClD,UAAuC,EAAE;;IAEzC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,QAAQ,mCAAI,iBAAiB,CAAC,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,WAAW,mCAAI,oBAAoB,CAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,IAAA,yCAAwB,GAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,YAAY,CAAC;IAE5C,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;;QAC9E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAClC,GAAG,SAAS,OAAO,EAAE,EAAE,EACvB,QAAQ,EACR,WAAW,CACZ,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBAC5B,IAAA,oBAAY,EAAC,mBAAmB,EAAE;wBAChC,EAAE;wBACF,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,GAAG;oBACX,UAAU,EAAE,CAAC;oBACb,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,2BAA2B;oBAClC,OAAO,EAAE,sCAAsC;iBAChD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,WAAM,CAAC;YACP,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,IAAA,oBAAY,EAAC,wBAAwB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,GAAG;gBACX,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,gCAAgC;gBACtC,KAAK,EAAE,gCAAgC;gBACvC,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\nimport { auditAccessi } from './audit';\nimport { getDefaultRateLimitStore } from './rateLimitStore';\nimport type { RateLimitStore } from './rateLimitStore';\n\n/** Opzioni del limite grossolano per IP applicato davanti alle rotte Accessi. */\nexport interface AccessiEdgeRateLimitOptions {\n  /** Default: true quando l'oggetto viene configurato. */\n  enabled?: boolean;\n  /** Finestra del limite. Default: 60000 ms. */\n  windowMs?: number;\n  /** Richieste consentite per IP nella finestra. Default: 300. */\n  maxAttempts?: number;\n  /** Store condiviso. Default: memoria. */\n  store?: RateLimitStore;\n  /** Prefisso delle chiavi. Default: `edge`. */\n  keyPrefix?: string;\n  /** Audit strutturato degli eventi di blocco. Default: true. */\n  audit?: boolean;\n  /**\n   * Decide se applicare il limite alla richiesta.\n   *\n   * Default: `/api` e `/api/*`. Il bootstrap Accessi passa un matcher che include\n   * anche OpenAPI e JWKS.\n   */\n  match?: (path: string, req: Request) => boolean;\n}\n\nexport type AccessiEdgeRateLimitMiddleware = (\n  req: Request,\n  res: Response,\n  next: NextFunction,\n) => Promise<void>;\n\nconst DEFAULT_WINDOW_MS = 60_000;\nconst DEFAULT_MAX_ATTEMPTS = 300;\n\nfunction defaultMatch(path: string): boolean {\n  return path === '/api' || path.startsWith('/api/');\n}\n\n/**\n * Middleware edge per Accessi Service.\n *\n * Non sostituisce il rate limit applicativo per account: aggiunge una soglia\n * grossolana per IP, utile contro bot e floods prima che la richiesta raggiunga\n * controller, database o introspection.\n */\nexport function createAccessiEdgeRateLimitMiddleware(\n  options: AccessiEdgeRateLimitOptions = {},\n): AccessiEdgeRateLimitMiddleware | undefined {\n  if (options.enabled === false) return undefined;\n\n  const windowMs = Math.max(1, Math.trunc(options.windowMs ?? DEFAULT_WINDOW_MS));\n  const maxAttempts = Math.max(1, Math.trunc(options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS));\n  const store = options.store ?? getDefaultRateLimitStore();\n  const keyPrefix = (options.keyPrefix ?? 'edge').replace(/\\|+$/, '');\n  const match = options.match ?? defaultMatch;\n\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    if (!match(req.path, req)) {\n      next();\n      return;\n    }\n\n    const ip = req.ip ?? req.socket?.remoteAddress ?? 'unknown';\n    try {\n      const decision = await store.consume(\n        `${keyPrefix}|ip|${ip}`,\n        windowMs,\n        maxAttempts,\n      );\n      if (!decision.allowed) {\n        if (options.audit !== false) {\n          auditAccessi('edge_rate_limited', {\n            ip,\n            path: req.path,\n            retryAfterSeconds: decision.retryAfterSeconds,\n          });\n        }\n        res.setHeader('Retry-After', String(decision.retryAfterSeconds));\n        res.status(429).json({\n          severity: 'error',\n          status: 429,\n          statusCode: 2,\n          code: 'ACCESSI_EDGE_RATE_LIMITED',\n          error: 'ACCESSI_EDGE_RATE_LIMITED',\n          message: 'Troppe richieste. Riprova piu tardi.',\n        });\n        return;\n      }\n      next();\n    } catch {\n      if (options.audit !== false) {\n        auditAccessi('rate_limit_unavailable', { ip, path: req.path });\n      }\n      res.status(503).json({\n        severity: 'error',\n        status: 503,\n        statusCode: 2,\n        code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',\n        error: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',\n        message: 'Rate limit non disponibile. Riprova piu tardi.',\n      });\n    }\n  };\n}\n"]}

package/dist/accessi-module/security/jwks.d.ts

@@ -0,0 +1,33 @@
+import type { JsonWebKey } from "crypto";
+import type { Request, Response } from "express";
+import type { AccessiOptions } from "../AccessiModule";
+/** Chiave pubblica in formato JWK, pronta per una risposta JWKS. */
+export type AccessiJwksKey = JsonWebKey & {
+    kid: string;
+    alg: string;
+    use: "sig";
+};
+export interface AccessiJwksDocument {
+    keys: AccessiJwksKey[];
+}
+/** Path pubblico della JWKS, oppure `undefined` quando si usa HS256. */
+export declare function getAccessiJwksPath(options: AccessiOptions): string | undefined;
+/**
+ * Costruisce la JWKS pubblica con chiave corrente e chiavi precedenti.
+ *
+ * Restituisce `null` per HS256 o quando non e configurata una chiave
+ * pubblica/privata asimmetrica.
+ */
+export declare function buildAccessiJwks(options: AccessiOptions): AccessiJwksDocument | null;
+/** Handler Express per la JWKS. Risponde 404 se la configurazione e HS256. */
+export declare function createAccessiJwksHandler(options: AccessiOptions): (req: Request, res: Response) => Response | void;
+/**
+ * Monta la route JWKS sull'Express host.
+ *
+ * Per un'app Nest esistente passare `app.getHttpAdapter().getInstance()`.
+ * Restituisce il path montato, oppure `undefined` se HS256.
+ */
+export interface AccessiJwksExpressApp {
+    get(path: string, handler: (req: Request, res: Response) => unknown): unknown;
+}
+export declare function setupAccessiJwks(app: AccessiJwksExpressApp, options: AccessiOptions): string | undefined;

