npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.68 → 2.0.0-dev.69 - Mend

emilsoftware-utilities 2.0.0-dev.68 → 2.0.0-dev.69

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (132) hide show

package/dist/accessi-module/security/rateLimitStore.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rateLimitStore.js","sourceRoot":"","sources":["../../../src/accessi-module/security/rateLimitStore.ts"],"names":[],"mappings":";;;;;;;;;;;AA+~~BA,gEA4DC~~;AAKD,4DAEC;AA+BD,~~8DAkCC~~;~~AA9ID~~,MAAM,mBAAmB,GAAG,KAAM,CAAC;AAEnC,SAAS,eAAe,CAAC,QAAgB,EAAE,WAAmB;IAC5D,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3C,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,0BAA0B,CACxC,aAAqB,mBAAmB;IAExC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,IAAI,OAAO,CAAC,IAAI,GAAG,cAAc;YAAE,OAAO;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,OAAO,OAAO,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,SAA6B,CAAC;YAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACpC,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;oBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;oBAC/B,SAAS,GAAG,GAAG,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO;YACpC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACC,OAAO,CAAC,GAAW,EAAE,QAAgB,EAAE,WAAmB;;gBAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,CAAC;gBAEX,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;oBACzC,UAAU,EAAE,CAAC;oBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;wBACf,KAAK,EAAE,CAAC;wBACR,OAAO,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ;wBAC9B,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;oBACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;gBACjD,CAAC;gBAED,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACzC,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;qBAC3E,CAAC;gBACJ,CAAC;gBAED,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACjD,CAAC;SAAA;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;AAElD,2FAA2F;AAC3F,SAAgB,wBAAwB;IACtC,OAAO,YAAY,CAAC;AACtB,CAAC;AAaD,MAAM,YAAY,GAAG;;;;;;;;;;CAUpB,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,yBAAyB,CACvC,OAAmC;;IAEnC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,eAAe,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE7E,OAAO;QACC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW;;gBACtC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACnC,YAAY,EACZ,CAAC,EACD,GAAG,SAAS,GAAG,GAAG,EAAE,EACpB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,WAAW,CACnB,CAAC;gBAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,OAAO;oBACL,OAAO;oBACP,iBAAiB,EAAE,OAAO;wBACxB,CAAC,CAAC,CAAC;wBACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;iBACnF,CAAC;YACJ,CAAC;SAAA;KACF,CAAC;AACJ,CAAC","sourcesContent":["/** Esito di un controllo di rate limit. /\nexport interface RateLimitDecision {\n allowed: boolean;\n retryAfterSeconds: number;\n}\n\n/* Store pluggable per rate limit: memoria per singola istanza, Redis per cluster. /\nexport interface RateLimitStore {\n consume(key: string, windowMs: number, maxAttempts: number): Promise<RateLimitDecision>;\n}\n\nexport interface MemoryRateLimitStore extends RateLimitStore {\n reset(): void;\n}\n\ninterface RateLimitBucket {\n count: number;\n resetAt: number;\n lastSeenAt: number;\n}\n\nconst DEFAULT_MAX_BUCKETS = 20_000;\n\nfunction normalizeLimits(windowMs: number, maxAttempts: number): { windowMs: number; maxAttempts: number } {\n return {\n windowMs: Math.max(1, Math.trunc(windowMs)),\n maxAttempts: Math.max(1, Math.trunc(maxAttempts)),\n };\n}\n\n/* Store in memoria con finestra fissa e limite di bucket. /\nexport function createMemoryRateLimitStore(\n maxBuckets: number = DEFAULT_MAX_BUCKETS,\n): MemoryRateLimitStore {\n const buckets = new Map<string, RateLimitBucket>();\n const safeMaxBuckets = Math.max(1, Math.trunc(maxBuckets));\n\n const prune = (now: number): void => {\n if (buckets.size < safeMaxBuckets) return;\n for (const [key, bucket] of buckets) {\n if (bucket.resetAt <= now) buckets.delete(key);\n }\n };\n\n const enforceCap = (): void => {\n while (buckets.size >= safeMaxBuckets) {\n let oldestKey: string \| undefined;\n let oldestSeen = Number.POSITIVE_INFINITY;\n for (const [key, bucket] of buckets) {\n if (bucket.lastSeenAt < oldestSeen) {\n oldestSeen = bucket.lastSeenAt;\n oldestKey = key;\n }\n }\n if (oldestKey === undefined) return;\n buckets.delete(oldestKey);\n }\n };\n\n return {\n async consume(key: string, windowMs: number, maxAttempts: number): Promise<RateLimitDecision> {\n const limits = normalizeLimits(windowMs, maxAttempts);\n const now = Date.now();\n prune(now);\n\n const existing = buckets.get(key);\n if (!existing \|\| existing.resetAt <= now) {\n enforceCap();\n buckets.set(key, {\n count: 1,\n resetAt: now + limits.windowMs,\n lastSeenAt: now,\n });\n return { allowed: true, retryAfterSeconds: 0 };\n }\n\n existing.lastSeenAt = now;\n if (existing.count >= limits.maxAttempts) {\n return {\n allowed: false,\n retryAfterSeconds: Math.max(1, Math.ceil((existing.resetAt - now) / 1000)),\n };\n }\n\n existing.count += 1;\n return { allowed: true, retryAfterSeconds: 0 };\n },\n reset() {\n buckets.clear();\n },\n };\n}\n\nconst defaultStore = createMemoryRateLimitStore();\n\n/* Store di default in memoria, usato quando non viene configurato uno store condiviso. /\nexport function getDefaultRateLimitStore(): MemoryRateLimitStore {\n return defaultStore;\n}\n\n/* Client Redis minimale: compatibile con ioredis (`redis.eval(script, numKeys, ...args)`). /\nexport interface RateLimitRedisClient {\n eval(script: string, numKeys: number, ...args: Array<string \| number>): Promise<unknown>;\n}\n\nexport interface RedisRateLimitStoreOptions {\n client: RateLimitRedisClient;\n /* Default: `accessi:rate:`. /\n keyPrefix?: string;\n}\n\nconst REDIS_SCRIPT = `\nlocal current = redis.call('INCR', KEYS[1])\nif current == 1 then\n redis.call('PEXPIRE', KEYS[1], ARGV[1])\nend\nlocal ttl = redis.call('PTTL', KEYS[1])\nif current > tonumber(ARGV[2]) then\n return {0, ttl}\nend\nreturn {1, ttl}\n`;\n\n/\n Store Redis per rate limit distribuito.\n \n Usa `INCR` + `PEXPIRE` atomici. Adatto a login, reset password, 2FA,\n * console entry e service token in deployment multi-istanza.\n */\nexport function createRedisRateLimitStore(\n options: RedisRateLimitStoreOptions,\n): RateLimitStore {\n if (!options?.client \|\| typeof options.client.eval !== 'function') {\n throw new Error('Redis rate limit store: client.eval non configurato.');\n }\n\n const keyPrefix = (options.keyPrefix ?? 'accessi:rate:').replace(/:+$/, ':');\n\n return {\n async consume(key, windowMs, maxAttempts) {\n const limits = normalizeLimits(windowMs, maxAttempts);\n const raw = await options.client.eval(\n REDIS_SCRIPT,\n 1,\n `${keyPrefix}${key}`,\n limits.windowMs,\n limits.maxAttempts,\n );\n\n if (!Array.isArray(raw) \|\| raw.length < 2) {\n throw new Error('Redis rate limit store: risposta non valida.');\n }\n\n const allowed = Number(raw[0]) === 1;\n const ttlMs = Number(raw[1]);\n return {\n allowed,\n retryAfterSeconds: allowed\n ? 0\n : Math.max(1, Number.isFinite(ttlMs) && ttlMs > 0 ? Math.ceil(ttlMs / 1000) : 1),\n };\n },\n };\n}\n"]}
