npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.68 → 2.0.0-dev.69 - Mend

emilsoftware-utilities 2.0.0-dev.68 → 2.0.0-dev.69

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (132) hide show

package/dist/accessi-module/Controllers/AuthController.js CHANGED Viewed

@@ -26,11 +26,15 @@ exports.AuthController = void 0;
 const common_1 = require("@nestjs/common");
 const TwoFactorDtos_1 = require("../Dtos/TwoFactorDtos");
 const swagger_1 = require("@nestjs/swagger");
+const crypto_1 = require("crypto");
 const Logger_1 = require("../../Logger");
 const Utilities_1 = require("../../Utilities");
 const Dtos_1 = require("../Dtos");
 const AuthService_1 = require("../Services/AuthService/AuthService");
 const AdminBootstrapService_1 = require("../Services/AdminBootstrapService/AdminBootstrapService");
+const jwt_strategy_1 = require("../jwt/jwt.strategy");
+const accessControl_1 = require("../security/accessControl");
+const sessionRevocation_1 = require("../security/sessionRevocation");
 const publicAuthRateLimit_1 = require("../security/publicAuthRateLimit");
 let AuthController = AuthController_1 = class AuthController {
     constructor(authService, adminBootstrapService, options) {
@@ -78,6 +82,24 @@ let AuthController = AuthController_1 = class AuthController {
             }
         });
     }
+    revokeSessions(request, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const user = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                if (!(0, sessionRevocation_1.getSessionRevocationStore)(this.options)) {
+                    throw new common_1.HttpException({
+                        code: 'ACCESSI_SESSION_REVOCATION_DISABLED',
+                        message: 'La revoca sessioni non e configurata su questa istanza.',
+                    }, common_1.HttpStatus.NOT_IMPLEMENTED);
+                }
+                yield (0, sessionRevocation_1.revokeAccessiUserSessions)(this.options, user.codiceUtente);
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Sessioni revocate con successo.');
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.BAD_REQUEST);
+            }
+        });
+    }
     login(request, loginRequest, res) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
@@ -89,8 +111,12 @@ let AuthController = AuthController_1 = class AuthController {
                 if (!userData) {
                     return Utilities_1.RestUtilities.sendInvalidCredentials(res);
                 }
-                if (!userData.challenge && !userData.passwordRequired)
-                    userData.token = this.authService.createAccessiToken(userData.utente, ['password']);
+                if (!userData.challenge && !userData.passwordRequired) {
+                    const tokens = this.authService.createTokenPair(userData.utente, ['password']);
+                    userData.token = tokens.access;
+                    if (tokens.refresh)
+                        userData.refreshToken = tokens.refresh;
+                }
                 return Utilities_1.RestUtilities.sendBaseResponse(res, userData);
             }
             catch (error) {
@@ -117,6 +143,27 @@ let AuthController = AuthController_1 = class AuthController {
             }
         });
     }
+    refresh(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const tokenKey = typeof (body === null || body === void 0 ? void 0 : body.refreshToken) === 'string'
+                    ? (0, crypto_1.createHash)('sha256').update(body.refreshToken).digest('hex').slice(0, 32)
+                    : undefined;
+                const decision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'refresh', request, tokenKey ? [tokenKey] : []);
+                if (!decision.allowed) {
+                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, decision.retryAfterSeconds);
+                }
+                const result = yield this.authService.refreshAccessToken(body === null || body === void 0 ? void 0 : body.refreshToken);
+                if (!result.token) {
+                    throw new common_1.HttpException('Refresh token non valido.', common_1.HttpStatus.UNAUTHORIZED);
+                }
+                return Utilities_1.RestUtilities.sendBaseResponse(res, Object.assign({ token: result.token }, (result.refreshToken ? { refreshToken: result.refreshToken } : {})));
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.UNAUTHORIZED);
+            }
+        });
+    }
     verifyTwoFactor(request, body, res) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
@@ -210,6 +257,23 @@ __decorate([
     __metadata("design:paramtypes", [Object, Dtos_1.GetUserByTokenRequest, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "getUserByToken", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Revoca tutte le sessioni dell utente corrente',
+        operationId: 'revokeSessions',
+        description: 'Invalida i token emessi prima di questa chiamata. Richiede sessionRevocation.store configurato. I token emessi dopo la revoca restano validi.',
+    }),
+    (0, swagger_1.ApiOkResponse)({ type: Dtos_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse, description: 'Token Accessi mancante o non valido.' }),
+    (0, swagger_1.ApiResponse)({ status: 501, type: Dtos_1.ErrorResponse, description: 'Revoca sessioni non configurata.' }),
+    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard),
+    (0, common_1.Post)('revoke-sessions'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "revokeSessions", null);
 __decorate([
     (0, swagger_1.ApiOperation)({
         summary: 'Effettua il login utente',
@@ -241,6 +305,24 @@ __decorate([
     __metadata("design:paramtypes", [Object, Dtos_1.LoginRequest, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "login", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Scambia un refresh token con un nuovo access token',
+        operationId: 'refreshAccessToken',
+        description: 'Richiede jwtOptions.refreshExpiresIn. Il refresh token ha typ=refresh e non e accettato dai guard API.',
+    }),
+    (0, swagger_1.ApiBody)({ type: Dtos_1.RefreshTokenRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: Dtos_1.RefreshTokenResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, description: 'Refresh token non valido, scaduto o revocato.', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 429, description: 'Troppi tentativi.', type: Dtos_1.ErrorResponse }),
+    (0, common_1.Post)('refresh'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Dtos_1.RefreshTokenRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "refresh", null);
 __decorate([
     (0, common_1.Post)('two-factor/verify'),
     (0, swagger_1.ApiOperation)({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' }),