package/dist/accessi-module/security/jwks.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAccessiJwksPath = getAccessiJwksPath;
+exports.buildAccessiJwks = buildAccessiJwks;
+exports.createAccessiJwksHandler = createAccessiJwksHandler;
+exports.setupAccessiJwks = setupAccessiJwks;
+const crypto_1 = require("crypto");
+const DEFAULT_JWKS_PATH = "accessi/.well-known/jwks.json";
+function normalizePath(value) {
+    return `/${value.replace(/^\/+|\/+$/g, "")}`;
+}
+function fingerprintPublicKey(publicKey) {
+    const der = (0, crypto_1.createPublicKey)(publicKey).export({ type: "spki", format: "der" });
+    return (0, crypto_1.createHash)("sha256").update(der).digest("base64url").slice(0, 16);
+}
+function toJwksKey(publicKey, keyId, algorithm) {
+    const jwk = (0, crypto_1.createPublicKey)(publicKey).export({ format: "jwk" });
+    return Object.assign(Object.assign({}, jwk), { kid: keyId !== null && keyId !== void 0 ? keyId : fingerprintPublicKey(publicKey), alg: algorithm, use: "sig" });
+}
+/** Path pubblico della JWKS, oppure `undefined` quando si usa HS256. */
+function getAccessiJwksPath(options) {
+    var _a, _b;
+    const algorithm = (_a = options.jwtOptions.algorithm) !== null && _a !== void 0 ? _a : "HS256";
+    if (algorithm.startsWith("HS"))
+        return undefined;
+    return normalizePath((_b = options.jwtOptions.jwksPath) !== null && _b !== void 0 ? _b : DEFAULT_JWKS_PATH);
+}
+/**
+ * Costruisce la JWKS pubblica con chiave corrente e chiavi precedenti.
+ *
+ * Restituisce `null` per HS256 o quando non e configurata una chiave
+ * pubblica/privata asimmetrica.
+ */
+function buildAccessiJwks(options) {
+    var _a, _b, _c, _d;
+    const algorithm = (_a = options.jwtOptions.algorithm) !== null && _a !== void 0 ? _a : "HS256";
+    if (algorithm.startsWith("HS"))
+        return null;
+    const currentPublicKey = (_b = options.jwtOptions.publicKey) !== null && _b !== void 0 ? _b : options.jwtOptions.privateKey;
+    if (!currentPublicKey)
+        return null;
+    const keys = [
+        toJwksKey(currentPublicKey, options.jwtOptions.keyId, algorithm),
+    ];
+    for (const previous of (_c = options.jwtOptions.previousPublicKeys) !== null && _c !== void 0 ? _c : []) {
+        const previousAlgorithm = (_d = previous.algorithm) !== null && _d !== void 0 ? _d : algorithm;
+        keys.push(toJwksKey(previous.publicKey, previous.keyId, previousAlgorithm));
+    }
+    // Deduplica per kid: la chiave corrente vince sulle precedenti.
+    const unique = new Map();
+    for (const key of keys) {
+        if (!unique.has(key.kid))
+            unique.set(key.kid, key);
+    }
+    return { keys: [...unique.values()] };
+}
+/** Handler Express per la JWKS. Risponde 404 se la configurazione e HS256. */
+function createAccessiJwksHandler(options) {
+    return (_req, res) => {
+        const document = buildAccessiJwks(options);
+        if (!document) {
+            return res.status(404).json({
+                severity: "error",
+                status: 404,
+                statusCode: 2,
+                code: "ACCESSI_JWKS_NOT_AVAILABLE",
+                error: "ACCESSI_JWKS_NOT_AVAILABLE",
+                message: "JWKS non disponibile: Accessi usa HS256 o non ha una chiave asimmetrica.",
+            });
+        }
+        res.setHeader("Content-Type", "application/json");
+        res.setHeader("Cache-Control", "public, max-age=300");
+        return res.status(200).send(document);
+    };
+}
+function setupAccessiJwks(app, options) {
+    const path = getAccessiJwksPath(options);
+    if (!path)
+        return undefined;
+    app.get(path, createAccessiJwksHandler(options));
+    return path;
+}
+//# sourceMappingURL=jwks.js.map