1	+ {"version":3,"file":"rateLimitStore.js","sourceRoot":"","sources":["../../../src/accessi-module/security/rateLimitStore.ts"],"names":[],"mappings":";;;;;;;;;;;AAiCA,gEA+DC;AAKD,4DAEC;AA+BD,8DA0CC;AAzJD,MAAM,mBAAmB,GAAG,KAAM,CAAC;AAEnC,SAAS,eAAe,CAAC,QAAgB,EAAE,WAAmB;IAC5D,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3C,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,0BAA0B,CACxC,aAAqB,mBAAmB;IAExC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,IAAI,OAAO,CAAC,IAAI,GAAG,cAAc;YAAE,OAAO;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,OAAO,OAAO,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,SAA6B,CAAC;YAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACpC,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;oBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;oBAC/B,SAAS,GAAG,GAAG,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO;YACpC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACC,OAAO,CAAC,GAAW,EAAE,QAAgB,EAAE,WAAmB;;gBAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,CAAC;gBAEX,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;oBACzC,UAAU,EAAE,CAAC;oBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;wBACf,KAAK,EAAE,CAAC;wBACR,OAAO,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ;wBAC9B,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;oBACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;gBACjD,CAAC;gBAED,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACzC,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;qBAC3E,CAAC;gBACJ,CAAC;gBAED,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACjD,CAAC;SAAA;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;AAElD,2FAA2F;AAC3F,SAAgB,wBAAwB;IACtC,OAAO,YAAY,CAAC;AACtB,CAAC;AAaD,MAAM,YAAY,GAAG;;;;;;;;;;CAUpB,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,yBAAyB,CACvC,OAAmC;;IAEnC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,eAAe,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE7E,OAAO;QACC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW;;gBACtC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACnC,YAAY,EACZ,CAAC,EACD,GAAG,SAAS,GAAG,GAAG,EAAE,EACpB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,WAAW,CACnB,CAAC;gBAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,OAAO;oBACL,OAAO;oBACP,iBAAiB,EAAE,OAAO;wBACxB,CAAC,CAAC,CAAC;wBACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;iBACnF,CAAC;YACJ,CAAC;SAAA;QACK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC","sourcesContent":["/** Esito di un controllo di rate limit. /\nexport interface RateLimitDecision {\n allowed: boolean;\n retryAfterSeconds: number;\n}\n\n/* Store pluggable per rate limit: memoria per singola istanza, Redis per cluster. /\nexport interface RateLimitStore {\n consume(key: string, windowMs: number, maxAttempts: number): Promise<RateLimitDecision>;\n /* Health check opzionale per readiness del servizio. /\n healthCheck?(): Promise<boolean>;\n}\n\nexport interface MemoryRateLimitStore extends RateLimitStore {\n reset(): void;\n}\n\ninterface RateLimitBucket {\n count: number;\n resetAt: number;\n lastSeenAt: number;\n}\n\nconst DEFAULT_MAX_BUCKETS = 20_000;\n\nfunction normalizeLimits(windowMs: number, maxAttempts: number): { windowMs: number; maxAttempts: number } {\n return {\n windowMs: Math.max(1, Math.trunc(windowMs)),\n maxAttempts: Math.max(1, Math.trunc(maxAttempts)),\n };\n}\n\n/* Store in memoria con finestra fissa e limite di bucket. /\nexport function createMemoryRateLimitStore(\n maxBuckets: number = DEFAULT_MAX_BUCKETS,\n): MemoryRateLimitStore {\n const buckets = new Map<string, RateLimitBucket>();\n const safeMaxBuckets = Math.max(1, Math.trunc(maxBuckets));\n\n const prune = (now: number): void => {\n if (buckets.size < safeMaxBuckets) return;\n for (const [key, bucket] of buckets) {\n if (bucket.resetAt <= now) buckets.delete(key);\n }\n };\n\n const enforceCap = (): void => {\n while (buckets.size >= safeMaxBuckets) {\n let oldestKey: string \| undefined;\n let oldestSeen = Number.POSITIVE_INFINITY;\n for (const [key, bucket] of buckets) {\n if (bucket.lastSeenAt < oldestSeen) {\n oldestSeen = bucket.lastSeenAt;\n oldestKey = key;\n }\n }\n if (oldestKey === undefined) return;\n buckets.delete(oldestKey);\n }\n };\n\n return {\n async consume(key: string, windowMs: number, maxAttempts: number): Promise<RateLimitDecision> {\n const limits = normalizeLimits(windowMs, maxAttempts);\n const now = Date.now();\n prune(now);\n\n const existing = buckets.get(key);\n if (!existing \|\| existing.resetAt <= now) {\n enforceCap();\n buckets.set(key, {\n count: 1,\n resetAt: now + limits.windowMs,\n lastSeenAt: now,\n });\n return { allowed: true, retryAfterSeconds: 0 };\n }\n\n existing.lastSeenAt = now;\n if (existing.count >= limits.maxAttempts) {\n return {\n allowed: false,\n retryAfterSeconds: Math.max(1, Math.ceil((existing.resetAt - now) / 1000)),\n };\n }\n\n existing.count += 1;\n return { allowed: true, retryAfterSeconds: 0 };\n },\n reset() {\n buckets.clear();\n },\n async healthCheck() {\n return true;\n },\n };\n}\n\nconst defaultStore = createMemoryRateLimitStore();\n\n/* Store di default in memoria, usato quando non viene configurato uno store condiviso. /\nexport function getDefaultRateLimitStore(): MemoryRateLimitStore {\n return defaultStore;\n}\n\n/* Client Redis minimale: compatibile con ioredis (`redis.eval(script, numKeys, ...args)`). /\nexport interface RateLimitRedisClient {\n eval(script: string, numKeys: number, ...args: Array<string \| number>): Promise<unknown>;\n}\n\nexport interface RedisRateLimitStoreOptions {\n client: RateLimitRedisClient;\n /* Default: `accessi:rate:`. /\n keyPrefix?: string;\n}\n\nconst REDIS_SCRIPT = `\nlocal current = redis.call('INCR', KEYS[1])\nif current == 1 then\n redis.call('PEXPIRE', KEYS[1], ARGV[1])\nend\nlocal ttl = redis.call('PTTL', KEYS[1])\nif current > tonumber(ARGV[2]) then\n return {0, ttl}\nend\nreturn {1, ttl}\n`;\n\n/\n Store Redis per rate limit distribuito.\n \n Usa `INCR` + `PEXPIRE` atomici. Adatto a login, reset password, 2FA,\n * console entry e service token in deployment multi-istanza.\n */\nexport function createRedisRateLimitStore(\n options: RedisRateLimitStoreOptions,\n): RateLimitStore {\n if (!options?.client \|\| typeof options.client.eval !== 'function') {\n throw new Error('Redis rate limit store: client.eval non configurato.');\n }\n\n const keyPrefix = (options.keyPrefix ?? 'accessi:rate:').replace(/:+$/, ':');\n\n return {\n async consume(key, windowMs, maxAttempts) {\n const limits = normalizeLimits(windowMs, maxAttempts);\n const raw = await options.client.eval(\n REDIS_SCRIPT,\n 1,\n `${keyPrefix}${key}`,\n limits.windowMs,\n limits.maxAttempts,\n );\n\n if (!Array.isArray(raw) \|\| raw.length < 2) {\n throw new Error('Redis rate limit store: risposta non valida.');\n }\n\n const allowed = Number(raw[0]) === 1;\n const ttlMs = Number(raw[1]);\n return {\n allowed,\n retryAfterSeconds: allowed\n ? 0\n : Math.max(1, Number.isFinite(ttlMs) && ttlMs > 0 ? Math.ceil(ttlMs / 1000) : 1),\n };\n },\n async healthCheck() {\n try {\n const result = await options.client.eval(\"return redis.call('PING')\", 0);\n return String(result).toUpperCase() === 'PONG';\n } catch {\n return false;\n }\n },\n };\n}\n"]}