package/dist/accessi-module/Controllers/AuthController.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAiH;AACjH,yDAAuF;AACvF,6CAAwF;AAExF,yCAAsC;AACtC,+CAAgD;AAEhD,kCAYiB;AACjB,qEAA2F;AAC3F,mGAAgG;AAChG,yEAGyC;AAQlC,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YACmB,WAAwB,EACxB,qBAA4C,EAClC,OAAwC;QAFlD,gBAAW,GAAX,WAAW,CAAa;QACxB,0BAAqB,GAArB,qBAAqB,CAAuB;QACjB,YAAO,GAAP,OAAO,CAAgB;QALrE,WAAM,GAAW,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAM9C,CAAC;IAgBE,aAAa,CACV,OAAgB,EAChB,GAAa,EACJ,KAAa,EACrB,IAAiC;;YAEzC,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,sBAAsB,EACtB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;KAAA;IAkBK,cAAc,CACX,OAAgB,EACf,IAA2B,EAC5B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,gBAAgB,EAChB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,EAAE,CAAC;oBACjB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,mBAAmB,EACnB,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7F,MAAM,QAAQ,GAAI,oBAA6C,aAA7C,oBAAoB,uBAApB,oBAAoB,CAA2B,MAAM,CAAC;gBACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;gBAED,2EAA2E;gBAC3E,sFAAsF;gBACtF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;KAAA;IA0BK,KAAK,CAAQ,OAAgB,EAAU,YAA0B,EAAS,GAAa;;YAC3F,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,OAAO,EACP,CAAC,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,CAAC,CACtB,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,gBAAgB;oBAAE,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAE3I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,kBAAkB,EAAE,CAAC;oBACrD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACnE,OAAO,yBAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,KAAK,YAAY,sBAAa,EAAE,CAAC;oBACnC,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5F,CAAC;gBAED,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,qCAAuB,EAAE,CAAC;oBAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;wBAC3C,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;wBAC9D,IAAI,EAAE,qCAAuB;wBAC7B,KAAK,EAAE,qCAAuB;wBAC9B,OAAO,EAAE,+EAA+E;qBACzF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBACpD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;gBACJ,CAAC;gBACD,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9H,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAeK,cAAc,CAAQ,OAAgB,EAAU,IAA2B,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBACtF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAUK,oBAAoB,CAAQ,GAAa;;YAC7C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAClG,CAAC;KAAA;CACF,CAAA;AAlPY,wCAAc;AAuBnB;IAdL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kCAA2B,EAAE,CAAC;IAC9C,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kCAAkC;QAC/C,IAAI,EAAE,qBAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,+BAA+B,CAAC;IAEnC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,aAAI,GAAE,CAAA;;6DAAO,kCAA2B;;mDAiB1C;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,gBAAgB;KAC9B,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAsB;KAC7B,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,4BAA4B;QACzC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IAEvB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,4BAAqB;;oDAkCpC;AA0BK;IAxBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,wOAAwO;QAC1O,WAAW,EAAE,OAAO;KACrB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,mBAAY,EAAE,CAAC;IAC/B,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,wBAAwB;QACrC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,8BAAuB;KAC9B,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC9F,IAAA,aAAI,EAAC,OAAO,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAApB,mBAAY;;2CAkDtE;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACnG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACzG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAeK;IAbL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,gBAAgB;QAC7B,WAAW,EACT,4FAA4F;YAC5F,mHAAmH;KACtH,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,6BAAsB,EAAE,CAAC;IAC1D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC7D,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA+B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA7B,4BAAqB;;oDAQhF;AAUK;IARL,IAAA,YAAG,EAAC,wBAAwB,CAAC;IAC7B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,yBAAyB;QACtC,WAAW,EACT,iGAAiG;KACpG,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mCAA4B,EAAE,CAAC;IACrC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;0DAEhC;yBAjPU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAOE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFI,yBAAW;QACD,6CAAqB;GALpD,cAAc,CAkP1B","sourcesContent":["import { Body, Controller, Get, HttpException, HttpStatus, Inject, Param, Post, Req, Res } from '@nestjs/common';\nimport { ResendTwoFactorRequest, VerifyTwoFactorRequest } from '../Dtos/TwoFactorDtos';\nimport { ApiBody, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n ActionResponse,\n AdminBootstrapStatusResponse,\n BootstrapAdminRequest,\n BootstrapAdminResponse,\n ConfirmResetPasswordRequest,\n ErrorResponse,\n GetUserByTokenRequest,\n GetUserByTokenResponse,\n LoginRequest,\n LoginResponse,\n PasswordExpiredResponse,\n} from '../Dtos';\nimport { AuthService, PASSWORD_LOGIN_DISABLED } from '../Services/AuthService/AuthService';\nimport { AdminBootstrapService } from '../Services/AdminBootstrapService/AdminBootstrapService';\nimport {\n checkPublicAuthRateLimit,\n sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n@ApiTags('Auth')\n@Controller('accessi/auth')\n/*\n Endpoint pubblici di autenticazione locale e verifica sessione.\n * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.\n */\nexport class AuthController {\n logger: Logger = new Logger(AuthController.name);\n\n constructor(\n private readonly authService: AuthService,\n private readonly adminBootstrapService: AdminBootstrapService,\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n ) {}\n\n @ApiOperation({ summary: 'Conferma il reset della password', operationId: 'resetPassword' })\n @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\n @ApiBody({ type: ConfirmResetPasswordRequest })\n @ApiResponse({\n status: 200,\n description: 'Password aggiornata con successo',\n type: ActionResponse,\n })\n @ApiResponse({\n status: 400,\n description: 'Errore nella richiesta o token non valido',\n type: ErrorResponse,\n })\n @Post('confirm-reset-password/:token')\n async resetPassword(\n @Req() request: Request,\n @Res() res: Response,\n @Param('token') token: string,\n @Body() body: ConfirmResetPasswordRequest,\n ) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'passwordResetConfirm',\n request,\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n await this.authService.confirmResetPassword(token, body.newPassword);\n return RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.BAD_REQUEST);\n }\n }\n\n @ApiOperation({\n summary: 'Recupera le informazioni utente dal token JWT',\n operationId: 'getUserByToken',\n })\n @ApiBody({ type: GetUserByTokenRequest })\n @ApiResponse({\n status: 200,\n description: 'Informazioni utente recuperate con successo',\n type: GetUserByTokenResponse,\n })\n @ApiResponse({\n status: 401,\n description: 'Token non valido o scaduto',\n type: ErrorResponse,\n })\n @Post('get-user-by-token')\n async getUserByToken(\n @Req() request: Request,\n @Body() body: GetUserByTokenRequest,\n @Res() res: Response,\n ) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'getUserByToken',\n request,\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n if (!body?.token) {\n return RestUtilities.sendErrorMessage(\n res,\n 'Token non fornito',\n AuthController.name,\n HttpStatus.BAD_REQUEST,\n );\n }\n\n const authenticatedPayload = await this.authService.getAuthenticatedTokenPayload(body.token);\n const userData = (authenticatedPayload as { utente?: unknown })?.utente;\n if (!userData) {\n throw new Error('Il token non contiene un utente Accessi valido.');\n }\n\n // Keep the runtime response aligned with GetUserByTokenResponse and Orval:\n // Result.userData contains the authenticated user directly, not a nested JWT payload.\n return RestUtilities.sendBaseResponse(res, { userData });\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.UNAUTHORIZED);\n }\n }\n\n @ApiOperation({\n summary: 'Effettua il login utente',\n description:\n \"Con sola email restituisce passwordRequired oppure avvia il codice per utenti passwordless. Con password valida restituisce il login completo o challenge se la 2FA e attiva. Nessun JWT viene emesso prima della verifica del codice.\",\n operationId: 'login',\n })\n @ApiBody({ type: LoginRequest })\n @ApiResponse({\n status: 200,\n description: 'Login effettuato con successo',\n type: LoginResponse,\n })\n @ApiResponse({\n status: 401,\n description: 'Credenziali non valide',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: 403,\n description: 'Password scaduta, e necessario aggiornarla.',\n type: PasswordExpiredResponse,\n })\n @ApiResponse({ status: 403, description: 'Utente abilitato solo a SSO.', type: ErrorResponse })\n @Post('login')\n async login(@Req() request: Request, @Body() loginRequest: LoginRequest, @Res() res: Response) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'login',\n request,\n [loginRequest?.email],\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n const userData = await this.authService.login(loginRequest);\n if (!userData) {\n return RestUtilities.sendInvalidCredentials(res);\n }\n\n if (!userData.challenge && !userData.passwordRequired) userData.token = this.authService.createAccessiToken(userData.utente, ['password']);\n\n return RestUtilities.sendBaseResponse(res, userData);\n } catch (error) {\n if ((error as Error)?.message === 'PASSWORD_EXPIRED') {\n this.logger.warning('Password scaduta, cambiare password ', error);\n return RestUtilities.sendPasswordExpired(res);\n }\n\n if (error instanceof HttpException) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error.getStatus());\n }\n\n if ((error as Error)?.message === PASSWORD_LOGIN_DISABLED) {\n return res.status(HttpStatus.FORBIDDEN).json({\n severity: 'error', status: HttpStatus.FORBIDDEN, statusCode: 2,\n code: PASSWORD_LOGIN_DISABLED,\n error: PASSWORD_LOGIN_DISABLED,\n message: 'Questo utente e abilitato solo tramite SSO. Accedi con un provider collegato.',\n });\n }\n\n this.logger.error('Errore durante il login', error);\n if (RestUtilities.isDatabaseSchemaError(error)) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n HttpStatus.SERVICE_UNAVAILABLE,\n );\n }\n return RestUtilities.sendInvalidCredentials(res);\n }\n }\n\n @Post('two-factor/verify')\n @ApiOperation({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' })\n @ApiBody({ type: VerifyTwoFactorRequest })\n @ApiResponse({ status: 200, type: LoginResponse })\n @ApiResponse({ status: 401, type: ErrorResponse })\n @ApiResponse({ status: 429, type: ErrorResponse })\n async verifyTwoFactor(@Req() request: Request, @Body() body: VerifyTwoFactorRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'twoFactorVerify', request, [body.challengeId]);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.authService.verifyTwoFactor(body.challengeId, body.code, body.scope));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Post('two-factor/resend')\n @ApiOperation({ summary: 'Reinvia il codice, invalidando il precedente', operationId: 'resendTwoFactor' })\n @ApiBody({ type: ResendTwoFactorRequest })\n @ApiResponse({ status: 200, type: LoginResponse })\n @ApiResponse({ status: 401, type: ErrorResponse })\n @ApiResponse({ status: 429, type: ErrorResponse })\n async resendTwoFactor(@Req() request: Request, @Body() body: ResendTwoFactorRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'twoFactorResend', request, [body.challengeId]);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.authService.resendTwoFactor(body.challengeId));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Post('bootstrap-admin')\n @ApiOperation({\n summary: 'Crea il primo utente admin (bootstrap)',\n operationId: 'bootstrapAdmin',\n description:\n 'Endpoint pubblico ma protetto dal token di avvio: attivo solo con adminBootstrap.enabled. ' +\n 'Crea un utente in stato confermato senza email, con flag admin (e super opzionale) e password fornita o generata.',\n })\n @ApiBody({ type: BootstrapAdminRequest })\n @ApiResponse({ status: 200, type: BootstrapAdminResponse })\n @ApiResponse({ status: 401, description: 'Token di bootstrap non valido', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Bootstrap admin non abilitato', type: ErrorResponse })\n @ApiResponse({ status: 429, description: 'Troppi tentativi', type: ErrorResponse })\n async bootstrapAdmin(@Req() request: Request, @Body() body: BootstrapAdminRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'adminBootstrap', request);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.adminBootstrapService.bootstrap(body));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Get('bootstrap-admin/status')\n @ApiOperation({\n summary: 'Indica se il bootstrap admin e abilitato',\n operationId: 'getAdminBootstrapStatus',\n description:\n 'Endpoint pubblico: la console mostra la sezione \"Crea utente admin\" solo quando enabled e true.',\n })\n @ApiResponse({ status: 200, type: AdminBootstrapStatusResponse })\n async adminBootstrapStatus(@Res() res: Response) {\n return RestUtilities.sendBaseResponse(res, { enabled: this.adminBootstrapService.isEnabled() });\n }\n}\n"]}
1	+ {"version":3,"file":"AuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4H;AAC5H,yDAAuF;AACvF,6CAAuG;AAEvG,mCAAoC;AACpC,yCAAsC;AACtC,+CAAgD;AAEhD,kCAciB;AACjB,qEAA2F;AAC3F,mGAAgG;AAChG,sDAAqD;AACrD,6DAAwE;AACxE,qEAGuC;AACvC,yEAGyC;AAQlC,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YACmB,WAAwB,EACxB,qBAA4C,EAClC,OAAwC;QAFlD,gBAAW,GAAX,WAAW,CAAa;QACxB,0BAAqB,GAArB,qBAAqB,CAAuB;QACjB,YAAO,GAAP,OAAO,CAAgB;QALrE,WAAM,GAAW,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAM9C,CAAC;IAgBE,aAAa,CACV,OAAgB,EAChB,GAAa,EACJ,KAAa,EACrB,IAAiC;;YAEzC,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,sBAAsB,EACtB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;KAAA;IAkBK,cAAc,CACX,OAAgB,EACf,IAA2B,EAC5B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,gBAAgB,EAChB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,EAAE,CAAC;oBACjB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,mBAAmB,EACnB,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7F,MAAM,QAAQ,GAAI,oBAA6C,aAA7C,oBAAoB,uBAApB,oBAAoB,CAA2B,MAAM,CAAC;gBACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;gBAED,2EAA2E;gBAC3E,sFAAsF;gBACtF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;KAAA;IAaK,cAAc,CAAQ,OAAgB,EAAS,GAAa;;YAChE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAA,6CAAyB,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7C,MAAM,IAAI,sBAAa,CACrB;wBACE,IAAI,EAAE,qCAAqC;wBAC3C,OAAO,EAAE,yDAAyD;qBACnE,EACD,mBAAU,CAAC,eAAe,CAC3B,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAA,6CAAyB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBACjE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IA0BK,KAAK,CAAQ,OAAgB,EAAU,YAA0B,EAAS,GAAa;;YAC3F,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,OAAO,EACP,CAAC,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,CAAC,CACtB,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;oBACtD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;oBAC/E,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;oBAC/B,IAAI,MAAM,CAAC,OAAO;wBAAE,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC7D,CAAC;gBAED,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,kBAAkB,EAAE,CAAC;oBACrD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACnE,OAAO,yBAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,KAAK,YAAY,sBAAa,EAAE,CAAC;oBACnC,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5F,CAAC;gBAED,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,qCAAuB,EAAE,CAAC;oBAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;wBAC3C,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;wBAC9D,IAAI,EAAE,qCAAuB;wBAC7B,KAAK,EAAE,qCAAuB;wBAC9B,OAAO,EAAE,+EAA+E;qBACzF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBACpD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;gBACJ,CAAC;gBACD,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;KAAA;IAaK,OAAO,CACJ,OAAgB,EACf,IAAyB,EAC1B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,CAAA,KAAK,QAAQ;oBACrD,CAAC,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC3E,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAwB,EAC7C,IAAI,CAAC,OAAO,EACZ,SAAS,EACT,OAAO,EACP,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3B,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,CAAC,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,IAAI,sBAAa,CAAC,2BAA2B,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;gBAChF,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,kBACvC,KAAK,EAAE,MAAM,CAAC,KAAK,IAChB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACrE,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9H,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAeK,cAAc,CAAQ,OAAgB,EAAU,IAA2B,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBACtF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAUK,oBAAoB,CAAQ,GAAa;;YAC7C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAClG,CAAC;KAAA;CACF,CAAA;AAzUY,wCAAc;AAuBnB;IAdL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kCAA2B,EAAE,CAAC;IAC9C,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kCAAkC;QAC/C,IAAI,EAAE,qBAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,+BAA+B,CAAC;IAEnC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,aAAI,GAAE,CAAA;;6DAAO,kCAA2B;;mDAiB1C;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,gBAAgB;KAC9B,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAsB;KAC7B,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,4BAA4B;QACzC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IAEvB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,4BAAqB;;oDAkCpC;AAaK;IAXL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,gBAAgB;QAC7B,WAAW,EACT,+IAA+I;KAClJ,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qBAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAClG,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACF,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDAsBnD;AA0BK;IAxBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,wOAAwO;QAC1O,WAAW,EAAE,OAAO;KACrB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,mBAAY,EAAE,CAAC;IAC/B,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,wBAAwB;QACrC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,8BAAuB;KAC9B,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC9F,IAAA,aAAI,EAAC,OAAO,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAApB,mBAAY;;2CAsDtE;AAaK;IAXL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EAAE,oBAAoB;QACjC,WAAW,EACT,wGAAwG;KAC3G,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,0BAAmB,EAAE,CAAC;IACtC,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,2BAAoB,EAAE,CAAC;IAC7C,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+CAA+C,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACnF,IAAA,aAAI,EAAC,SAAS,CAAC;IAEb,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,0BAAmB;;6CAiClC;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACnG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACzG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAeK;IAbL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,gBAAgB;QAC7B,WAAW,EACT,4FAA4F;YAC5F,mHAAmH;KACtH,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,6BAAsB,EAAE,CAAC;IAC1D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC7D,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA+B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA7B,4BAAqB;;oDAQhF;AAUK;IARL,IAAA,YAAG,EAAC,wBAAwB,CAAC;IAC7B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,yBAAyB;QACtC,WAAW,EACT,iGAAiG;KACpG,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mCAA4B,EAAE,CAAC;IACrC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;0DAEhC;yBAxUU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAOE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFI,yBAAW;QACD,6CAAqB;GALpD,cAAc,CAyU1B","sourcesContent":["import { Body, Controller, Get, HttpException, HttpStatus, Inject, Param, Post, Req, Res, UseGuards } from '@nestjs/common';\nimport { ResendTwoFactorRequest, VerifyTwoFactorRequest } from '../Dtos/TwoFactorDtos';\nimport { ApiBody, ApiOkResponse, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { createHash } from 'crypto';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n ActionResponse,\n AdminBootstrapStatusResponse,\n BootstrapAdminRequest,\n BootstrapAdminResponse,\n ConfirmResetPasswordRequest,\n ErrorResponse,\n GetUserByTokenRequest,\n GetUserByTokenResponse,\n LoginRequest,\n LoginResponse,\n PasswordExpiredResponse,\n RefreshTokenRequest,\n RefreshTokenResponse,\n} from '../Dtos';\nimport { AuthService, PASSWORD_LOGIN_DISABLED } from '../Services/AuthService/AuthService';\nimport { AdminBootstrapService } from '../Services/AdminBootstrapService/AdminBootstrapService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { getAuthenticatedAccessiUser } from '../security/accessControl';\nimport {\n getSessionRevocationStore,\n revokeAccessiUserSessions,\n} from '../security/sessionRevocation';\nimport {\n checkPublicAuthRateLimit,\n sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n@ApiTags('Auth')\n@Controller('accessi/auth')\n/*\n Endpoint pubblici di autenticazione locale e verifica sessione.