package/dist/accessi-module/security/jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../../src/accessi-module/security/jwks.ts"],"names":[],"mappings":";;AA0CA,gDAIC;AAQD,4CAuBC;AAGD,4DAoBC;AAYD,4CAQC;AAxHD,mCAAqD;AAgBrD,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAE1D,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,SAA0B;IACtD,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAChB,SAA0B,EAC1B,KAAyB,EACzB,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAe,CAAC;IAC/E,uCACK,GAAG,KACN,GAAG,EAAE,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,oBAAoB,CAAC,SAAS,CAAC,EAC7C,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,KAAK,IACV;AACJ,CAAC;AAED,wEAAwE;AACxE,SAAgB,kBAAkB,CAAC,OAAuB;;IACxD,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC;IAC1D,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,aAAa,CAAC,MAAA,OAAO,CAAC,UAAU,CAAC,QAAQ,mCAAI,iBAAiB,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,OAAuB;;IACtD,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC;IAC1D,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,gBAAgB,GAAG,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;IACvF,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,IAAI,GAAqB;QAC7B,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC;KACjE,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,MAAA,OAAO,CAAC,UAAU,CAAC,kBAAkB,mCAAI,EAAE,EAAE,CAAC;QACnE,MAAM,iBAAiB,GAAG,MAAA,QAAQ,CAAC,SAAS,mCAAI,SAAS,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,gEAAgE;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,SAAgB,wBAAwB,CACtC,OAAuB;IAEvB,OAAO,CAAC,IAAa,EAAE,GAAa,EAAmB,EAAE;QACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,GAAG;gBACX,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,4BAA4B;gBAClC,KAAK,EAAE,4BAA4B;gBACnC,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAYD,SAAgB,gBAAgB,CAC9B,GAA0B,EAC1B,OAAuB;IAEvB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { createHash, createPublicKey } from \"crypto\";\nimport type { JsonWebKey } from \"crypto\";\nimport type { Request, Response } from \"express\";\nimport type { AccessiOptions } from \"../AccessiModule\";\n\n/** Chiave pubblica in formato JWK, pronta per una risposta JWKS. */\nexport type AccessiJwksKey = JsonWebKey & {\n  kid: string;\n  alg: string;\n  use: \"sig\";\n};\n\nexport interface AccessiJwksDocument {\n  keys: AccessiJwksKey[];\n}\n\nconst DEFAULT_JWKS_PATH = \"accessi/.well-known/jwks.json\";\n\nfunction normalizePath(value: string): string {\n  return `/${value.replace(/^\\/+|\\/+$/g, \"\")}`;\n}\n\nfunction fingerprintPublicKey(publicKey: string | Buffer): string {\n  const der = createPublicKey(publicKey).export({ type: \"spki\", format: \"der\" });\n  return createHash(\"sha256\").update(der).digest(\"base64url\").slice(0, 16);\n}\n\nfunction toJwksKey(\n  publicKey: string | Buffer,\n  keyId: string | undefined,\n  algorithm: string,\n): AccessiJwksKey {\n  const jwk = createPublicKey(publicKey).export({ format: \"jwk\" }) as JsonWebKey;\n  return {\n    ...jwk,\n    kid: keyId ?? fingerprintPublicKey(publicKey),\n    alg: algorithm,\n    use: \"sig\",\n  };\n}\n\n/** Path pubblico della JWKS, oppure `undefined` quando si usa HS256. */\nexport function getAccessiJwksPath(options: AccessiOptions): string | undefined {\n  const algorithm = options.jwtOptions.algorithm ?? \"HS256\";\n  if (algorithm.startsWith(\"HS\")) return undefined;\n  return normalizePath(options.jwtOptions.jwksPath ?? DEFAULT_JWKS_PATH);\n}\n\n/**\n * Costruisce la JWKS pubblica con chiave corrente e chiavi precedenti.\n *\n * Restituisce `null` per HS256 o quando non e configurata una chiave\n * pubblica/privata asimmetrica.\n */\nexport function buildAccessiJwks(options: AccessiOptions): AccessiJwksDocument | null {\n  const algorithm = options.jwtOptions.algorithm ?? \"HS256\";\n  if (algorithm.startsWith(\"HS\")) return null;\n\n  const currentPublicKey = options.jwtOptions.publicKey ?? options.jwtOptions.privateKey;\n  if (!currentPublicKey) return null;\n\n  const keys: AccessiJwksKey[] = [\n    toJwksKey(currentPublicKey, options.jwtOptions.keyId, algorithm),\n  ];\n\n  for (const previous of options.jwtOptions.previousPublicKeys ?? []) {\n    const previousAlgorithm = previous.algorithm ?? algorithm;\n    keys.push(toJwksKey(previous.publicKey, previous.keyId, previousAlgorithm));\n  }\n\n  // Deduplica per kid: la chiave corrente vince sulle precedenti.\n  const unique = new Map<string, AccessiJwksKey>();\n  for (const key of keys) {\n    if (!unique.has(key.kid)) unique.set(key.kid, key);\n  }\n\n  return { keys: [...unique.values()] };\n}\n\n/** Handler Express per la JWKS. Risponde 404 se la configurazione e HS256. */\nexport function createAccessiJwksHandler(\n  options: AccessiOptions,\n): (req: Request, res: Response) => Response | void {\n  return (_req: Request, res: Response): Response | void => {\n    const document = buildAccessiJwks(options);\n    if (!document) {\n      return res.status(404).json({\n        severity: \"error\",\n        status: 404,\n        statusCode: 2,\n        code: \"ACCESSI_JWKS_NOT_AVAILABLE\",\n        error: \"ACCESSI_JWKS_NOT_AVAILABLE\",\n        message: \"JWKS non disponibile: Accessi usa HS256 o non ha una chiave asimmetrica.\",\n      });\n    }\n\n    res.setHeader(\"Content-Type\", \"application/json\");\n    res.setHeader(\"Cache-Control\", \"public, max-age=300\");\n    return res.status(200).send(document);\n  };\n}\n\n/**\n * Monta la route JWKS sull'Express host.\n *\n * Per un'app Nest esistente passare `app.getHttpAdapter().getInstance()`.\n * Restituisce il path montato, oppure `undefined` se HS256.\n */\nexport interface AccessiJwksExpressApp {\n  get(path: string, handler: (req: Request, res: Response) => unknown): unknown;\n}\n\nexport function setupAccessiJwks(\n  app: AccessiJwksExpressApp,\n  options: AccessiOptions,\n): string | undefined {\n  const path = getAccessiJwksPath(options);\n  if (!path) return undefined;\n  app.get(path, createAccessiJwksHandler(options));\n  return path;\n}\n"]}

package/dist/accessi-module/security/jwksBootstrap.d.ts

@@ -0,0 +1,15 @@
+import { OnModuleInit } from '@nestjs/common';
+import { HttpAdapterHost } from '@nestjs/core';
+import type { AccessiOptions } from '../AccessiModule';
+/**
+ * Monta automaticamente la JWKS sull'Express adapter di Nest.
+ *
+ * Serve sia ai bootstrap standalone sia a `AccessiModule.forRoot` in un'app
+ * Nest ospitante, senza richiedere una chiamata manuale a `setupAccessiJwks`.
+ */
+export declare class AccessiJwksBootstrapService implements OnModuleInit {
+    private readonly options;
+    private readonly adapterHost;
+    constructor(options: AccessiOptions, adapterHost: HttpAdapterHost);
+    onModuleInit(): void;
+}

package/dist/accessi-module/security/jwksBootstrap.js

@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiJwksBootstrapService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const jwks_1 = require("./jwks");
+/**
+ * Monta automaticamente la JWKS sull'Express adapter di Nest.
+ *
+ * Serve sia ai bootstrap standalone sia a `AccessiModule.forRoot` in un'app
+ * Nest ospitante, senza richiedere una chiamata manuale a `setupAccessiJwks`.
+ */
+let AccessiJwksBootstrapService = class AccessiJwksBootstrapService {
+    constructor(options, adapterHost) {
+        this.options = options;
+        this.adapterHost = adapterHost;
+    }
+    onModuleInit() {
+        var _a, _b;
+        const instance = (_b = (_a = this.adapterHost.httpAdapter) === null || _a === void 0 ? void 0 : _a.getInstance) === null || _b === void 0 ? void 0 : _b.call(_a);
+        if (instance && typeof instance.get === 'function') {
+            (0, jwks_1.setupAccessiJwks)(instance, this.options);
+        }
+    }
+};
+exports.AccessiJwksBootstrapService = AccessiJwksBootstrapService;
+exports.AccessiJwksBootstrapService = AccessiJwksBootstrapService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object, core_1.HttpAdapterHost])
+], AccessiJwksBootstrapService);
+//# sourceMappingURL=jwksBootstrap.js.map