package/dist/accessi-module/security/refreshTokenRotation.d.ts ADDED Viewed

@@ -0,0 +1,40 @@
+import type { AccessiOptions } from '../AccessiModule';
+/**
+ * Store di rotazione refresh token.
+ *
+ * `consume` e atomico: restituisce true una sola volta per `jti`, poi il token
+ * e considerato usato fino alla sua scadenza. In multi-istanza usare Redis.
+ */
+export interface RefreshTokenRotationStore {
+    consume(jti: string, expiresAtMs: number): Promise<boolean>;
+    /** Health check opzionale per readiness del servizio. */
+    healthCheck?(): Promise<boolean>;
+}
+export interface RefreshTokenRotationOptions {
+    /** Default: disabilitata se non viene fornito uno store. */
+    enabled?: boolean;
+    /** Store condiviso (es. Redis) per il monouso tra istanze. */
+    store?: RefreshTokenRotationStore;
+}
+export interface MemoryRefreshTokenRotationStore extends RefreshTokenRotationStore {
+    clear(): void;
+}
+export declare function createMemoryRefreshTokenRotationStore(): MemoryRefreshTokenRotationStore;
+export interface RefreshTokenRotationRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+export interface RedisRefreshTokenRotationStoreOptions {
+    client: RefreshTokenRotationRedisClient;
+    /** Default: `accessi:refresh-used:`. */
+    keyPrefix?: string;
+}
+/**
+ * Store Redis per refresh token monouso.
+ *
+ * Usa `SET ... PX ... NX` atomico: due refresh concorrenti dello stesso token
+ * producono un solo successo.
+ */
+export declare function createRedisRefreshTokenRotationStore(options: RedisRefreshTokenRotationStoreOptions): RefreshTokenRotationStore;
+export declare function getRefreshTokenRotationStore(options: AccessiOptions): RefreshTokenRotationStore | undefined;
+/** Solo per test: azzera lo store in memoria di default. */
+export declare function clearDefaultRefreshTokenRotations(): void;

package/dist/accessi-module/security/refreshTokenRotation.js ADDED Viewed

@@ -0,0 +1,91 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemoryRefreshTokenRotationStore = createMemoryRefreshTokenRotationStore;
+exports.createRedisRefreshTokenRotationStore = createRedisRefreshTokenRotationStore;
+exports.getRefreshTokenRotationStore = getRefreshTokenRotationStore;
+exports.clearDefaultRefreshTokenRotations = clearDefaultRefreshTokenRotations;
+const CONSUME_SCRIPT = `
+local ttl = tonumber(ARGV[2])
+if not ttl or ttl <= 0 then return nil end
+return redis.call('SET', KEYS[1], '1', 'PX', ttl, 'NX')
+`;
+function createMemoryRefreshTokenRotationStore() {
+    const used = new Map();
+    return {
+        consume(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const now = Date.now();
+                const existing = used.get(jti);
+                if (existing !== undefined && existing > now) {
+                    return false;
+                }
+                used.set(jti, expiresAtMs);
+                return true;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                return true;
+            });
+        },
+        clear() {
+            used.clear();
+        },
+    };
+}
+/**
+ * Store Redis per refresh token monouso.
+ *
+ * Usa `SET ... PX ... NX` atomico: due refresh concorrenti dello stesso token
+ * producono un solo successo.
+ */
+function createRedisRefreshTokenRotationStore(options) {
+    var _a;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis refresh rotation store: client.eval non configurato.');
+    }
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:refresh-used:').replace(/:+$/, ':');
+    return {
+        consume(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const ttlMs = Math.max(1, Math.trunc(expiresAtMs - Date.now()));
+                const result = yield options.client.eval(CONSUME_SCRIPT, 1, `${keyPrefix}${jti}`, ttlMs);
+                return result !== null && result !== undefined && result !== false;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const result = yield options.client.eval("return redis.call('PING')", 0);
+                    return String(result).toUpperCase() === 'PONG';
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+    };
+}
+const defaultMemoryStore = createMemoryRefreshTokenRotationStore();
+function getRefreshTokenRotationStore(options) {
+    var _a, _b, _c;
+    if (((_a = options.refreshTokenRotation) === null || _a === void 0 ? void 0 : _a.enabled) === false)
+        return undefined;
+    if ((_b = options.refreshTokenRotation) === null || _b === void 0 ? void 0 : _b.store)
+        return options.refreshTokenRotation.store;
+    return ((_c = options.refreshTokenRotation) === null || _c === void 0 ? void 0 : _c.enabled) === true ? defaultMemoryStore : undefined;
+}
+/** Solo per test: azzera lo store in memoria di default. */
+function clearDefaultRefreshTokenRotations() {
+    defaultMemoryStore.clear();
+}
+//# sourceMappingURL=refreshTokenRotation.js.map

package/dist/accessi-module/security/refreshTokenRotation.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"refreshTokenRotation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/refreshTokenRotation.ts"],"names":[],"mappings":";;;;;;;;;;;AA+BA,sFAmBC;AAkBD,oFA6BC;AAID,oEAMC;AAGD,8EAEC;AAvFD,MAAM,cAAc,GAAG;;;;CAItB,CAAC;AAEF,SAAgB,qCAAqC;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACC,OAAO,CAAC,GAAG,EAAE,WAAW;;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;oBAC7C,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACD,KAAK;YACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,SAAgB,oCAAoC,CAClD,OAA8C;;IAE9C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAErF,OAAO;QACC,OAAO,CAAC,GAAG,EAAE,WAAW;;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACtC,cAAc,EACd,CAAC,EACD,GAAG,SAAS,GAAG,GAAG,EAAE,EACpB,KAAK,CACN,CAAC;gBACF,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC;YACrE,CAAC;SAAA;QACK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,qCAAqC,EAAE,CAAC;AAEnE,SAAgB,4BAA4B,CAC1C,OAAuB;;IAEvB,IAAI,CAAA,MAAA,OAAO,CAAC,oBAAoB,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,MAAA,OAAO,CAAC,oBAAoB,0CAAE,KAAK;QAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IACnF,OAAO,CAAA,MAAA,OAAO,CAAC,oBAAoB,0CAAE,OAAO,MAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,4DAA4D;AAC5D,SAAgB,iCAAiC;IAC/C,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\n\n/**\n * Store di rotazione refresh token.\n *\n * `consume` e atomico: restituisce true una sola volta per `jti`, poi il token\n * e considerato usato fino alla sua scadenza. In multi-istanza usare Redis.\n */\nexport interface RefreshTokenRotationStore {\n consume(jti: string, expiresAtMs: number): Promise<boolean>;\n /** Health check opzionale per readiness del servizio. */\n healthCheck?(): Promise<boolean>;\n}\n\nexport interface RefreshTokenRotationOptions {\n /** Default: disabilitata se non viene fornito uno store. */\n enabled?: boolean;\n /** Store condiviso (es. Redis) per il monouso tra istanze. */\n store?: RefreshTokenRotationStore;\n}\n\nexport interface MemoryRefreshTokenRotationStore extends RefreshTokenRotationStore {\n clear(): void;\n}\n\nconst CONSUME_SCRIPT = `\nlocal ttl = tonumber(ARGV[2])\nif not ttl or ttl <= 0 then return nil end\nreturn redis.call('SET', KEYS[1], '1', 'PX', ttl, 'NX')\n`;\n\nexport function createMemoryRefreshTokenRotationStore(): MemoryRefreshTokenRotationStore {\n const used = new Map<string, number>();\n return {\n async consume(jti, expiresAtMs) {\n const now = Date.now();\n const existing = used.get(jti);\n if (existing !== undefined && existing > now) {\n return false;\n }\n used.set(jti, expiresAtMs);\n return true;\n },\n async healthCheck() {\n return true;\n },\n clear() {\n used.clear();\n },\n };\n}\n\nexport interface RefreshTokenRotationRedisClient {\n eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisRefreshTokenRotationStoreOptions {\n client: RefreshTokenRotationRedisClient;\n /** Default: `accessi:refresh-used:`. */\n keyPrefix?: string;\n}\n\n/**\n * Store Redis per refresh token monouso.\n *\n * Usa `SET ... PX ... NX` atomico: due refresh concorrenti dello stesso token\n * producono un solo successo.\n */\nexport function createRedisRefreshTokenRotationStore(\n options: RedisRefreshTokenRotationStoreOptions,\n): RefreshTokenRotationStore {\n if (!options?.client || typeof options.client.eval !== 'function') {\n throw new Error('Redis refresh rotation store: client.eval non configurato.');\n }\n\n const keyPrefix = (options.keyPrefix ?? 'accessi:refresh-used:').replace(/:+$/, ':');\n\n return {\n async consume(jti, expiresAtMs) {\n const ttlMs = Math.max(1, Math.trunc(expiresAtMs - Date.now()));\n const result = await options.client.eval(\n CONSUME_SCRIPT,\n 1,\n `${keyPrefix}${jti}`,\n ttlMs,\n );\n return result !== null && result !== undefined && result !== false;\n },\n async healthCheck() {\n try {\n const result = await options.client.eval(\"return redis.call('PING')\", 0);\n return String(result).toUpperCase() === 'PONG';\n } catch {\n return false;\n }\n },\n };\n}\n\nconst defaultMemoryStore = createMemoryRefreshTokenRotationStore();\n\nexport function getRefreshTokenRotationStore(\n options: AccessiOptions,\n): RefreshTokenRotationStore | undefined {\n if (options.refreshTokenRotation?.enabled === false) return undefined;\n if (options.refreshTokenRotation?.store) return options.refreshTokenRotation.store;\n return options.refreshTokenRotation?.enabled === true ? defaultMemoryStore : undefined;\n}\n\n/** Solo per test: azzera lo store in memoria di default. */\nexport function clearDefaultRefreshTokenRotations(): void {\n defaultMemoryStore.clear();\n}\n"]}