\n * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.\n */\nexport class AuthController {\n logger: Logger = new Logger(AuthController.name);\n\n constructor(\n private readonly authService: AuthService,\n private readonly adminBootstrapService: AdminBootstrapService,\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n ) {}\n\n @ApiOperation({ summary: 'Conferma il reset della password', operationId: 'resetPassword' })\n @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\n @ApiBody({ type: ConfirmResetPasswordRequest })\n @ApiResponse({\n status: 200,\n description: 'Password aggiornata con successo',\n type: ActionResponse,\n })\n @ApiResponse({\n status: 400,\n description: 'Errore nella richiesta o token non valido',\n type: ErrorResponse,\n })\n @Post('confirm-reset-password/:token')\n async resetPassword(\n @Req() request: Request,\n @Res() res: Response,\n @Param('token') token: string,\n @Body() body: ConfirmResetPasswordRequest,\n ) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'passwordResetConfirm',\n request,\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n await this.authService.confirmResetPassword(token, body.newPassword);\n return RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.BAD_REQUEST);\n }\n }\n\n @ApiOperation({\n summary: 'Recupera le informazioni utente dal token JWT',\n operationId: 'getUserByToken',\n })\n @ApiBody({ type: GetUserByTokenRequest })\n @ApiResponse({\n status: 200,\n description: 'Informazioni utente recuperate con successo',\n type: GetUserByTokenResponse,\n })\n @ApiResponse({\n status: 401,\n description: 'Token non valido o scaduto',\n type: ErrorResponse,\n })\n @Post('get-user-by-token')\n async getUserByToken(\n @Req() request: Request,\n @Body() body: GetUserByTokenRequest,\n @Res() res: Response,\n ) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'getUserByToken',\n request,\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n if (!body?.token) {\n return RestUtilities.sendErrorMessage(\n res,\n 'Token non fornito',\n AuthController.name,\n HttpStatus.BAD_REQUEST,\n );\n }\n\n const authenticatedPayload = await this.authService.getAuthenticatedTokenPayload(body.token);\n const userData = (authenticatedPayload as { utente?: unknown })?.utente;\n if (!userData) {\n throw new Error('Il token non contiene un utente Accessi valido.');\n }\n\n // Keep the runtime response aligned with GetUserByTokenResponse and Orval:\n // Result.userData contains the authenticated user directly, not a nested JWT payload.\n return RestUtilities.sendBaseResponse(res, { userData });\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.UNAUTHORIZED);\n }\n }\n\n @ApiOperation({\n summary: 'Revoca tutte le sessioni dell utente corrente',\n operationId: 'revokeSessions',\n description:\n 'Invalida i token emessi prima di questa chiamata. Richiede sessionRevocation.store configurato. I token emessi dopo la revoca restano validi.',\n })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n @ApiResponse({ status: 501, type: ErrorResponse, description: 'Revoca sessioni non configurata.' })\n @UseGuards(JwtSimpleGuard)\n @Post('revoke-sessions')\n async revokeSessions(@Req() request: Request, @Res() res: Response) {\n try {\n const user = getAuthenticatedAccessiUser(request);\n if (!getSessionRevocationStore(this.options)) {\n throw new HttpException(\n {\n code: 'ACCESSI_SESSION_REVOCATION_DISABLED',\n message: 'La revoca sessioni non e configurata su questa istanza.',\n },\n HttpStatus.NOT_IMPLEMENTED,\n );\n }\n await revokeAccessiUserSessions(this.options, user.codiceUtente);\n return RestUtilities.sendOKMessage(res, 'Sessioni revocate con successo.');\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST,\n );\n }\n }\n\n @ApiOperation({\n summary: 'Effettua il login utente',\n description:\n \"Con sola email restituisce passwordRequired oppure avvia il codice per utenti passwordless. Con password valida restituisce il login completo o challenge se la 2FA e attiva. Nessun JWT viene emesso prima della verifica del codice.\",\n operationId: 'login',\n })\n @ApiBody({ type: LoginRequest })\n @ApiResponse({\n status: 200,\n description: 'Login effettuato con successo',\n type: LoginResponse,\n })\n @ApiResponse({\n status: 401,\n description: 'Credenziali non valide',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: 403,\n description: 'Password scaduta, e necessario aggiornarla.',\n type: PasswordExpiredResponse,\n })\n @ApiResponse({ status: 403, description: 'Utente abilitato solo a SSO.', type: ErrorResponse })\n @Post('login')\n async login(@Req() request: Request, @Body() loginRequest: LoginRequest, @Res() res: Response) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'login',\n request,\n [loginRequest?.email],\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n const userData = await this.authService.login(loginRequest);\n if (!userData) {\n return RestUtilities.sendInvalidCredentials(res);\n }\n\n if (!userData.challenge && !userData.passwordRequired) {\n const tokens = this.authService.createTokenPair(userData.utente, ['password']);\n userData.token = tokens.access;\n if (tokens.refresh) userData.refreshToken = tokens.refresh;\n }\n\n return RestUtilities.sendBaseResponse(res, userData);\n } catch (error) {\n if ((error as Error)?.message === 'PASSWORD_EXPIRED') {\n this.logger.warning('Password scaduta, cambiare password ', error);\n return RestUtilities.sendPasswordExpired(res);\n }\n\n if (error instanceof HttpException) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error.getStatus());\n }\n\n if ((error as Error)?.message === PASSWORD_LOGIN_DISABLED) {\n return res.status(HttpStatus.FORBIDDEN).json({\n severity: 'error', status: HttpStatus.FORBIDDEN, statusCode: 2,\n code: PASSWORD_LOGIN_DISABLED,\n error: PASSWORD_LOGIN_DISABLED,\n message: 'Questo utente e abilitato solo tramite SSO. Accedi con un provider collegato.',\n });\n }\n\n this.logger.error('Errore durante il login', error);\n if (RestUtilities.isDatabaseSchemaError(error)) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n HttpStatus.SERVICE_UNAVAILABLE,\n );\n }\n return RestUtilities.sendInvalidCredentials(res);\n }\n }\n\n @ApiOperation({\n summary: 'Scambia un refresh token con un nuovo access token',\n operationId: 'refreshAccessToken',\n description:\n 'Richiede jwtOptions.refreshExpiresIn. Il refresh token ha typ=refresh e non e accettato dai guard API.',\n })\n @ApiBody({ type: RefreshTokenRequest })\n @ApiOkResponse({ type: RefreshTokenResponse })\n @ApiResponse({ status: 401, description: 'Refresh token non valido, scaduto o revocato.', type: ErrorResponse })\n @ApiResponse({ status: 429, description: 'Troppi tentativi.', type: ErrorResponse })\n @Post('refresh')\n async refresh(\n @Req() request: Request,\n @Body() body: RefreshTokenRequest,\n @Res() res: Response,\n ) {\n try {\n const tokenKey = typeof body?.refreshToken === 'string'\n ? createHash('sha256').update(body.refreshToken).digest('hex').slice(0, 32)\n : undefined;\n const decision = await checkPublicAuthRateLimit(\n this.options,\n 'refresh',\n request,\n tokenKey ? [tokenKey] : [],\n );\n if (!decision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, decision.retryAfterSeconds);\n }\n\n const result = await this.authService.refreshAccessToken(body?.refreshToken);\n if (!result.token) {\n throw new HttpException('Refresh token non valido.', HttpStatus.UNAUTHORIZED);\n }\n return RestUtilities.sendBaseResponse(res, {\n token: result.token,\n ...(result.refreshToken ? { refreshToken: result.refreshToken } : {}),\n });\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n );\n }\n }\n\n @Post('two-factor/verify')\n @ApiOperation({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' })\n @ApiBody({ type: VerifyTwoFactorRequest })\n @ApiResponse({ status: 200, type: LoginResponse })\n @ApiResponse({ status: 401, type: ErrorResponse })\n @ApiResponse({ status: 429, type: ErrorResponse })\n async verifyTwoFactor(@Req() request: Request, @Body() body: VerifyTwoFactorRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'twoFactorVerify', request, [body.challengeId]);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.authService.verifyTwoFactor(body.challengeId, body.code, body.scope));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Post('two-factor/resend')\n @ApiOperation({ summary: 'Reinvia il codice, invalidando il precedente', operationId: 'resendTwoFactor' })\n @ApiBody({ type: ResendTwoFactorRequest })\n @ApiResponse({ status: 200, type: LoginResponse })\n @ApiResponse({ status: 401, type: ErrorResponse })\n @ApiResponse({ status: 429, type: ErrorResponse })\n async resendTwoFactor(@Req() request: Request, @Body() body: ResendTwoFactorRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'twoFactorResend', request, [body.challengeId]);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.authService.resendTwoFactor(body.challengeId));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Post('bootstrap-admin')\n @ApiOperation({\n summary: 'Crea il primo utente admin (bootstrap)',\n operationId: 'bootstrapAdmin',\n description:\n 'Endpoint pubblico ma protetto dal token di avvio: attivo solo con adminBootstrap.enabled. ' +\n 'Crea un utente in stato confermato senza email, con flag admin (e super opzionale) e password fornita o generata.',\n })\n @ApiBody({ type: BootstrapAdminRequest })\n @ApiResponse({ status: 200, type: BootstrapAdminResponse })\n @ApiResponse({ status: 401, description: 'Token di bootstrap non valido', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Bootstrap admin non abilitato', type: ErrorResponse })\n @ApiResponse({ status: 429, description: 'Troppi tentativi', type: ErrorResponse })\n async bootstrapAdmin(@Req() request: Request, @Body() body: BootstrapAdminRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'adminBootstrap', request);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.adminBootstrapService.bootstrap(body));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Get('bootstrap-admin/status')\n @ApiOperation({\n summary: 'Indica se il bootstrap admin e abilitato',\n operationId: 'getAdminBootstrapStatus',\n description:\n 'Endpoint pubblico: la console mostra la sezione \"Crea utente admin\" solo quando enabled e true.',\n })\n @ApiResponse({ status: 200, type: AdminBootstrapStatusResponse })\n async adminBootstrapStatus(@Res() res: Response) {\n return RestUtilities.sendBaseResponse(res, { enabled: this.adminBootstrapService.isEnabled() });\n }\n}\n"]}