package/dist/accessi-module/security/jwksBootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwksBootstrap.js","sourceRoot":"","sources":["../../../src/accessi-module/security/jwksBootstrap.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAkE;AAClE,uCAA+C;AAE/C,iCAA0C;AAG1C;;;;;GAKG;AAEI,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACtC,YAC8C,OAAuB,EAClD,WAA4B;QADD,YAAO,GAAP,OAAO,CAAgB;QAClD,gBAAW,GAAX,WAAW,CAAiB;IAC5C,CAAC;IAEJ,YAAY;;QACV,MAAM,QAAQ,GAAY,MAAA,MAAA,IAAI,CAAC,WAAW,CAAC,WAAW,0CAAE,WAAW,kDAAI,CAAC;QACxE,IAAI,QAAQ,IAAI,OAAQ,QAAkC,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9E,IAAA,uBAAgB,EAAC,QAAiC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;CACF,CAAA;AAZY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,sBAAe;GAHpC,2BAA2B,CAYvC","sourcesContent":["import { Inject, Injectable, OnModuleInit } from '@nestjs/common';\nimport { HttpAdapterHost } from '@nestjs/core';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { setupAccessiJwks } from './jwks';\nimport type { AccessiJwksExpressApp } from './jwks';\n\n/**\n * Monta automaticamente la JWKS sull'Express adapter di Nest.\n *\n * Serve sia ai bootstrap standalone sia a `AccessiModule.forRoot` in un'app\n * Nest ospitante, senza richiedere una chiamata manuale a `setupAccessiJwks`.\n */\n@Injectable()\nexport class AccessiJwksBootstrapService implements OnModuleInit {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n    private readonly adapterHost: HttpAdapterHost,\n  ) {}\n\n  onModuleInit(): void {\n    const instance: unknown = this.adapterHost.httpAdapter?.getInstance?.();\n    if (instance && typeof (instance as AccessiJwksExpressApp).get === 'function') {\n      setupAccessiJwks(instance as AccessiJwksExpressApp, this.options);\n    }\n  }\n}\n"]}

package/dist/accessi-module/security/jwtTokenOptions.d.ts

@@ -2,14 +2,21 @@ import type * as jwt from "jsonwebtoken";
 import type { AccessiOptions } from "../AccessiModule";
 /** Algoritmi supportati per gli access token Accessi. */
 export type AccessiAccessTokenAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512";
-/** Configurazione di firma: chiave, algoritmo e claim standard. */
 export declare function getAccessiAccessTokenSigningConfig(options: AccessiOptions): {
     key: jwt.Secret;
     algorithm: AccessiAccessTokenAlgorithm;
     signOptions: Pick<jwt.SignOptions, "issuer" | "audience" | "keyid">;
 };
-/** Configurazione di verifica: chiave pubblica per RS/ES, segreto derivato per HS. */
 export declare function getAccessiAccessTokenVerificationConfig(options: AccessiOptions): {
     key: jwt.Secret;
     verifyOptions: jwt.VerifyOptions;
 };
+export declare function getAccessiRefreshTokenSigningConfig(options: AccessiOptions): {
+    key: jwt.Secret;
+    algorithm: AccessiAccessTokenAlgorithm;
+    signOptions: Pick<jwt.SignOptions, "issuer" | "audience" | "keyid">;
+};
+export declare function getAccessiRefreshTokenVerificationConfig(options: AccessiOptions): {
+    key: jwt.Secret;
+    verifyOptions: jwt.VerifyOptions;
+};

package/dist/accessi-module/security/jwtTokenOptions.js

@@ -2,16 +2,18 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAccessiAccessTokenSigningConfig = getAccessiAccessTokenSigningConfig;
 exports.getAccessiAccessTokenVerificationConfig = getAccessiAccessTokenVerificationConfig;
+exports.getAccessiRefreshTokenSigningConfig = getAccessiRefreshTokenSigningConfig;
+exports.getAccessiRefreshTokenVerificationConfig = getAccessiRefreshTokenVerificationConfig;
 const passwordResetToken_1 = require("./passwordResetToken");
 function resolveAlgorithm(options) {
     var _a;
     return (_a = options.jwtOptions.algorithm) !== null && _a !== void 0 ? _a : "HS256";
 }
 /** Configurazione di firma: chiave, algoritmo e claim standard. */
-function getAccessiAccessTokenSigningConfig(options) {
+function getTokenSigningConfig(options, purpose) {
     const algorithm = resolveAlgorithm(options);
     const key = algorithm.startsWith("HS")
-        ? (0, passwordResetToken_1.getAccessiJwtSecret)(options)
+        ? (0, passwordResetToken_1.getAccessiJwtSecret)(options, purpose)
         : options.jwtOptions.privateKey;
     if (!key) {
         throw new Error(`jwtOptions.privateKey e obbligatoria per l'algoritmo ${algorithm}.`);
@@ -25,11 +27,11 @@ function getAccessiAccessTokenSigningConfig(options) {
     };
 }
 /** Configurazione di verifica: chiave pubblica per RS/ES, segreto derivato per HS. */
-function getAccessiAccessTokenVerificationConfig(options) {
+function getTokenVerificationConfig(options, purpose) {
     var _a;
     const algorithm = resolveAlgorithm(options);
     const key = algorithm.startsWith("HS")
-        ? (0, passwordResetToken_1.getAccessiJwtSecret)(options)
+        ? (0, passwordResetToken_1.getAccessiJwtSecret)(options, purpose)
         : ((_a = options.jwtOptions.publicKey) !== null && _a !== void 0 ? _a : options.jwtOptions.privateKey);
     if (!key) {
         throw new Error(`jwtOptions.publicKey e obbligatoria per verificare token ${algorithm}.`);
@@ -41,4 +43,16 @@ function getAccessiAccessTokenVerificationConfig(options) {
             : {})),
     };
 }
+function getAccessiAccessTokenSigningConfig(options) {
+    return getTokenSigningConfig(options, "access");
+}
+function getAccessiAccessTokenVerificationConfig(options) {
+    return getTokenVerificationConfig(options, "access");
+}
+function getAccessiRefreshTokenSigningConfig(options) {
+    return getTokenSigningConfig(options, "refresh");
+}
+function getAccessiRefreshTokenVerificationConfig(options) {
+    return getTokenVerificationConfig(options, "refresh");
+}
 //# sourceMappingURL=jwtTokenOptions.js.map