package/dist/accessi-module/security/sessionRevocation.d.ts ADDED Viewed

@@ -0,0 +1,52 @@
+import type { AccessiOptions } from '../AccessiModule';
+/**
+ * Revoca delle sessioni per utente.
+ *
+ * La revoca e un timestamp: un token con `iat` precedente al cutoff viene
+ * rifiutato. I token emessi dopo il cutoff restano validi. La granularita di
+ * `iat` e in secondi, quindi un token emesso nello stesso secondo della revoca
+ * puo sopravvivere: e una finestra massima di 1 secondo.
+ */
+export interface SessionRevocationStore {
+    revokeUser(codiceUtente: number, revokedAtMs: number): Promise<void>;
+    getUserRevocation(codiceUtente: number): Promise<number | null>;
+    /** Health check opzionale per readiness del servizio. */
+    healthCheck?(): Promise<boolean>;
+}
+export interface SessionRevocationOptions {
+    /** Default: disabilitata se non viene fornito uno store. */
+    enabled?: boolean;
+    /** Store condiviso (es. Redis) per invalidare le sessioni tra istanze. */
+    store?: SessionRevocationStore;
+    /** TTL delle chiavi Redis. Default: 365 giorni. */
+    ttlMs?: number;
+}
+export interface MemorySessionRevocationStore extends SessionRevocationStore {
+    clear(): void;
+}
+export declare function createMemorySessionRevocationStore(): MemorySessionRevocationStore;
+export interface SessionRevocationRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+export interface RedisSessionRevocationStoreOptions {
+    client: SessionRevocationRedisClient;
+    /** Default: `accessi:revoked-user:`. */
+    keyPrefix?: string;
+    /** Default: 365 giorni. */
+    ttlMs?: number;
+}
+/**
+ * Store Redis per la revoca sessioni.
+ *
+ * `revokeUser` scrive un timestamp con TTL; `getUserRevocation` lo legge.
+ * Il TTL deve essere maggiore della durata massima dei token.
+ */
+export declare function createRedisSessionRevocationStore(options: RedisSessionRevocationStoreOptions): SessionRevocationStore;
+/** Store di default in memoria, usato quando `sessionRevocation.store` non e configurato ma la revoca e abilitata. */
+export declare function getSessionRevocationStore(options: AccessiOptions): SessionRevocationStore | undefined;
+/** True se il token e stato emesso prima dell'ultima revoca sessioni dell'utente. */
+export declare function isAccessiTokenRevoked(options: AccessiOptions, payload: Record<string, unknown>, codiceUtente: number): Promise<boolean>;
+/** Revoca tutte le sessioni dell'utente. Richiede uno store configurato. */
+export declare function revokeAccessiUserSessions(options: AccessiOptions, codiceUtente: number, revokedAtMs?: number): Promise<void>;
+/** Solo per test: azzera lo store in memoria di default. */
+export declare function clearDefaultSessionRevocations(): void;

package/dist/accessi-module/security/sessionRevocation.js ADDED Viewed

@@ -0,0 +1,124 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemorySessionRevocationStore = createMemorySessionRevocationStore;
+exports.createRedisSessionRevocationStore = createRedisSessionRevocationStore;
+exports.getSessionRevocationStore = getSessionRevocationStore;
+exports.isAccessiTokenRevoked = isAccessiTokenRevoked;
+exports.revokeAccessiUserSessions = revokeAccessiUserSessions;
+exports.clearDefaultSessionRevocations = clearDefaultSessionRevocations;
+const REVOKE_USER_SCRIPT = "if tonumber(ARGV[2]) > 0 then return redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2]) else return redis.call('SET', KEYS[1], ARGV[1]) end";
+const GET_USER_SCRIPT = "return redis.call('GET', KEYS[1])";
+function createMemorySessionRevocationStore() {
+    const revokedAt = new Map();
+    return {
+        revokeUser(codiceUtente, timestamp) {
+            return __awaiter(this, void 0, void 0, function* () {
+                revokedAt.set(codiceUtente, timestamp);
+            });
+        },
+        getUserRevocation(codiceUtente) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                return (_a = revokedAt.get(codiceUtente)) !== null && _a !== void 0 ? _a : null;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                return true;
+            });
+        },
+        clear() {
+            revokedAt.clear();
+        },
+    };
+}
+/**
+ * Store Redis per la revoca sessioni.
+ *
+ * `revokeUser` scrive un timestamp con TTL; `getUserRevocation` lo legge.
+ * Il TTL deve essere maggiore della durata massima dei token.
+ */
+function createRedisSessionRevocationStore(options) {
+    var _a, _b;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis session revocation store: client.eval non configurato.');
+    }
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:revoked-user:').replace(/:+$/, ':');
+    const ttlMs = Math.max(0, Math.trunc((_b = options.ttlMs) !== null && _b !== void 0 ? _b : 365 * 24 * 60 * 60 * 1000));
+    return {
+        revokeUser(codiceUtente, revokedAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield options.client.eval(REVOKE_USER_SCRIPT, 1, `${keyPrefix}${codiceUtente}`, String(revokedAtMs), ttlMs);
+            });
+        },
+        getUserRevocation(codiceUtente) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const value = yield options.client.eval(GET_USER_SCRIPT, 1, `${keyPrefix}${codiceUtente}`);
+                if (typeof value !== 'string' && typeof value !== 'number')
+                    return null;
+                const timestamp = Number(value);
+                return Number.isFinite(timestamp) ? timestamp : null;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const result = yield options.client.eval("return redis.call('PING')", 0);
+                    return String(result).toUpperCase() === 'PONG';
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+    };
+}
+const defaultMemoryStore = createMemorySessionRevocationStore();
+/** Store di default in memoria, usato quando `sessionRevocation.store` non e configurato ma la revoca e abilitata. */
+function getSessionRevocationStore(options) {
+    var _a, _b, _c;
+    if (((_a = options.sessionRevocation) === null || _a === void 0 ? void 0 : _a.enabled) === false)
+        return undefined;
+    if ((_b = options.sessionRevocation) === null || _b === void 0 ? void 0 : _b.store)
+        return options.sessionRevocation.store;
+    return ((_c = options.sessionRevocation) === null || _c === void 0 ? void 0 : _c.enabled) === true ? defaultMemoryStore : undefined;
+}
+/** True se il token e stato emesso prima dell'ultima revoca sessioni dell'utente. */
+function isAccessiTokenRevoked(options, payload, codiceUtente) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const store = getSessionRevocationStore(options);
+        if (!store)
+            return false;
+        const issuedAt = Number(payload.iat);
+        if (!Number.isFinite(issuedAt))
+            return true;
+        const revokedAt = yield store.getUserRevocation(codiceUtente);
+        if (revokedAt === null)
+            return false;
+        return issuedAt < Math.floor(revokedAt / 1000);
+    });
+}
+/** Revoca tutte le sessioni dell'utente. Richiede uno store configurato. */
+function revokeAccessiUserSessions(options_1, codiceUtente_1) {
+    return __awaiter(this, arguments, void 0, function* (options, codiceUtente, revokedAtMs = Date.now()) {
+        const store = getSessionRevocationStore(options);
+        if (!store) {
+            throw new Error('Session revocation store non configurato.');
+        }
+        yield store.revokeUser(codiceUtente, revokedAtMs);
+    });
+}
+/** Solo per test: azzera lo store in memoria di default. */
+function clearDefaultSessionRevocations() {
+    defaultMemoryStore.clear();
+}
+//# sourceMappingURL=sessionRevocation.js.map