package/dist/accessi-module/Dtos/FederatedExchangeDtos.d.ts ADDED Viewed

@@ -0,0 +1,21 @@
+import { BaseResponse } from './BaseResponse';
+import { LoginResult } from './LoginResponse';
+import { TokenResult } from './TokenResult';
+/**
+ * Identita esterna gia verificata dal backend fratello.
+ *
+ * Accessi non riceve token del provider: il backend valida firma/issuer/audience
+ * e passa solo la coppia stabile provider + subject.
+ */
+export declare class ExchangeFederatedIdentityRequest {
+    provider: string;
+    subject: string;
+}
+export declare class FederatedAuthenticationResultDto {
+    codiceUtente: number;
+    login: LoginResult;
+    token?: TokenResult;
+}
+export declare class FederatedExchangeResponse extends BaseResponse {
+    Result: FederatedAuthenticationResultDto;
+}

package/dist/accessi-module/Dtos/FederatedExchangeDtos.js ADDED Viewed

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FederatedExchangeResponse = exports.FederatedAuthenticationResultDto = exports.ExchangeFederatedIdentityRequest = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const BaseResponse_1 = require("./BaseResponse");
+const LoginResponse_1 = require("./LoginResponse");
+const TokenResult_1 = require("./TokenResult");
+/**
+ * Identita esterna gia verificata dal backend fratello.
+ *
+ * Accessi non riceve token del provider: il backend valida firma/issuer/audience
+ * e passa solo la coppia stabile provider + subject.
+ */
+class ExchangeFederatedIdentityRequest {
+}
+exports.ExchangeFederatedIdentityRequest = ExchangeFederatedIdentityRequest;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        example: 'azure-ad-acme-produzione',
+        description: 'Chiave provider censita in Accessi. Non e il nome commerciale del provider.',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Length)(1, 64),
+    __metadata("design:type", String)
+], ExchangeFederatedIdentityRequest.prototype, "provider", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        example: 'a1b2c3d4-...',
+        description: 'ID stabile dell account presso il provider: oid, sub o NameID persistente. Non usare email o username.',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Length)(1, 512),
+    __metadata("design:type", String)
+], ExchangeFederatedIdentityRequest.prototype, "subject", void 0);
+class FederatedAuthenticationResultDto {
+}
+exports.FederatedAuthenticationResultDto = FederatedAuthenticationResultDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 123 }),
+    __metadata("design:type", Number)
+], FederatedAuthenticationResultDto.prototype, "codiceUtente", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: LoginResponse_1.LoginResult, description: 'Profilo, grant e token della sessione Accessi.' }),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => LoginResponse_1.LoginResult),
+    __metadata("design:type", LoginResponse_1.LoginResult)
+], FederatedAuthenticationResultDto.prototype, "login", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ type: TokenResult_1.TokenResult, description: 'Assente quando login.challenge richiede la verifica 2FA.' }),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => TokenResult_1.TokenResult),
+    __metadata("design:type", TokenResult_1.TokenResult)
+], FederatedAuthenticationResultDto.prototype, "token", void 0);
+class FederatedExchangeResponse extends BaseResponse_1.BaseResponse {
+}
+exports.FederatedExchangeResponse = FederatedExchangeResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: FederatedAuthenticationResultDto }),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => FederatedAuthenticationResultDto),
+    __metadata("design:type", FederatedAuthenticationResultDto)
+], FederatedExchangeResponse.prototype, "Result", void 0);
+//# sourceMappingURL=FederatedExchangeDtos.js.map