package/dist/accessi-module/security/jwtTokenOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwtTokenOptions.js","sourceRoot":"","sources":["../../../src/accessi-module/security/jwtTokenOptions.ts"],"names":[],"mappings":";;AAqBA,gFAyBC;AAGD,0FAyBC;AAxED,6DAA2D;AAc3D,SAAS,gBAAgB,CAAC,OAAuB;;IAC/C,OAAO,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC;AACjD,CAAC;AAED,mEAAmE;AACnE,SAAgB,kCAAkC,CAAC,OAAuB;IAKxE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,CAAC,CAAC,IAAA,wCAAmB,EAAC,OAAO,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;IAElC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,wDAAwD,SAAS,GAAG,CAAC,CAAC;IACxF,CAAC;IAED,OAAO;QACL,GAAG;QACH,SAAS;QACT,WAAW,gDACN,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAuC,EAAE;YAC1E,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzE;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,uCAAuC,CAAC,OAAuB;;IAI7E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,CAAC,CAAC,IAAA,wCAAmB,EAAC,OAAO,CAAC;QAC9B,CAAC,CAAC,CAAC,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG;QACH,aAAa,gCACX,UAAU,EAAE,CAAC,SAAS,CAAC,IACpB,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAyC,EAAE;YAC5E,CAAC,CAAC,EAAE,CAAC,CACR;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type * as jwt from \"jsonwebtoken\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { getAccessiJwtSecret } from \"./passwordResetToken\";\n\n/** Algoritmi supportati per gli access token Accessi. */\nexport type AccessiAccessTokenAlgorithm =\n  | \"HS256\"\n  | \"HS384\"\n  | \"HS512\"\n  | \"RS256\"\n  | \"RS384\"\n  | \"RS512\"\n  | \"ES256\"\n  | \"ES384\"\n  | \"ES512\";\n\nfunction resolveAlgorithm(options: AccessiOptions): AccessiAccessTokenAlgorithm {\n  return options.jwtOptions.algorithm ?? \"HS256\";\n}\n\n/** Configurazione di firma: chiave, algoritmo e claim standard. */\nexport function getAccessiAccessTokenSigningConfig(options: AccessiOptions): {\n  key: jwt.Secret;\n  algorithm: AccessiAccessTokenAlgorithm;\n  signOptions: Pick<jwt.SignOptions, \"issuer\" | \"audience\" | \"keyid\">;\n} {\n  const algorithm = resolveAlgorithm(options);\n  const key = algorithm.startsWith(\"HS\")\n    ? getAccessiJwtSecret(options)\n    : options.jwtOptions.privateKey;\n\n  if (!key) {\n    throw new Error(`jwtOptions.privateKey e obbligatoria per l'algoritmo ${algorithm}.`);\n  }\n\n  return {\n    key,\n    algorithm,\n    signOptions: {\n      ...(options.jwtOptions.issuer ? { issuer: options.jwtOptions.issuer } : {}),\n      ...(options.jwtOptions.audience\n        ? { audience: options.jwtOptions.audience as jwt.SignOptions[\"audience\"] }\n        : {}),\n      ...(options.jwtOptions.keyId ? { keyid: options.jwtOptions.keyId } : {}),\n    },\n  };\n}\n\n/** Configurazione di verifica: chiave pubblica per RS/ES, segreto derivato per HS. */\nexport function getAccessiAccessTokenVerificationConfig(options: AccessiOptions): {\n  key: jwt.Secret;\n  verifyOptions: jwt.VerifyOptions;\n} {\n  const algorithm = resolveAlgorithm(options);\n  const key = algorithm.startsWith(\"HS\")\n    ? getAccessiJwtSecret(options)\n    : (options.jwtOptions.publicKey ?? options.jwtOptions.privateKey);\n\n  if (!key) {\n    throw new Error(\n      `jwtOptions.publicKey e obbligatoria per verificare token ${algorithm}.`,\n    );\n  }\n\n  return {\n    key,\n    verifyOptions: {\n      algorithms: [algorithm],\n      ...(options.jwtOptions.issuer ? { issuer: options.jwtOptions.issuer } : {}),\n      ...(options.jwtOptions.audience\n        ? { audience: options.jwtOptions.audience as jwt.VerifyOptions[\"audience\"] }\n        : {}),\n    },\n  };\n}\n"]}