package/dist/accessi-module/security/sessionRevocation.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"sessionRevocation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/sessionRevocation.ts"],"names":[],"mappings":";;;;;;;;;;;AAkCA,gFAgBC;AAoBD,8EAyCC;AAKD,8DAIC;AAGD,sDAeC;AAGD,8DAUC;AAGD,wEAEC;AA9HD,MAAM,kBAAkB,GACtB,6IAA6I,CAAC;AAChJ,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,SAAgB,kCAAkC;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,OAAO;QACC,UAAU,CAAC,YAAY,EAAE,SAAS;;gBACtC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACzC,CAAC;SAAA;QACK,iBAAiB,CAAC,YAAY;;;gBAClC,OAAO,MAAA,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,mCAAI,IAAI,CAAC;YAC7C,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACD,KAAK;YACH,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAcD;;;;;GAKG;AACH,SAAgB,iCAAiC,CAC/C,OAA2C;;IAE3C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAElF,OAAO;QACC,UAAU,CAAC,YAAY,EAAE,WAAW;;gBACxC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACvB,kBAAkB,EAClB,CAAC,EACD,GAAG,SAAS,GAAG,YAAY,EAAE,EAC7B,MAAM,CAAC,WAAW,CAAC,EACnB,KAAK,CACN,CAAC;YACJ,CAAC;SAAA;QAEK,iBAAiB,CAAC,YAAY;;gBAClC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACrC,eAAe,EACf,CAAC,EACD,GAAG,SAAS,GAAG,YAAY,EAAE,CAC9B,CAAC;gBACF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBACxE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,CAAC;SAAA;QAEK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,kCAAkC,EAAE,CAAC;AAEhE,sHAAsH;AACtH,SAAgB,yBAAyB,CAAC,OAAuB;;IAC/D,IAAI,CAAA,MAAA,OAAO,CAAC,iBAAiB,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,MAAA,OAAO,CAAC,iBAAiB,0CAAE,KAAK;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;IAC7E,OAAO,CAAA,MAAA,OAAO,CAAC,iBAAiB,0CAAE,OAAO,MAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED,qFAAqF;AACrF,SAAsB,qBAAqB,CACzC,OAAuB,EACvB,OAAgC,EAChC,YAAoB;;QAEpB,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAErC,OAAO,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACjD,CAAC;CAAA;AAED,4EAA4E;AAC5E,SAAsB,yBAAyB;yDAC7C,OAAuB,EACvB,YAAoB,EACpB,cAAsB,IAAI,CAAC,GAAG,EAAE;QAEhC,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACpD,CAAC;CAAA;AAED,4DAA4D;AAC5D,SAAgB,8BAA8B;IAC5C,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\n\n/**\n * Revoca delle sessioni per utente.\n *\n * La revoca e un timestamp: un token con `iat` precedente al cutoff viene\n * rifiutato. I token emessi dopo il cutoff restano validi. La granularita di\n * `iat` e in secondi, quindi un token emesso nello stesso secondo della revoca\n * puo sopravvivere: e una finestra massima di 1 secondo.\n */\nexport interface SessionRevocationStore {\n revokeUser(codiceUtente: number, revokedAtMs: number): Promise<void>;\n getUserRevocation(codiceUtente: number): Promise<number | null>;\n /** Health check opzionale per readiness del servizio. */\n healthCheck?(): Promise<boolean>;\n}\n\nexport interface SessionRevocationOptions {\n /** Default: disabilitata se non viene fornito uno store. */\n enabled?: boolean;\n /** Store condiviso (es. Redis) per invalidare le sessioni tra istanze. */\n store?: SessionRevocationStore;\n /** TTL delle chiavi Redis. Default: 365 giorni. */\n ttlMs?: number;\n}\n\nexport interface MemorySessionRevocationStore extends SessionRevocationStore {\n clear(): void;\n}\n\nconst REVOKE_USER_SCRIPT =\n \"if tonumber(ARGV[2]) > 0 then return redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2]) else return redis.call('SET', KEYS[1], ARGV[1]) end\";\nconst GET_USER_SCRIPT = \"return redis.call('GET', KEYS[1])\";\n\nexport function createMemorySessionRevocationStore(): MemorySessionRevocationStore {\n const revokedAt = new Map<number, number>();\n return {\n async revokeUser(codiceUtente, timestamp) {\n revokedAt.set(codiceUtente, timestamp);\n },\n async getUserRevocation(codiceUtente) {\n return revokedAt.get(codiceUtente) ?? null;\n },\n async healthCheck() {\n return true;\n },\n clear() {\n revokedAt.clear();\n },\n };\n}\n\nexport interface SessionRevocationRedisClient {\n eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisSessionRevocationStoreOptions {\n client: SessionRevocationRedisClient;\n /** Default: `accessi:revoked-user:`. */\n keyPrefix?: string;\n /** Default: 365 giorni. */\n ttlMs?: number;\n}\n\n/**\n * Store Redis per la revoca sessioni.\n *\n * `revokeUser` scrive un timestamp con TTL; `getUserRevocation` lo legge.\n * Il TTL deve essere maggiore della durata massima dei token.\n */\nexport function createRedisSessionRevocationStore(\n options: RedisSessionRevocationStoreOptions,\n): SessionRevocationStore {\n if (!options?.client || typeof options.client.eval !== 'function') {\n throw new Error('Redis session revocation store: client.eval non configurato.');\n }\n\n const keyPrefix = (options.keyPrefix ?? 'accessi:revoked-user:').replace(/:+$/, ':');\n const ttlMs = Math.max(0, Math.trunc(options.ttlMs ?? 365 * 24 * 60 * 60 * 1000));\n\n return {\n async revokeUser(codiceUtente, revokedAtMs) {\n await options.client.eval(\n REVOKE_USER_SCRIPT,\n 1,\n `${keyPrefix}${codiceUtente}`,\n String(revokedAtMs),\n ttlMs,\n );\n },\n\n async getUserRevocation(codiceUtente) {\n const value = await options.client.eval(\n GET_USER_SCRIPT,\n 1,\n `${keyPrefix}${codiceUtente}`,\n );\n if (typeof value !== 'string' && typeof value !== 'number') return null;\n const timestamp = Number(value);\n return Number.isFinite(timestamp) ? timestamp : null;\n },\n\n async healthCheck() {\n try {\n const result = await options.client.eval(\"return redis.call('PING')\", 0);\n return String(result).toUpperCase() === 'PONG';\n } catch {\n return false;\n }\n },\n };\n}\n\nconst defaultMemoryStore = createMemorySessionRevocationStore();\n\n/** Store di default in memoria, usato quando `sessionRevocation.store` non e configurato ma la revoca e abilitata. */\nexport function getSessionRevocationStore(options: AccessiOptions): SessionRevocationStore | undefined {\n if (options.sessionRevocation?.enabled === false) return undefined;\n if (options.sessionRevocation?.store) return options.sessionRevocation.store;\n return options.sessionRevocation?.enabled === true ? defaultMemoryStore : undefined;\n}\n\n/** True se il token e stato emesso prima dell'ultima revoca sessioni dell'utente. */\nexport async function isAccessiTokenRevoked(\n options: AccessiOptions,\n payload: Record<string, unknown>,\n codiceUtente: number,\n): Promise<boolean> {\n const store = getSessionRevocationStore(options);\n if (!store) return false;\n\n const issuedAt = Number(payload.iat);\n if (!Number.isFinite(issuedAt)) return true;\n\n const revokedAt = await store.getUserRevocation(codiceUtente);\n if (revokedAt === null) return false;\n\n return issuedAt < Math.floor(revokedAt / 1000);\n}\n\n/** Revoca tutte le sessioni dell'utente. Richiede uno store configurato. */\nexport async function revokeAccessiUserSessions(\n options: AccessiOptions,\n codiceUtente: number,\n revokedAtMs: number = Date.now(),\n): Promise<void> {\n const store = getSessionRevocationStore(options);\n if (!store) {\n throw new Error('Session revocation store non configurato.');\n }\n await store.revokeUser(codiceUtente, revokedAtMs);\n}\n\n/** Solo per test: azzera lo store in memoria di default. */\nexport function clearDefaultSessionRevocations(): void {\n defaultMemoryStore.clear();\n}\n"]}

