emilsoftware-utilities 2.0.0-dev.7 → 2.0.0-dev.70

package/dist/accessi-module/jwt/jwt.strategy.js

@@ -59,6 +59,8 @@ const common_1 = require("@nestjs/common");
 const jwt = __importStar(require("jsonwebtoken"));
 const UserService_1 = require("../Services/UserService/UserService");
 const authenticatedToken_1 = require("../security/authenticatedToken");
+const jwtTokenOptions_1 = require("../security/jwtTokenOptions");
+const sessionRevocation_1 = require("../security/sessionRevocation");
 let JwtSimpleGuard = class JwtSimpleGuard {
     constructor(accessiOptions, userService) {
         this.accessiOptions = accessiOptions;
@@ -66,26 +68,37 @@ let JwtSimpleGuard = class JwtSimpleGuard {
     }
     canActivate(context) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
             const request = context.switchToHttp().getRequest();
             const authHeader = request.headers['authorization'];
             if (!authHeader)
                 throw new common_1.UnauthorizedException('Token mancante.');
-            const token = authHeader.split(' ')[1];
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(authHeader);
             if (!token)
                 throw new common_1.UnauthorizedException('Formato token non valido.');
             try {
-                const secret = ((_b = (_a = this.accessiOptions) === null || _a === void 0 ? void 0 : _a.jwtOptions) === null || _b === void 0 ? void 0 : _b.secret) || process.env.ACC_JWT_SECRET;
-                if (!secret) {
-                    throw new common_1.InternalServerErrorException('JWT secret non configurato.');
+                let verification;
+                try {
+                    verification = (0, jwtTokenOptions_1.getAccessiAccessTokenVerificationConfig)(this.accessiOptions);
+                }
+                catch (_a) {
+                    throw new common_1.InternalServerErrorException('Chiave JWT non configurata.');
+                }
+                let payload;
+                try {
+                    payload = jwt.verify(token, verification.key, verification.verifyOptions);
+                }
+                catch (_b) {
+                    throw new common_1.UnauthorizedException('Token non valido o scaduto.');
                 }
-                const payload = jwt.verify(token, secret);
                 const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(payload);
                 if (!codiceUtente) {
                     throw new common_1.UnauthorizedException('Token privo di un utente valido.');
                 }
+                if (yield (0, sessionRevocation_1.isAccessiTokenRevoked)(this.accessiOptions, payload, codiceUtente)) {
+                    throw new common_1.UnauthorizedException('Sessione revocata.');
+                }
                 const currentUser = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
-                if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+                if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(payload, currentUser)) {
                     throw new common_1.UnauthorizedException('Utente non piu autorizzato.');
                 }
                 request.user = (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(payload, currentUser);
@@ -95,7 +108,7 @@ let JwtSimpleGuard = class JwtSimpleGuard {
                 if (error instanceof common_1.InternalServerErrorException || error instanceof common_1.UnauthorizedException) {
                     throw error;
                 }
-                throw new common_1.UnauthorizedException('Token non valido o scaduto.');
+                throw new common_1.InternalServerErrorException('Errore durante la verifica dell utente.');
             }
         });
     }