package/dist/accessi-module/Dtos/FederatedExchangeDtos.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"FederatedExchangeDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/FederatedExchangeDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,yDAAyC;AACzC,qDAAmE;AACnE,iDAA8C;AAC9C,mDAA8C;AAC9C,+CAA4C;AAE5C;;;;;GAKG;AACH,MAAa,gCAAgC;CAgB5C;AAhBD,4EAgBC;AATC;IANC,IAAA,qBAAW,EAAC;QACX,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,6EAA6E;KAC3F,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,wBAAM,EAAC,CAAC,EAAE,EAAE,CAAC;;kEACI;AAQlB;IANC,IAAA,qBAAW,EAAC;QACX,OAAO,EAAE,cAAc;QACvB,WAAW,EAAE,wGAAwG;KACtH,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,wBAAM,EAAC,CAAC,EAAE,GAAG,CAAC;;iEACE;AAGnB,MAAa,gCAAgC;CAa5C;AAbD,4EAaC;AAXC;IADC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;;sEACR;AAKtB;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,2BAAW,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;IACjG,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,2BAAW,CAAC;8BAChB,2BAAW;+DAAC;AAKpB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IACnH,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BAChB,yBAAW;+DAAC;AAGtB,MAAa,yBAA0B,SAAQ,2BAAY;CAK1D;AALD,8DAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC;IACvD,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC;8BACpC,gCAAgC;yDAAC","sourcesContent":["import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsString, Length, ValidateNested } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\nimport { LoginResult } from './LoginResponse';\nimport { TokenResult } from './TokenResult';\n\n/**\n * Identita esterna gia verificata dal backend fratello.\n *\n * Accessi non riceve token del provider: il backend valida firma/issuer/audience\n * e passa solo la coppia stabile provider + subject.\n */\nexport class ExchangeFederatedIdentityRequest {\n @ApiProperty({\n example: 'azure-ad-acme-produzione',\n description: 'Chiave provider censita in Accessi. Non e il nome commerciale del provider.',\n })\n @IsString()\n @Length(1, 64)\n provider!: string;\n\n @ApiProperty({\n example: 'a1b2c3d4-...',\n description: 'ID stabile dell account presso il provider: oid, sub o NameID persistente. Non usare email o username.',\n })\n @IsString()\n @Length(1, 512)\n subject!: string;\n}\n\nexport class FederatedAuthenticationResultDto {\n @ApiProperty({ example: 123 })\n codiceUtente!: number;\n\n @ApiProperty({ type: LoginResult, description: 'Profilo, grant e token della sessione Accessi.' })\n @ValidateNested()\n @Type(() => LoginResult)\n login!: LoginResult;\n\n @ApiPropertyOptional({ type: TokenResult, description: 'Assente quando login.challenge richiede la verifica 2FA.' })\n @ValidateNested()\n @Type(() => TokenResult)\n token?: TokenResult;\n}\n\nexport class FederatedExchangeResponse extends BaseResponse {\n @ApiProperty({ type: FederatedAuthenticationResultDto })\n @ValidateNested()\n @Type(() => FederatedAuthenticationResultDto)\n Result!: FederatedAuthenticationResultDto;\n}\n"]}

package/dist/accessi-module/Dtos/LoginResponse.d.ts CHANGED Viewed

@@ -13,6 +13,7 @@ export declare class LoginResult {
     userGrants?: UserGrantsDto;
     extensionFields?: Record<string, unknown[]>;
     token?: TokenResult;
+    refreshToken?: TokenResult;
 }
 export declare class LoginResponse extends BaseResponse {
     Result: LoginResult;

package/dist/accessi-module/Dtos/LoginResponse.js CHANGED Viewed

@@ -62,6 +62,12 @@ __decorate([
     (0, class_transformer_1.Type)(() => TokenResult_1.TokenResult),
     __metadata("design:type", TokenResult_1.TokenResult)
 ], LoginResult.prototype, "token", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Refresh token, presente solo se jwtOptions.refreshExpiresIn e configurato.', type: TokenResult_1.TokenResult }),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => TokenResult_1.TokenResult),
+    __metadata("design:type", TokenResult_1.TokenResult)
+], LoginResult.prototype, "refreshToken", void 0);
 class LoginResponse extends BaseResponse_1.BaseResponse {
 }
 exports.LoginResponse = LoginResponse;

package/dist/accessi-module/Dtos/LoginResponse.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"LoginResponse.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/LoginResponse.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,mDAAwD;AACxD,iDAA8C;AAC9C,iDAA8C;AAC9C,+CAA4C;AAC5C,uCAAoC;AACpC,yDAAyC;AACzC,qDAAiD;AACjD,mDAAgD;AAEhD,MAAa,WAAW;~~CA8BvB~~;~~AA9BD~~,~~kCA8BC~~;~~AA5BC~~;IADC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,wFAAwF,EAAE,CAAC;;qDACrH;AAIxB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,qCAAqB,EAAE,WAAW,EAAE,+FAA+F,EAAE,CAAC;IAClK,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,qCAAqB,CAAC;8BACtB,qCAAqB;8CAAC;AAIlC;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,wDAAwD,EAAE,IAAI,EAAE,iBAAO,EAAE,CAAC;IAC7G,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,iBAAO,CAAC;8BACX,iBAAO;2CAAC;AAMjB;IAJC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,2BAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3F,IAAA,gCAAc,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,2BAAY,CAAC;IACzB,iGAAiG;;;2CAClE;AAK/B;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,6BAAa,EAAE,CAAC;IACxF,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,6BAAa,CAAC;8BACb,6BAAa;+CAAC;AAG3B;IADC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAC,CAAC;;oDAC1B;AAK5C;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,IAAI,EAAE,yBAAW,EAAE,CAAC;IACzG,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BAChB,yBAAW;0CAAC;~~AAGtB~~,MAAa,aAAc,SAAQ,2BAAY;CAK9C;AALD,sCAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAClC,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,WAAW,CAAC;8BACf,WAAW;6CAAC","sourcesContent":["import { ApiProperty, ApiPropertyOptional } from \"@nestjs/swagger\";\nimport { TwoFactorChallengeDto } from './TwoFactorDtos';\nimport { BaseResponse } from \"./BaseResponse\";\nimport { FiltriUtente } from \"./FiltriUtente\";\nimport { TokenResult } from \"./TokenResult\";\nimport { UserDto } from \"./UserDto\";\nimport { Type } from \"class-transformer\";\nimport { ValidateNested } from \"class-validator\";\nimport { UserGrantsDto } from \"./UserGrantsDto\";\n\nexport class LoginResult {\n @ApiPropertyOptional({ enum: [true], description: 'Il primo passo email richiede ora la password. Nessun utente o token viene restituito.' })\n passwordRequired?: true;\n @ApiPropertyOptional({ type: TwoFactorChallengeDto, description: 'Presente solo quando serve il codice. Profilo, grant e token sono assenti fino alla verifica.' })\n @ValidateNested()\n @Type(() => TwoFactorChallengeDto)\n challenge?: TwoFactorChallengeDto;\n @ApiPropertyOptional({ description: 'Dati utente, presenti solo al completamento del login.', type: UserDto })\n @ValidateNested()\n @Type(() => UserDto)\n utente?: UserDto;\n\n @ApiPropertyOptional({ description: 'Filtri utente', type: [FiltriUtente], nullable: true })\n @ValidateNested({ each: true })\n @Type(() => FiltriUtente)\n /** Null is retained for historic demo responses; normal authenticated users receive an array. */\n filtri?: FiltriUtente[] \| null;\n\n @ApiPropertyOptional({ description: 'Abilitazioni e ruoli utente', type: UserGrantsDto })\n @ValidateNested()\n @Type(() => UserGrantsDto)\n userGrants?: UserGrantsDto;\n\n @ApiPropertyOptional({ description: 'Extension Fields', type: Object})\n extensionFields?: Record<string, unknown[]>;\n\n @ApiPropertyOptional({ description: 'Token, assente durante la verifica del codice.', type: TokenResult })\n @ValidateNested()\n @Type(() => TokenResult)\n token?: TokenResult;\n}\n\nexport class LoginResponse extends BaseResponse {\n @ApiProperty({ type: LoginResult })\n @ValidateNested()\n @Type(() => LoginResult)\n Result!: LoginResult;\n}\n"]}
1	+ {"version":3,"file":"LoginResponse.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/LoginResponse.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,mDAAwD;AACxD,iDAA8C;AAC9C,iDAA8C;AAC9C,+CAA4C;AAC5C,uCAAoC;AACpC,yDAAyC;AACzC,qDAAiD;AACjD,mDAAgD;AAEhD,MAAa,WAAW;CAmCvB;AAnCD,kCAmCC;AAjCC;IADC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,wFAAwF,EAAE,CAAC;;qDACrH;AAIxB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,qCAAqB,EAAE,WAAW,EAAE,+FAA+F,EAAE,CAAC;IAClK,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,qCAAqB,CAAC;8BACtB,qCAAqB;8CAAC;AAIlC;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,wDAAwD,EAAE,IAAI,EAAE,iBAAO,EAAE,CAAC;IAC7G,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,iBAAO,CAAC;8BACX,iBAAO;2CAAC;AAMjB;IAJC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,2BAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3F,IAAA,gCAAc,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,2BAAY,CAAC;IACzB,iGAAiG;;;2CAClE;AAK/B;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,6BAAa,EAAE,CAAC;IACxF,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,6BAAa,CAAC;8BACb,6BAAa;+CAAC;AAG3B;IADC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAC,CAAC;;oDAC1B;AAK5C;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,IAAI,EAAE,yBAAW,EAAE,CAAC;IACzG,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BAChB,yBAAW;0CAAC;AAKpB;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,4EAA4E,EAAE,IAAI,EAAE,yBAAW,EAAE,CAAC;IACrI,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BACT,yBAAW;iDAAC;AAG7B,MAAa,aAAc,SAAQ,2BAAY;CAK9C;AALD,sCAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAClC,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,WAAW,CAAC;8BACf,WAAW;6CAAC","sourcesContent":["import { ApiProperty, ApiPropertyOptional } from \"@nestjs/swagger\";\nimport { TwoFactorChallengeDto } from './TwoFactorDtos';\nimport { BaseResponse } from \"./BaseResponse\";\nimport { FiltriUtente } from \"./FiltriUtente\";\nimport { TokenResult } from \"./TokenResult\";\nimport { UserDto } from \"./UserDto\";\nimport { Type } from \"class-transformer\";\nimport { ValidateNested } from \"class-validator\";\nimport { UserGrantsDto } from \"./UserGrantsDto\";\n\nexport class LoginResult {\n @ApiPropertyOptional({ enum: [true], description: 'Il primo passo email richiede ora la password. Nessun utente o token viene restituito.' })\n passwordRequired?: true;\n @ApiPropertyOptional({ type: TwoFactorChallengeDto, description: 'Presente solo quando serve il codice. Profilo, grant e token sono assenti fino alla verifica.' })\n @ValidateNested()\n @Type(() => TwoFactorChallengeDto)\n challenge?: TwoFactorChallengeDto;\n @ApiPropertyOptional({ description: 'Dati utente, presenti solo al completamento del login.', type: UserDto })\n @ValidateNested()\n @Type(() => UserDto)\n utente?: UserDto;\n\n @ApiPropertyOptional({ description: 'Filtri utente', type: [FiltriUtente], nullable: true })\n @ValidateNested({ each: true })\n @Type(() => FiltriUtente)\n /** Null is retained for historic demo responses; normal authenticated users receive an array. */\n filtri?: FiltriUtente[] \| null;\n\n @ApiPropertyOptional({ description: 'Abilitazioni e ruoli utente', type: UserGrantsDto })\n @ValidateNested()\n @Type(() => UserGrantsDto)\n userGrants?: UserGrantsDto;\n\n @ApiPropertyOptional({ description: 'Extension Fields', type: Object})\n extensionFields?: Record<string, unknown[]>;\n\n @ApiPropertyOptional({ description: 'Token, assente durante la verifica del codice.', type: TokenResult })\n @ValidateNested()\n @Type(() => TokenResult)\n token?: TokenResult;\n\n @ApiPropertyOptional({ description: 'Refresh token, presente solo se jwtOptions.refreshExpiresIn e configurato.', type: TokenResult })\n @ValidateNested()\n @Type(() => TokenResult)\n refreshToken?: TokenResult;\n}\n\nexport class LoginResponse extends BaseResponse {\n @ApiProperty({ type: LoginResult })\n @ValidateNested()\n @Type(() => LoginResult)\n Result!: LoginResult;\n}\n"]}