package/dist/accessi-module/security/validateOptions.d.ts ADDED Viewed

@@ -0,0 +1,19 @@
+import type { AccessiOptions } from '../AccessiModule';
+export interface AccessiOptionsValidationIssue {
+    code: string;
+    message: string;
+}
+export interface AccessiOptionsValidationResult {
+    errors: AccessiOptionsValidationIssue[];
+    warnings: AccessiOptionsValidationIssue[];
+}
+/**
+ * Validazione fail-fast della configurazione Accessi.
+ *
+ * `createAccessiService` usa `assertValidAccessiOptions`; i bootstrap esistenti
+ * possono usare `validateAccessiOptions` per loggare warning senza rompere il
+ * comportamento storico.
+ */
+export declare function validateAccessiOptions(options: AccessiOptions): AccessiOptionsValidationResult;
+/** Lancia un errore aggregato se la configurazione non e valida. */
+export declare function assertValidAccessiOptions(options: AccessiOptions): void;

package/dist/accessi-module/security/validateOptions.js ADDED Viewed

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAccessiOptions = validateAccessiOptions;
+exports.assertValidAccessiOptions = assertValidAccessiOptions;
+function isHttpUrl(value) {
+    if (!value)
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:';
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function positive(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0;
+}
+/**
+ * Validazione fail-fast della configurazione Accessi.
+ *
+ * `createAccessiService` usa `assertValidAccessiOptions`; i bootstrap esistenti
+ * possono usare `validateAccessiOptions` per loggare warning senza rompere il
+ * comportamento storico.
+ */
+function validateAccessiOptions(options) {
+    var _a, _b, _c, _d;
+    const errors = [];
+    const warnings = [];
+    const addError = (code, message) => errors.push({ code, message });
+    const addWarning = (code, message) => warnings.push({ code, message });
+    if (!(options === null || options === void 0 ? void 0 : options.databaseOptions)) {
+        addError('ACCESSI_DB_OPTIONS_MISSING', 'databaseOptions e obbligatorio.');
+    }
+    const jwt = options === null || options === void 0 ? void 0 : options.jwtOptions;
+    const secret = (jwt === null || jwt === void 0 ? void 0 : jwt.secret) || process.env.ACC_JWT_SECRET;
+    if (!secret) {
+        addError('ACCESSI_JWT_SECRET_MISSING', 'jwtOptions.secret e obbligatorio.');
+    }
+    else if (secret.length < 32) {
+        addWarning('ACCESSI_JWT_SECRET_WEAK', 'jwtOptions.secret dovrebbe avere almeno 32 caratteri.');
+    }
+    if (!(jwt === null || jwt === void 0 ? void 0 : jwt.expiresIn)) {
+        addError('ACCESSI_JWT_EXPIRES_MISSING', 'jwtOptions.expiresIn e obbligatorio.');
+    }
+    const algorithm = (_a = jwt === null || jwt === void 0 ? void 0 : jwt.algorithm) !== null && _a !== void 0 ? _a : 'HS256';
+    if (algorithm.startsWith('HS')) {
+        if ((jwt === null || jwt === void 0 ? void 0 : jwt.privateKey) || (jwt === null || jwt === void 0 ? void 0 : jwt.publicKey)) {
+            addWarning('ACCESSI_JWT_ASYMMETRIC_KEYS_WITH_HMAC', 'Sono configurate chiavi asimmetriche ma algorithm e HS256: verranno ignorate.');
+        }
+    }
+    else {
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.privateKey)) {
+            addError('ACCESSI_JWT_PRIVATE_KEY_MISSING', `jwtOptions.privateKey e obbligatoria per ${algorithm}.`);
+        }
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.publicKey) && !(jwt === null || jwt === void 0 ? void 0 : jwt.privateKey)) {
+            addError('ACCESSI_JWT_PUBLIC_KEY_MISSING', `jwtOptions.publicKey e obbligatoria per ${algorithm}.`);
+        }
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.keyId)) {
+            addWarning('ACCESSI_JWT_KEY_ID_MISSING', 'jwtOptions.keyId e consigliato per la rotazione JWKS.');
+        }
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.jwksPath)) {
+            addWarning('ACCESSI_JWKS_PATH_DEFAULT', 'jwksPath non configurato: verra usato accessi/.well-known/jwks.json.');
+        }
+    }
+    if (!(jwt === null || jwt === void 0 ? void 0 : jwt.issuer)) {
+        addWarning('ACCESSI_JWT_ISSUER_MISSING', 'jwtOptions.issuer e consigliato in multi-servizio.');
+    }
+    if (!(jwt === null || jwt === void 0 ? void 0 : jwt.audience)) {
+        addWarning('ACCESSI_JWT_AUDIENCE_MISSING', 'jwtOptions.audience e consigliato in multi-servizio.');
+    }
+    if (!(options === null || options === void 0 ? void 0 : options.encryptionKey)) {
+        addError('ACCESSI_ENCRYPTION_KEY_MISSING', 'encryptionKey e obbligatoria.');
+    }
+    else if (options.encryptionKey.length < 16) {
+        addWarning('ACCESSI_ENCRYPTION_KEY_WEAK', 'encryptionKey dovrebbe avere almeno 16 caratteri.');
+    }
+    if (!isHttpUrl(options === null || options === void 0 ? void 0 : options.confirmationEmailUrl)) {
+        addWarning('ACCESSI_CONFIRMATION_URL_INVALID', 'confirmationEmailUrl dovrebbe essere un URL http/https.');
+    }
+    if (!isHttpUrl(options === null || options === void 0 ? void 0 : options.confirmationEmailReturnUrl)) {
+        addWarning('ACCESSI_CONFIRMATION_RETURN_URL_INVALID', 'confirmationEmailReturnUrl dovrebbe essere un URL http/https.');
+    }
+    if ((options === null || options === void 0 ? void 0 : options.publicBaseUrl) && !isHttpUrl(options.publicBaseUrl)) {
+        addWarning('ACCESSI_PUBLIC_BASE_URL_INVALID', 'publicBaseUrl dovrebbe essere un URL http/https.');
+    }
+    if (((_b = options === null || options === void 0 ? void 0 : options.publicAuthRateLimit) === null || _b === void 0 ? void 0 : _b.login) && !positive(options.publicAuthRateLimit.login.windowMs)) {
+        addError('ACCESSI_RATE_LIMIT_WINDOW_INVALID', 'publicAuthRateLimit.login.windowMs deve essere positivo.');
+    }
+    if (((_c = options === null || options === void 0 ? void 0 : options.publicAuthRateLimit) === null || _c === void 0 ? void 0 : _c.login) && !positive(options.publicAuthRateLimit.login.maxAttempts)) {
+        addError('ACCESSI_RATE_LIMIT_ATTEMPTS_INVALID', 'publicAuthRateLimit.login.maxAttempts deve essere positivo.');
+    }
+    if (options === null || options === void 0 ? void 0 : options.edgeRateLimit) {
+        if (options.edgeRateLimit.windowMs !== undefined && !positive(options.edgeRateLimit.windowMs)) {
+            addError('ACCESSI_EDGE_RATE_LIMIT_WINDOW_INVALID', 'edgeRateLimit.windowMs deve essere positivo.');
+        }
+        if (options.edgeRateLimit.maxAttempts !== undefined && !positive(options.edgeRateLimit.maxAttempts)) {
+            addError('ACCESSI_EDGE_RATE_LIMIT_ATTEMPTS_INVALID', 'edgeRateLimit.maxAttempts deve essere positivo.');
+        }
+    }
+    if (((_d = options === null || options === void 0 ? void 0 : options.consoleEntry) === null || _d === void 0 ? void 0 : _d.ttlMs) !== undefined && !positive(options.consoleEntry.ttlMs)) {
+        addError('ACCESSI_CONSOLE_ENTRY_TTL_INVALID', 'consoleEntry.ttlMs deve essere positivo.');
+    }
+    return { errors, warnings };
+}
+/** Lancia un errore aggregato se la configurazione non e valida. */
+function assertValidAccessiOptions(options) {
+    const result = validateAccessiOptions(options);
+    if (result.errors.length === 0)
+        return;
+    throw new Error(`Configurazione Accessi non valida:\n${result.errors
+        .map((issue) => `- ${issue.code}: ${issue.message}`)
+        .join('\n')}`);
+}
+//# sourceMappingURL=validateOptions.js.map