+{"version":3,"file":"jwtTokenOptions.js","sourceRoot":"","sources":["../../../src/accessi-module/security/jwtTokenOptions.ts"],"names":[],"mappings":";;AAmFA,gFAEC;AAED,0FAEC;AAED,kFAEC;AAED,4FAEC;AA/FD,6DAA2D;AAe3D,SAAS,gBAAgB,CAAC,OAAuB;;IAC/C,OAAO,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC;AACjD,CAAC;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAC5B,OAAuB,EACvB,OAA0B;IAM1B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,CAAC,CAAC,IAAA,wCAAmB,EAAC,OAAO,EAAE,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;IAElC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,wDAAwD,SAAS,GAAG,CAAC,CAAC;IACxF,CAAC;IAED,OAAO;QACL,GAAG;QACH,SAAS;QACT,WAAW,gDACN,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAuC,EAAE;YAC1E,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzE;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,0BAA0B,CACjC,OAAuB,EACvB,OAA0B;;IAK1B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,CAAC,CAAC,IAAA,wCAAmB,EAAC,OAAO,EAAE,OAAO,CAAC;QACvC,CAAC,CAAC,CAAC,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG;QACH,aAAa,gCACX,UAAU,EAAE,CAAC,SAAS,CAAC,IACpB,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAyC,EAAE;YAC5E,CAAC,CAAC,EAAE,CAAC,CACR;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,kCAAkC,CAAC,OAAuB;IACxE,OAAO,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,uCAAuC,CAAC,OAAuB;IAC7E,OAAO,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,mCAAmC,CAAC,OAAuB;IACzE,OAAO,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,SAAgB,wCAAwC,CAAC,OAAuB;IAC9E,OAAO,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC","sourcesContent":["import type * as jwt from \"jsonwebtoken\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { getAccessiJwtSecret } from \"./passwordResetToken\";\nimport type { AccessiJwtPurpose } from \"./passwordResetToken\";\n\n/** Algoritmi supportati per gli access token Accessi. */\nexport type AccessiAccessTokenAlgorithm =\n  | \"HS256\"\n  | \"HS384\"\n  | \"HS512\"\n  | \"RS256\"\n  | \"RS384\"\n  | \"RS512\"\n  | \"ES256\"\n  | \"ES384\"\n  | \"ES512\";\n\nfunction resolveAlgorithm(options: AccessiOptions): AccessiAccessTokenAlgorithm {\n  return options.jwtOptions.algorithm ?? \"HS256\";\n}\n\n/** Configurazione di firma: chiave, algoritmo e claim standard. */\nfunction getTokenSigningConfig(\n  options: AccessiOptions,\n  purpose: AccessiJwtPurpose,\n): {\n  key: jwt.Secret;\n  algorithm: AccessiAccessTokenAlgorithm;\n  signOptions: Pick<jwt.SignOptions, \"issuer\" | \"audience\" | \"keyid\">;\n} {\n  const algorithm = resolveAlgorithm(options);\n  const key = algorithm.startsWith(\"HS\")\n    ? getAccessiJwtSecret(options, purpose)\n    : options.jwtOptions.privateKey;\n\n  if (!key) {\n    throw new Error(`jwtOptions.privateKey e obbligatoria per l'algoritmo ${algorithm}.`);\n  }\n\n  return {\n    key,\n    algorithm,\n    signOptions: {\n      ...(options.jwtOptions.issuer ? { issuer: options.jwtOptions.issuer } : {}),\n      ...(options.jwtOptions.audience\n        ? { audience: options.jwtOptions.audience as jwt.SignOptions[\"audience\"] }\n        : {}),\n      ...(options.jwtOptions.keyId ? { keyid: options.jwtOptions.keyId } : {}),\n    },\n  };\n}\n\n/** Configurazione di verifica: chiave pubblica per RS/ES, segreto derivato per HS. */\nfunction getTokenVerificationConfig(\n  options: AccessiOptions,\n  purpose: AccessiJwtPurpose,\n): {\n  key: jwt.Secret;\n  verifyOptions: jwt.VerifyOptions;\n} {\n  const algorithm = resolveAlgorithm(options);\n  const key = algorithm.startsWith(\"HS\")\n    ? getAccessiJwtSecret(options, purpose)\n    : (options.jwtOptions.publicKey ?? options.jwtOptions.privateKey);\n\n  if (!key) {\n    throw new Error(\n      `jwtOptions.publicKey e obbligatoria per verificare token ${algorithm}.`,\n    );\n  }\n\n  return {\n    key,\n    verifyOptions: {\n      algorithms: [algorithm],\n      ...(options.jwtOptions.issuer ? { issuer: options.jwtOptions.issuer } : {}),\n      ...(options.jwtOptions.audience\n        ? { audience: options.jwtOptions.audience as jwt.VerifyOptions[\"audience\"] }\n        : {}),\n    },\n  };\n}\n\nexport function getAccessiAccessTokenSigningConfig(options: AccessiOptions) {\n  return getTokenSigningConfig(options, \"access\");\n}\n\nexport function getAccessiAccessTokenVerificationConfig(options: AccessiOptions) {\n  return getTokenVerificationConfig(options, \"access\");\n}\n\nexport function getAccessiRefreshTokenSigningConfig(options: AccessiOptions) {\n  return getTokenSigningConfig(options, \"refresh\");\n}\n\nexport function getAccessiRefreshTokenVerificationConfig(options: AccessiOptions) {\n  return getTokenVerificationConfig(options, \"refresh\");\n}\n"]}