package/dist/accessi-module/Dtos/RefreshTokenDtos.d.ts ADDED Viewed

@@ -0,0 +1,12 @@
+import { BaseResponse } from './BaseResponse';
+import { TokenResult } from './TokenResult';
+export declare class RefreshTokenRequest {
+    refreshToken: string;
+}
+export declare class RefreshTokenResult {
+    token: TokenResult;
+    refreshToken?: TokenResult;
+}
+export declare class RefreshTokenResponse extends BaseResponse {
+    Result: RefreshTokenResult;
+}

package/dist/accessi-module/Dtos/RefreshTokenDtos.js ADDED Viewed

@@ -0,0 +1,50 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshTokenResponse = exports.RefreshTokenResult = exports.RefreshTokenRequest = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const BaseResponse_1 = require("./BaseResponse");
+const TokenResult_1 = require("./TokenResult");
+class RefreshTokenRequest {
+}
+exports.RefreshTokenRequest = RefreshTokenRequest;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Refresh token emesso al login, 2FA o SSO.' }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], RefreshTokenRequest.prototype, "refreshToken", void 0);
+class RefreshTokenResult {
+}
+exports.RefreshTokenResult = RefreshTokenResult;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: TokenResult_1.TokenResult, description: 'Nuovo access token.' }),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => TokenResult_1.TokenResult),
+    __metadata("design:type", TokenResult_1.TokenResult)
+], RefreshTokenResult.prototype, "token", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ type: TokenResult_1.TokenResult, description: 'Nuovo refresh token, se abilitato.' }),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => TokenResult_1.TokenResult),
+    __metadata("design:type", TokenResult_1.TokenResult)
+], RefreshTokenResult.prototype, "refreshToken", void 0);
+class RefreshTokenResponse extends BaseResponse_1.BaseResponse {
+}
+exports.RefreshTokenResponse = RefreshTokenResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: RefreshTokenResult }),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => RefreshTokenResult),
+    __metadata("design:type", RefreshTokenResult)
+], RefreshTokenResponse.prototype, "Result", void 0);
+//# sourceMappingURL=RefreshTokenDtos.js.map

package/dist/accessi-module/Dtos/RefreshTokenDtos.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"RefreshTokenDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/RefreshTokenDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,yDAAyC;AACzC,qDAA2D;AAC3D,iDAA8C;AAC9C,+CAA4C;AAE5C,MAAa,mBAAmB;CAI/B;AAJD,kDAIC;AADC;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;IACzE,IAAA,0BAAQ,GAAE;;yDACW;AAGxB,MAAa,kBAAkB;CAU9B;AAVD,gDAUC;AANC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACtE,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BAChB,yBAAW;iDAAC;AAKpB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAC7F,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BACT,yBAAW;wDAAC;AAG7B,MAAa,oBAAqB,SAAQ,2BAAY;CAKrD;AALD,oDAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IACzC,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;8BACtB,kBAAkB;oDAAC","sourcesContent":["import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsString, ValidateNested } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\nimport { TokenResult } from './TokenResult';\n\nexport class RefreshTokenRequest {\n @ApiProperty({ description: 'Refresh token emesso al login, 2FA o SSO.' })\n @IsString()\n refreshToken!: string;\n}\n\nexport class RefreshTokenResult {\n @ApiProperty({ type: TokenResult, description: 'Nuovo access token.' })\n @ValidateNested()\n @Type(() => TokenResult)\n token!: TokenResult;\n\n @ApiPropertyOptional({ type: TokenResult, description: 'Nuovo refresh token, se abilitato.' })\n @ValidateNested()\n @Type(() => TokenResult)\n refreshToken?: TokenResult;\n}\n\nexport class RefreshTokenResponse extends BaseResponse {\n @ApiProperty({ type: RefreshTokenResult })\n @ValidateNested()\n @Type(() => RefreshTokenResult)\n Result!: RefreshTokenResult;\n}\n"]}

package/dist/accessi-module/Dtos/index.d.ts CHANGED Viewed

@@ -10,6 +10,7 @@ export * from "./ConfirmResetPasswordRequest";
 export * from "./UpdateEnabledStatusRequest";
 export * from "./FiltriUtente";
 export * from "./FederatedIdentityDtos";
+export * from "./FederatedExchangeDtos";
 export * from "./GetUserByTokenRequest";
 export * from "./GetUserByTokenResponse";
 export * from "./IntrospectionDtos";
@@ -18,6 +19,7 @@ export * from "./LoginRequest";
 export * from "./LoginResponse";
 export * from "./Permission";
 export * from "./PublicRegisterRequest";
+export * from "./RefreshTokenDtos";
 export * from "./Role";
 export * from "./SchemaDtos";
 export * from "./ScopeDtos";