package/dist/accessi-module/security/validateOptions.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"validateOptions.js","sourceRoot":"","sources":["../../../src/accessi-module/security/validateOptions.ts"],"names":[],"mappings":";;AAiCA,wDA2FC;AAGD,8DAQC;AA3HD,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC/D,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,OAAuB;;IAC5D,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAoC,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAEvF,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe,CAAA,EAAE,CAAC;QAC9B,QAAQ,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,CAAC;IAChC,MAAM,MAAM,GAAG,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,EAAE,mCAAmC,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC9B,UAAU,CAAC,yBAAyB,EAAE,uDAAuD,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,EAAE,CAAC;QACpB,QAAQ,CAAC,6BAA6B,EAAE,sCAAsC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,mCAAI,OAAO,CAAC;IAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,MAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,EAAE,CAAC;YACtC,UAAU,CACR,uCAAuC,EACvC,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAA,EAAE,CAAC;YACrB,QAAQ,CAAC,iCAAiC,EAAE,4CAA4C,SAAS,GAAG,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAA,EAAE,CAAC;YACxC,QAAQ,CAAC,gCAAgC,EAAE,2CAA2C,SAAS,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,KAAK,CAAA,EAAE,CAAC;YAChB,UAAU,CAAC,4BAA4B,EAAE,uDAAuD,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,CAAA,EAAE,CAAC;YACnB,UAAU,CACR,2BAA2B,EAC3B,sEAAsE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,EAAE,CAAC;QACjB,UAAU,CAAC,4BAA4B,EAAE,oDAAoD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,CAAA,EAAE,CAAC;QACnB,UAAU,CAAC,8BAA8B,EAAE,sDAAsD,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,CAAA,EAAE,CAAC;QAC5B,QAAQ,CAAC,gCAAgC,EAAE,+BAA+B,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7C,UAAU,CAAC,6BAA6B,EAAE,mDAAmD,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9C,UAAU,CAAC,kCAAkC,EAAE,yDAAyD,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0BAA0B,CAAC,EAAE,CAAC;QACpD,UAAU,CAAC,yCAAyC,EAAE,+DAA+D,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,KAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,UAAU,CAAC,iCAAiC,EAAE,kDAAkD,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,mBAAmB,0CAAE,KAAK,KAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjG,QAAQ,CAAC,mCAAmC,EAAE,0DAA0D,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,mBAAmB,0CAAE,KAAK,KAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACpG,QAAQ,CAAC,qCAAqC,EAAE,6DAA6D,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9F,QAAQ,CAAC,wCAAwC,EAAE,8CAA8C,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACpG,QAAQ,CAAC,0CAA0C,EAAE,iDAAiD,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,0CAAE,KAAK,MAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,QAAQ,CAAC,mCAAmC,EAAE,0CAA0C,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,SAAgB,yBAAyB,CAAC,OAAuB;IAC/D,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;AACJ,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\n\nexport interface AccessiOptionsValidationIssue {\n code: string;\n message: string;\n}\n\nexport interface AccessiOptionsValidationResult {\n errors: AccessiOptionsValidationIssue[];\n warnings: AccessiOptionsValidationIssue[];\n}\n\nfunction isHttpUrl(value: string | undefined): boolean {\n if (!value) return false;\n try {\n const url = new URL(value);\n return url.protocol === 'http:' || url.protocol === 'https:';\n } catch {\n return false;\n }\n}\n\nfunction positive(value: number | undefined): boolean {\n return typeof value === 'number' && Number.isFinite(value) && value > 0;\n}\n\n/**\n * Validazione fail-fast della configurazione Accessi.\n *\n * `createAccessiService` usa `assertValidAccessiOptions`; i bootstrap esistenti\n * possono usare `validateAccessiOptions` per loggare warning senza rompere il\n * comportamento storico.\n */\nexport function validateAccessiOptions(options: AccessiOptions): AccessiOptionsValidationResult {\n const errors: AccessiOptionsValidationIssue[] = [];\n const warnings: AccessiOptionsValidationIssue[] = [];\n\n const addError = (code: string, message: string) => errors.push({ code, message });\n const addWarning = (code: string, message: string) => warnings.push({ code, message });\n\n if (!options?.databaseOptions) {\n addError('ACCESSI_DB_OPTIONS_MISSING', 'databaseOptions e obbligatorio.');\n }\n\n const jwt = options?.jwtOptions;\n const secret = jwt?.secret || process.env.ACC_JWT_SECRET;\n if (!secret) {\n addError('ACCESSI_JWT_SECRET_MISSING', 'jwtOptions.secret e obbligatorio.');\n } else if (secret.length < 32) {\n addWarning('ACCESSI_JWT_SECRET_WEAK', 'jwtOptions.secret dovrebbe avere almeno 32 caratteri.');\n }\n\n if (!jwt?.expiresIn) {\n addError('ACCESSI_JWT_EXPIRES_MISSING', 'jwtOptions.expiresIn e obbligatorio.');\n }\n\n const algorithm = jwt?.algorithm ?? 'HS256';\n if (algorithm.startsWith('HS')) {\n if (jwt?.privateKey || jwt?.publicKey) {\n addWarning(\n 'ACCESSI_JWT_ASYMMETRIC_KEYS_WITH_HMAC',\n 'Sono configurate chiavi asimmetriche ma algorithm e HS256: verranno ignorate.',\n );\n }\n } else {\n if (!jwt?.privateKey) {\n addError('ACCESSI_JWT_PRIVATE_KEY_MISSING', `jwtOptions.privateKey e obbligatoria per ${algorithm}.`);\n }\n if (!jwt?.publicKey && !jwt?.privateKey) {\n addError('ACCESSI_JWT_PUBLIC_KEY_MISSING', `jwtOptions.publicKey e obbligatoria per ${algorithm}.`);\n }\n if (!jwt?.keyId) {\n addWarning('ACCESSI_JWT_KEY_ID_MISSING', 'jwtOptions.keyId e consigliato per la rotazione JWKS.');\n }\n if (!jwt?.jwksPath) {\n addWarning(\n 'ACCESSI_JWKS_PATH_DEFAULT',\n 'jwksPath non configurato: verra usato accessi/.well-known/jwks.json.',\n );\n }\n }\n\n if (!jwt?.issuer) {\n addWarning('ACCESSI_JWT_ISSUER_MISSING', 'jwtOptions.issuer e consigliato in multi-servizio.');\n }\n if (!jwt?.audience) {\n addWarning('ACCESSI_JWT_AUDIENCE_MISSING', 'jwtOptions.audience e consigliato in multi-servizio.');\n }\n\n if (!options?.encryptionKey) {\n addError('ACCESSI_ENCRYPTION_KEY_MISSING', 'encryptionKey e obbligatoria.');\n } else if (options.encryptionKey.length < 16) {\n addWarning('ACCESSI_ENCRYPTION_KEY_WEAK', 'encryptionKey dovrebbe avere almeno 16 caratteri.');\n }\n\n if (!isHttpUrl(options?.confirmationEmailUrl)) {\n addWarning('ACCESSI_CONFIRMATION_URL_INVALID', 'confirmationEmailUrl dovrebbe essere un URL http/https.');\n }\n if (!isHttpUrl(options?.confirmationEmailReturnUrl)) {\n addWarning('ACCESSI_CONFIRMATION_RETURN_URL_INVALID', 'confirmationEmailReturnUrl dovrebbe essere un URL http/https.');\n }\n if (options?.publicBaseUrl && !isHttpUrl(options.publicBaseUrl)) {\n addWarning('ACCESSI_PUBLIC_BASE_URL_INVALID', 'publicBaseUrl dovrebbe essere un URL http/https.');\n }\n\n if (options?.publicAuthRateLimit?.login && !positive(options.publicAuthRateLimit.login.windowMs)) {\n addError('ACCESSI_RATE_LIMIT_WINDOW_INVALID', 'publicAuthRateLimit.login.windowMs deve essere positivo.');\n }\n if (options?.publicAuthRateLimit?.login && !positive(options.publicAuthRateLimit.login.maxAttempts)) {\n addError('ACCESSI_RATE_LIMIT_ATTEMPTS_INVALID', 'publicAuthRateLimit.login.maxAttempts deve essere positivo.');\n }\n if (options?.edgeRateLimit) {\n if (options.edgeRateLimit.windowMs !== undefined && !positive(options.edgeRateLimit.windowMs)) {\n addError('ACCESSI_EDGE_RATE_LIMIT_WINDOW_INVALID', 'edgeRateLimit.windowMs deve essere positivo.');\n }\n if (options.edgeRateLimit.maxAttempts !== undefined && !positive(options.edgeRateLimit.maxAttempts)) {\n addError('ACCESSI_EDGE_RATE_LIMIT_ATTEMPTS_INVALID', 'edgeRateLimit.maxAttempts deve essere positivo.');\n }\n }\n if (options?.consoleEntry?.ttlMs !== undefined && !positive(options.consoleEntry.ttlMs)) {\n addError('ACCESSI_CONSOLE_ENTRY_TTL_INVALID', 'consoleEntry.ttlMs deve essere positivo.');\n }\n\n return { errors, warnings };\n}\n\n/** Lancia un errore aggregato se la configurazione non e valida. */\nexport function assertValidAccessiOptions(options: AccessiOptions): void {\n const result = validateAccessiOptions(options);\n if (result.errors.length === 0) return;\n throw new Error(\n `Configurazione Accessi non valida:\\n${result.errors\n .map((issue) => `- ${issue.code}: ${issue.message}`)\n .join('\\n')}`,\n );\n}\n"]}