package/dist/accessi-module/security/passwordResetToken.d.ts

@@ -3,7 +3,7 @@ import type { AccessiOptions } from '../AccessiModule';
 /** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */
 export declare const DEFAULT_PASSWORD_RESET_EXPIRES_IN = "1h";
 /** Scopo della chiave derivata: separa le chiavi di access token, reset password e 2FA. */
-export type AccessiJwtPurpose = 'access' | 'reset' | '2fa';
+export type AccessiJwtPurpose = 'access' | 'refresh' | 'reset' | '2fa';
 /**
  * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).
  * Un leak della chiave di reset non compromette gli access token e viceversa.

package/dist/accessi-module/security/passwordResetToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"passwordResetToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,kDAOC;AAGD,4DAqBC;AAGD,4DAeC;AApED,kDAAoC;AACpC,mCAAoC;AAGpC,mHAAmH;AACtG,QAAA,iCAAiC,GAAG,IAAI,CAAC;AAUtD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAuB,EAAE,UAA6B,QAAQ;;IAChG,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,oHAAoH;AACpH,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,KAAa,EACb,MAAc,EACd,YAA0C,yCAAiC;IAE3E,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CACb;QACE,KAAK;QACL,GAAG,EAAE,gBAAgB;KACtB,EACD,MAAM,EACN;QACE,OAAO,EAAE,GAAG,YAAY,EAAE;QAC1B,SAAS;KACV,CACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,wBAAwB,CACtC,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAA8B,CAAC;IAClG,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,MAAK,gBAAgB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1J,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import * as jwt from 'jsonwebtoken';\nimport { createHmac } from 'crypto';\nimport type { AccessiOptions } from '../AccessiModule';\n\n/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */\nexport const DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';\n\ninterface PasswordResetTokenPayload extends jwt.JwtPayload {\n  nonce: string;\n  typ: 'password-reset';\n}\n\n/** Scopo della chiave derivata: separa le chiavi di access token, reset password e 2FA. */\nexport type AccessiJwtPurpose = 'access' | 'reset' | '2fa';\n\n/**\n * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).\n * Un leak della chiave di reset non compromette gli access token e viceversa.\n */\nexport function getAccessiJwtSecret(options: AccessiOptions, purpose: AccessiJwtPurpose = 'access'): string {\n  const secret = options?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\n  if (!secret) {\n    throw new Error('JWT secret non configurato.');\n  }\n\n  return createHmac('sha256', secret).update(`accessi:jwt:${purpose}:v1`).digest('hex');\n}\n\n/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */\nexport function createPasswordResetToken(\n  codiceUtente: number,\n  nonce: string,\n  secret: string,\n  expiresIn: jwt.SignOptions['expiresIn'] = DEFAULT_PASSWORD_RESET_EXPIRES_IN,\n): string {\n  if (!codiceUtente || !nonce) {\n    throw new Error('Dati insufficienti per generare il reset token.');\n  }\n\n  return jwt.sign(\n    {\n      nonce,\n      typ: 'password-reset',\n    },\n    secret,\n    {\n      subject: `${codiceUtente}`,\n      expiresIn,\n    },\n  );\n}\n\n/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */\nexport function verifyPasswordResetToken(\n  token: string,\n  secret: string,\n): { codiceUtente: number; nonce: string } {\n  const decoded = jwt.verify(token, secret, { algorithms: ['HS256'] }) as PasswordResetTokenPayload;\n  const codiceUtente = Number(decoded?.sub);\n\n  if (decoded?.typ !== 'password-reset' || !Number.isSafeInteger(codiceUtente) || codiceUtente <= 0 || typeof decoded?.nonce !== 'string' || !decoded.nonce) {\n    throw new Error('Token di reset non valido.');\n  }\n\n  return {\n    codiceUtente,\n    nonce: decoded.nonce,\n  };\n}\n"]}
+{"version":3,"file":"passwordResetToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,kDAOC;AAGD,4DAqBC;AAGD,4DAeC;AApED,kDAAoC;AACpC,mCAAoC;AAGpC,mHAAmH;AACtG,QAAA,iCAAiC,GAAG,IAAI,CAAC;AAUtD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAuB,EAAE,UAA6B,QAAQ;;IAChG,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,oHAAoH;AACpH,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,KAAa,EACb,MAAc,EACd,YAA0C,yCAAiC;IAE3E,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CACb;QACE,KAAK;QACL,GAAG,EAAE,gBAAgB;KACtB,EACD,MAAM,EACN;QACE,OAAO,EAAE,GAAG,YAAY,EAAE;QAC1B,SAAS;KACV,CACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,wBAAwB,CACtC,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAA8B,CAAC;IAClG,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,MAAK,gBAAgB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1J,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import * as jwt from 'jsonwebtoken';\nimport { createHmac } from 'crypto';\nimport type { AccessiOptions } from '../AccessiModule';\n\n/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */\nexport const DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';\n\ninterface PasswordResetTokenPayload extends jwt.JwtPayload {\n  nonce: string;\n  typ: 'password-reset';\n}\n\n/** Scopo della chiave derivata: separa le chiavi di access token, reset password e 2FA. */\nexport type AccessiJwtPurpose = 'access' | 'refresh' | 'reset' | '2fa';\n\n/**\n * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).\n * Un leak della chiave di reset non compromette gli access token e viceversa.\n */\nexport function getAccessiJwtSecret(options: AccessiOptions, purpose: AccessiJwtPurpose = 'access'): string {\n  const secret = options?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\n  if (!secret) {\n    throw new Error('JWT secret non configurato.');\n  }\n\n  return createHmac('sha256', secret).update(`accessi:jwt:${purpose}:v1`).digest('hex');\n}\n\n/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */\nexport function createPasswordResetToken(\n  codiceUtente: number,\n  nonce: string,\n  secret: string,\n  expiresIn: jwt.SignOptions['expiresIn'] = DEFAULT_PASSWORD_RESET_EXPIRES_IN,\n): string {\n  if (!codiceUtente || !nonce) {\n    throw new Error('Dati insufficienti per generare il reset token.');\n  }\n\n  return jwt.sign(\n    {\n      nonce,\n      typ: 'password-reset',\n    },\n    secret,\n    {\n      subject: `${codiceUtente}`,\n      expiresIn,\n    },\n  );\n}\n\n/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */\nexport function verifyPasswordResetToken(\n  token: string,\n  secret: string,\n): { codiceUtente: number; nonce: string } {\n  const decoded = jwt.verify(token, secret, { algorithms: ['HS256'] }) as PasswordResetTokenPayload;\n  const codiceUtente = Number(decoded?.sub);\n\n  if (decoded?.typ !== 'password-reset' || !Number.isSafeInteger(codiceUtente) || codiceUtente <= 0 || typeof decoded?.nonce !== 'string' || !decoded.nonce) {\n    throw new Error('Token di reset non valido.');\n  }\n\n  return {\n    codiceUtente,\n    nonce: decoded.nonce,\n  };\n}\n"]}

package/dist/accessi-module/security/publicAuthRateLimit.d.ts

@@ -1,10 +1,12 @@
 import { Request, Response } from 'express';
 import type { AccessiOptions } from '../AccessiModule';
-export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken' | 'adminBootstrap' | 'consoleEntry';
-type RateLimitDecision = {
-    allowed: boolean;
-    retryAfterSeconds: number;
-};
-export declare function checkPublicAuthRateLimit(options: AccessiOptions, scope: PublicAuthRateLimitScope, req: Request, identifiers?: string[]): RateLimitDecision;
+import type { RateLimitDecision } from './rateLimitStore';
+export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'refresh' | 'getUserByToken' | 'adminBootstrap' | 'consoleEntry';
+/**
+ * Applica il rate limit per IP e, opzionalmente, per soggetto.
+ *
+ * Con `publicAuthRateLimit.store` e possibile usare uno store Redis condiviso;
+ * senza store usa la memoria del processo.
+ */
+export declare function checkPublicAuthRateLimit(options: AccessiOptions, scope: PublicAuthRateLimitScope, req: Request, identifiers?: string[]): Promise<RateLimitDecision>;
 export declare function sendPublicAuthRateLimitExceeded(res: Response, retryAfterSeconds: number): Response;
-export {};