package/dist/accessi-module/Dtos/index.js CHANGED Viewed

@@ -26,6 +26,7 @@ __exportStar(require("./ConfirmResetPasswordRequest"), exports);
 __exportStar(require("./UpdateEnabledStatusRequest"), exports);
 __exportStar(require("./FiltriUtente"), exports);
 __exportStar(require("./FederatedIdentityDtos"), exports);
+__exportStar(require("./FederatedExchangeDtos"), exports);
 __exportStar(require("./GetUserByTokenRequest"), exports);
 __exportStar(require("./GetUserByTokenResponse"), exports);
 __exportStar(require("./IntrospectionDtos"), exports);
@@ -34,6 +35,7 @@ __exportStar(require("./LoginRequest"), exports);
 __exportStar(require("./LoginResponse"), exports);
 __exportStar(require("./Permission"), exports);
 __exportStar(require("./PublicRegisterRequest"), exports);
+__exportStar(require("./RefreshTokenDtos"), exports);
 __exportStar(require("./Role"), exports);
 __exportStar(require("./SchemaDtos"), exports);
 __exportStar(require("./ScopeDtos"), exports);

package/dist/accessi-module/Dtos/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,mEAAiD;AACjD,6DAA2C;AAC3C,gEAA8C;AAC9C,iDAA+B;AAC/B,gDAA8B;AAC9B,gEAA8C;AAC9C,+DAA4C;AAE5C,iDAA+B;AAC/B,0DAAwC;AACxC,0DAAwC;AACxC,2DAAyC;AACzC,sDAAoC;AACpC,gDAA8B;AAC9B,iDAA+B;AAC/B,kDAAgC;AAChC,+CAA6B;AAC7B,0DAAwC;AACxC,yCAAuB;AACvB,+CAA6B;AAC7B,8CAA4B;AAC5B,kEAAgD;AAChD,uDAAqC;AACrC,qDAAmC;AACnC,gDAA8B;AAC9B,4CAA0B;AAC1B,uDAAqC;AAErC,8CAA2B;AAE3B,iDAA+B;AAE/B,kDAAgC","sourcesContent":["export * from \"./Abilitazione\";\nexport * from \"./AdminBootstrapDtos\";\nexport * from \"./AbilitazioneMenu\";\nexport * from \"./AssignPermissionsToUserRequest\";\nexport * from \"./AssignRolesToUserRequest\";\nexport * from \"./AuthenticatedUserPayloadDto\";\nexport * from \"./BaseResponse\";\nexport * from \"./CatalogDtos\";\nexport * from \"./ConfirmResetPasswordRequest\";\nexport * from \"./UpdateEnabledStatusRequest\"\n\nexport * from \"./FiltriUtente\";\nexport * from \"./FederatedIdentityDtos\";\nexport * from \"./GetUserByTokenRequest\";\nexport * from \"./GetUserByTokenResponse\";\nexport * from \"./IntrospectionDtos\";\nexport * from \"./LoginAsDtos\";\nexport * from \"./LoginRequest\";\nexport * from \"./LoginResponse\";\nexport * from \"./Permission\";\nexport * from \"./PublicRegisterRequest\";\nexport * from \"./Role\";\nexport * from \"./SchemaDtos\";\nexport * from \"./ScopeDtos\";\nexport * from \"./SendResetPasswordEmailRequest\";\nexport * from \"./StatoRegistrazione\";\nexport * from \"./TipoAbilitazione\";\nexport * from \"./TokenResult\";\nexport * from \"./UserDto\";\nexport * from \"./UserGrantsResponse\";\n\nexport * from \"./RuoliMenu\"\n\nexport * from \"./ServiceToken\";\n\nexport * from './TwoFactorDtos';\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,mEAAiD;AACjD,6DAA2C;AAC3C,gEAA8C;AAC9C,iDAA+B;AAC/B,gDAA8B;AAC9B,gEAA8C;AAC9C,+DAA4C;AAE5C,iDAA+B;AAC/B,0DAAwC;AACxC,0DAAwC;AACxC,0DAAwC;AACxC,2DAAyC;AACzC,sDAAoC;AACpC,gDAA8B;AAC9B,iDAA+B;AAC/B,kDAAgC;AAChC,+CAA6B;AAC7B,0DAAwC;AACxC,qDAAmC;AACnC,yCAAuB;AACvB,+CAA6B;AAC7B,8CAA4B;AAC5B,kEAAgD;AAChD,uDAAqC;AACrC,qDAAmC;AACnC,gDAA8B;AAC9B,4CAA0B;AAC1B,uDAAqC;AAErC,8CAA2B;AAE3B,iDAA+B;AAE/B,kDAAgC","sourcesContent":["export * from \"./Abilitazione\";\nexport * from \"./AdminBootstrapDtos\";\nexport * from \"./AbilitazioneMenu\";\nexport * from \"./AssignPermissionsToUserRequest\";\nexport * from \"./AssignRolesToUserRequest\";\nexport * from \"./AuthenticatedUserPayloadDto\";\nexport * from \"./BaseResponse\";\nexport * from \"./CatalogDtos\";\nexport * from \"./ConfirmResetPasswordRequest\";\nexport * from \"./UpdateEnabledStatusRequest\"\n\nexport * from \"./FiltriUtente\";\nexport * from \"./FederatedIdentityDtos\";\nexport * from \"./FederatedExchangeDtos\";\nexport * from \"./GetUserByTokenRequest\";\nexport * from \"./GetUserByTokenResponse\";\nexport * from \"./IntrospectionDtos\";\nexport * from \"./LoginAsDtos\";\nexport * from \"./LoginRequest\";\nexport * from \"./LoginResponse\";\nexport * from \"./Permission\";\nexport * from \"./PublicRegisterRequest\";\nexport * from \"./RefreshTokenDtos\";\nexport * from \"./Role\";\nexport * from \"./SchemaDtos\";\nexport * from \"./ScopeDtos\";\nexport * from \"./SendResetPasswordEmailRequest\";\nexport * from \"./StatoRegistrazione\";\nexport * from \"./TipoAbilitazione\";\nexport * from \"./TokenResult\";\nexport * from \"./UserDto\";\nexport * from \"./UserGrantsResponse\";\n\nexport * from \"./RuoliMenu\"\n\nexport * from \"./ServiceToken\";\n\nexport * from './TwoFactorDtos';\n"]}

package/dist/accessi-module/Services/AuthService/AuthService.d.ts CHANGED Viewed

@@ -28,8 +28,16 @@ export declare class AuthService {
     constructor(userService: UserService, filtriService: FiltriService, accessiOptions: AccessiOptions, twoFactorService: TwoFactorService);
     private refreshPasswordExpiration;
     private isMockDemoUserEnabled;
+    private createToken;
     /** Creates the normal internal JWT consumed by all existing Accessi guards. */
     createAccessiToken(utente: LoginResult['utente'], methods?: string[], tokenOptions?: AccessiTokenIssueOptions): TokenResult;
+    /** Emette il refresh token quando `jwtOptions.refreshExpiresIn` e configurato. */
+    createRefreshToken(utente: LoginResult['utente'], methods?: string[]): TokenResult | undefined;
+    /** Crea la coppia access + refresh token usata da login, 2FA e SSO. */
+    createTokenPair(utente: LoginResult['utente'], methods?: string[]): {
+        access: TokenResult;
+        refresh?: TokenResult;
+    };
     /**
      * Emette l'access token per l'utente target, con l'attore registrato nelle
      * claim `act` e `loginAs`. La durata e' quella standard di jwtOptions.expiresIn.
@@ -60,6 +68,12 @@ export declare class AuthService {
      * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.
      */
     getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>>;
+    /**
+     * Scambia un refresh token valido con una nuova coppia access + refresh.
+     *
+     * Il refresh token non e accettato dai guard API: ha `typ: "refresh"`.
+     */
+    refreshAccessToken(refreshToken: string): Promise<LoginResult>;
     /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */
     beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult>;
     private validateTwoFactorProof;