package/dist/emilsoftware-utilities-2.0.0-dev.69.tgz ADDED Viewed

Binary file

package/dist/initEmilsoftwareModule.js CHANGED Viewed

@@ -34,7 +34,7 @@ const edgeRateLimit_1 = require("./accessi-module/security/edgeRateLimit");
  */
 function initEmilsoftwareModule(app, options) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
         const logger = new Logger_1.Logger(initEmilsoftwareModule.name);
         if (options === null || options === void 0 ? void 0 : options.accessiOptions) {
             (0, authenticateGen_1.beginAccessiAuthInitialization)();
@@ -48,6 +48,10 @@ function initEmilsoftwareModule(app, options) {
             // Precedenza: EmilsoftwareOptions.openapi > AccessiOptions.openapi > default.
             const resolvedOpenApi = (0, OpenApiConfig_1.resolveAccessiOpenApiOptions)((_a = options === null || options === void 0 ? void 0 : options.accessiOptions) === null || _a === void 0 ? void 0 : _a.openapi, options === null || options === void 0 ? void 0 : options.openapi);
             const nestHostApp = (0, express_1.default)();
+            if (((_c = (_b = options === null || options === void 0 ? void 0 : options.accessiOptions) === null || _b === void 0 ? void 0 : _b.http) === null || _c === void 0 ? void 0 : _c.trustProxy) !== undefined) {
+                app.set('trust proxy', options.accessiOptions.http.trustProxy);
+                nestHostApp.set('trust proxy', options.accessiOptions.http.trustProxy);
+            }
             const jwksPath = (options === null || options === void 0 ? void 0 : options.accessiOptions)
                 ? (0, jwks_1.getAccessiJwksPath)(options.accessiOptions)
                 : undefined;
@@ -55,12 +59,24 @@ function initEmilsoftwareModule(app, options) {
                 path.startsWith("/api/") ||
                 (0, OpenApiConfig_1.isOpenApiRequestPath)(path, resolvedOpenApi) ||
                 (jwksPath !== undefined && path === jwksPath);
-            const edgeRateLimit = ((_b = options === null || options === void 0 ? void 0 : options.accessiOptions) === null || _b === void 0 ? void 0 : _b.edgeRateLimit)
-                ? (0, edgeRateLimit_1.createAccessiEdgeRateLimitMiddleware)(Object.assign(Object.assign({}, options.accessiOptions.edgeRateLimit), { match: (_c = options.accessiOptions.edgeRateLimit.match) !== null && _c !== void 0 ? _c : ((path) => isNestRoute(path)) }))
+            const edgeRateLimit = ((_d = options === null || options === void 0 ? void 0 : options.accessiOptions) === null || _d === void 0 ? void 0 : _d.edgeRateLimit)
+                ? (0, edgeRateLimit_1.createAccessiEdgeRateLimitMiddleware)(Object.assign(Object.assign({}, options.accessiOptions.edgeRateLimit), { match: (_e = options.accessiOptions.edgeRateLimit.match) !== null && _e !== void 0 ? _e : ((path) => isNestRoute(path)) }))
                 : undefined;
             if (edgeRateLimit) {
                 app.use(edgeRateLimit);
             }
+            if (((_g = (_f = options === null || options === void 0 ? void 0 : options.accessiOptions) === null || _f === void 0 ? void 0 : _f.http) === null || _g === void 0 ? void 0 : _g.securityHeaders) !== false) {
+                app.use((req, res, next) => {
+                    if (!isNestRoute(req.path)) {
+                        return next();
+                    }
+                    res.setHeader('X-Content-Type-Options', 'nosniff');
+                    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+                    res.setHeader('Referrer-Policy', 'no-referrer');
+                    res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
+                    return next();
+                });
+            }
             app.use((req, res, next) => {
                 if (!isNestRoute(req.path)) {
                     return next();
@@ -75,7 +91,9 @@ function initEmilsoftwareModule(app, options) {
             }
             const nestExpressInstance = new platform_express_1.ExpressAdapter(nestHostApp);
             const nestApp = yield core_1.NestFactory.create(EmilsoftwareModule_1.EmilsoftwareModule.forRoot(options), nestExpressInstance, Object.assign({ bufferLogs: (options === null || options === void 0 ? void 0 : options.bufferLogs) !== false }, ((options === null || options === void 0 ? void 0 : options.logger) ? { logger: options.logger } : {})));
-            nestApp.enableCors();
+            if (((_j = (_h = options === null || options === void 0 ? void 0 : options.accessiOptions) === null || _h === void 0 ? void 0 : _h.http) === null || _j === void 0 ? void 0 : _j.cors) !== false) {
+                nestApp.enableCors((_l = (_k = options === null || options === void 0 ? void 0 : options.accessiOptions) === null || _k === void 0 ? void 0 : _k.http) === null || _l === void 0 ? void 0 : _l.cors);
+            }
             if (options === null || options === void 0 ? void 0 : options.accessiOptions) {
                 // Keep the Accessi API contract identical for standalone and unified bootstraps.
                 nestApp.useGlobalPipes((0, accessiValidation_1.createAccessiValidationPipe)());