package/dist/accessi-module/security/publicAuthRateLimit.js

@@ -1,9 +1,19 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkPublicAuthRateLimit = checkPublicAuthRateLimit;
 exports.sendPublicAuthRateLimitExceeded = sendPublicAuthRateLimitExceeded;
 const common_1 = require("@nestjs/common");
 const Utilities_1 = require("../../Utilities");
+const rateLimitStore_1 = require("./rateLimitStore");
 const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
     twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },
@@ -11,13 +21,11 @@ const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
+    refresh: { windowMs: 5 * 60 * 1000, maxAttempts: 60 },
     getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
     adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
     consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
 };
-const RATE_LIMIT_BUCKETS = new Map();
-const MAX_TRACKED_BUCKETS = 20000;
-const MAX_WINDOW_MS = Math.max(...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs));
 function getRule(options, scope) {
     var _a;
     const configuredRule = (_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a[scope];
@@ -33,6 +41,19 @@ function getRule(options, scope) {
     }
     return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];
 }
+function consumeRateLimit(store, key, rule) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            return yield store.consume(key, rule.windowMs, rule.maxAttempts);
+        }
+        catch (_a) {
+            throw new common_1.HttpException({
+                code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',
+                message: 'Rate limit non disponibile. Riprova piu tardi.',
+            }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+        }
+    });
+}
 function normalizeIdentifier(identifier) {
     if (typeof identifier !== 'string') {
         return null;
@@ -40,87 +61,43 @@ function normalizeIdentifier(identifier) {
     const normalized = identifier.trim().toLowerCase();
     return normalized === '' ? null : normalized;
 }
-function pruneRateLimitBuckets(now) {
-    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {
-        return;
-    }
-    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {
-        if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {
-            RATE_LIMIT_BUCKETS.delete(key);
+/**
+ * Applica il rate limit per IP e, opzionalmente, per soggetto.
+ *
+ * Con `publicAuthRateLimit.store` e possibile usare uno store Redis condiviso;
+ * senza store usa la memoria del processo.
+ */
+function checkPublicAuthRateLimit(options_1, scope_1, req_1) {
+    return __awaiter(this, arguments, void 0, function* (options, scope, req, identifiers = []) {
+        var _a, _b, _c, _d, _e, _f, _g;
+        if (((_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.enabled) === false) {
+            return { allowed: true, retryAfterSeconds: 0 };
         }
-        if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {
-            return;
+        const rule = getRule(options, scope);
+        const store = (_c = (_b = options.publicAuthRateLimit) === null || _b === void 0 ? void 0 : _b.store) !== null && _c !== void 0 ? _c : (0, rateLimitStore_1.getDefaultRateLimitStore)();
+        const ipAddress = (_g = normalizeIdentifier((_f = (_d = req.ip) !== null && _d !== void 0 ? _d : (_e = req.socket) === null || _e === void 0 ? void 0 : _e.remoteAddress) !== null && _f !== void 0 ? _f : 'unknown')) !== null && _g !== void 0 ? _g : 'unknown';
+        // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,
+        // evitando crescita di memoria con identificatori sempre diversi.
+        const ipDecision = yield consumeRateLimit(store, `${scope}|ip|${ipAddress}`, rule);
+        if (!ipDecision.allowed) {
+            return ipDecision;
         }
-    }
-}
-/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */
-function enforceBucketCap() {
-    while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {
-        let oldestKey;
-        let oldestSeen = Number.POSITIVE_INFINITY;
-        for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {
-            if (bucket.lastSeenAt < oldestSeen) {
-                oldestSeen = bucket.lastSeenAt;
-                oldestKey = key;
+        let retryAfterSeconds = 0;
+        for (const identifier of identifiers) {
+            const normalizedIdentifier = normalizeIdentifier(identifier);
+            if (!normalizedIdentifier) {
+                continue;
+            }
+            const subjectDecision = yield consumeRateLimit(store, `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`, rule);
+            if (!subjectDecision.allowed) {
+                retryAfterSeconds = Math.max(retryAfterSeconds, subjectDecision.retryAfterSeconds);
             }
         }
-        if (oldestKey === undefined) {
-            return;
+        if (retryAfterSeconds > 0) {
+            return { allowed: false, retryAfterSeconds };
         }
-        RATE_LIMIT_BUCKETS.delete(oldestKey);
-    }
-}
-function consumeBucket(bucketKey, rule, now) {
-    const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);
-    if (!existingBucket || existingBucket.resetAt <= now) {
-        enforceBucketCap();
-        RATE_LIMIT_BUCKETS.set(bucketKey, {
-            count: 1,
-            resetAt: now + rule.windowMs,
-            lastSeenAt: now,
-        });
-        return null;
-    }
-    existingBucket.lastSeenAt = now;
-    if (existingBucket.count >= rule.maxAttempts) {
-        return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));
-    }
-    existingBucket.count += 1;
-    return null;
-}
-function checkPublicAuthRateLimit(options, scope, req, identifiers = []) {
-    var _a, _b, _c, _d, _e;
-    if (((_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.enabled) === false) {
         return { allowed: true, retryAfterSeconds: 0 };
-    }
-    const rule = getRule(options, scope);
-    const now = Date.now();
-    pruneRateLimitBuckets(now);
-    const ipAddress = (_e = normalizeIdentifier((_d = (_b = req.ip) !== null && _b !== void 0 ? _b : (_c = req.socket) === null || _c === void 0 ? void 0 : _c.remoteAddress) !== null && _d !== void 0 ? _d : 'unknown')) !== null && _e !== void 0 ? _e : 'unknown';
-    // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,
-    // evitando crescita di memoria con identificatori sempre diversi.
-    const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);
-    if (ipRetryAfterSeconds) {
-        return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };
-    }
-    let retryAfterSeconds = 0;
-    for (const identifier of identifiers) {
-        const normalizedIdentifier = normalizeIdentifier(identifier);
-        if (!normalizedIdentifier) {
-            continue;
-        }
-        const bucketRetryAfterSeconds = consumeBucket(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`, rule, now);
-        if (bucketRetryAfterSeconds) {
-            retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);
-        }
-    }
-    if (retryAfterSeconds > 0) {
-        return {
-            allowed: false,
-            retryAfterSeconds,
-        };
-    }
-    return { allowed: true, retryAfterSeconds: 0 };
+    });
 }
 function sendPublicAuthRateLimitExceeded(res, retryAfterSeconds) {
     res.setHeader('Retry-After', String(retryAfterSeconds));