package/dist/accessi-module/jwt/jwt.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kDAAoC;AAEpC,qEAAkE;AAClE,uEAIwC;AAGjC,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAA,MAAA,MAAA,IAAI,CAAC,cAAc,0CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBACrF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC1C,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;oBACnD,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAxCY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CAwC1B","sourcesContent":["import {\r\n  CanActivate,\r\n  ExecutionContext,\r\n  Inject,\r\n  Injectable,\r\n  InternalServerErrorException,\r\n  UnauthorizedException,\r\n} from '@nestjs/common';\r\nimport * as jwt from 'jsonwebtoken';\r\nimport { AccessiOptions } from '../AccessiModule';\r\nimport { UserService } from '../Services/UserService/UserService';\r\nimport {\r\n  buildAuthenticatedTokenPayload,\r\n  isAuthenticatedUserEnabledForJwt,\r\n  resolveCodiceUtenteFromTokenPayload,\r\n} from '../security/authenticatedToken';\r\n\r\n@Injectable()\r\nexport class JwtSimpleGuard implements CanActivate {\r\n  constructor(\r\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\r\n    private readonly userService: UserService,\r\n  ) {}\r\n\r\n  async canActivate(context: ExecutionContext): Promise<boolean> {\r\n    const request = context.switchToHttp().getRequest();\r\n\r\n    const authHeader = request.headers['authorization'];\r\n    if (!authHeader) throw new UnauthorizedException('Token mancante.');\r\n\r\n    const token = authHeader.split(' ')[1];\r\n    if (!token) throw new UnauthorizedException('Formato token non valido.');\r\n\r\n    try {\r\n      const secret = this.accessiOptions?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\r\n      if (!secret) {\r\n        throw new InternalServerErrorException('JWT secret non configurato.');\r\n      }\r\n      const payload = jwt.verify(token, secret);\r\n      const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\r\n      if (!codiceUtente) {\r\n        throw new UnauthorizedException('Token privo di un utente valido.');\r\n      }\r\n\r\n      const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\r\n      if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\r\n        throw new UnauthorizedException('Utente non piu autorizzato.');\r\n      }\r\n\r\n      request.user = buildAuthenticatedTokenPayload(payload, currentUser);\r\n      return true;\r\n    } catch (error) {\r\n      if (error instanceof InternalServerErrorException || error instanceof UnauthorizedException) {\r\n        throw error;\r\n      }\r\n      throw new UnauthorizedException('Token non valido o scaduto.');\r\n    }\r\n  }\r\n}\r\n"]}
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kDAAoC;AAEpC,qEAAkE;AAClE,uEAMwC;AACxC,iEAAsF;AACtF,qEAAsE;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,IAAI,YAAwE,CAAC;gBAC7E,IAAI,CAAC;oBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC9E,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,OAAgC,CAAC;gBACrC,IAAI,CAAC;oBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5E,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;oBACvG,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;gBACxD,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,yCAAyC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAlDY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CAkD1B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  Inject,\n  Injectable,\n  InternalServerErrorException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport * as jwt from 'jsonwebtoken';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { UserService } from '../Services/UserService/UserService';\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from '../security/authenticatedToken';\nimport { getAccessiAccessTokenVerificationConfig } from '../security/jwtTokenOptions';\nimport { isAccessiTokenRevoked } from '../security/sessionRevocation';\n\n@Injectable()\nexport class JwtSimpleGuard implements CanActivate {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly userService: UserService,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const authHeader = request.headers['authorization'];\n    if (!authHeader) throw new UnauthorizedException('Token mancante.');\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) throw new UnauthorizedException('Formato token non valido.');\n\n    try {\n      let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n      try {\n        verification = getAccessiAccessTokenVerificationConfig(this.accessiOptions);\n      } catch {\n        throw new InternalServerErrorException('Chiave JWT non configurata.');\n      }\n      let payload: jwt.JwtPayload | string;\n      try {\n        payload = jwt.verify(token, verification.key, verification.verifyOptions);\n      } catch {\n        throw new UnauthorizedException('Token non valido o scaduto.');\n      }\n      const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\n      if (!codiceUtente) {\n        throw new UnauthorizedException('Token privo di un utente valido.');\n      }\n      if (await isAccessiTokenRevoked(this.accessiOptions, payload as Record<string, unknown>, codiceUtente)) {\n        throw new UnauthorizedException('Sessione revocata.');\n      }\n\n      const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n      if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(payload, currentUser)) {\n        throw new UnauthorizedException('Utente non piu autorizzato.');\n      }\n\n      request.user = buildAuthenticatedTokenPayload(payload, currentUser);\n      return true;\n    } catch (error) {\n      if (error instanceof InternalServerErrorException || error instanceof UnauthorizedException) {\n        throw error;\n      }\n      throw new InternalServerErrorException('Errore durante la verifica dell utente.');\n    }\n  }\n}\n"]}

package/dist/accessi-module/middleware/accessiRequirements.d.ts

@@ -1,42 +1,57 @@
 import { Request } from "express";
+/** Grant effettivo letto da Accessi. Il confronto usa `tipoAbilitazione >= minPermissionLevel`. */
 export type AccessiGrant = {
     codiceMenu: string;
     tipoAbilitazione?: number;
 };
+/** Risultato memoizzato durante una singola autorizzazione. Non modificarlo nel custom handler. */
 export type GrantsResult = {
     grants?: AccessiGrant[];
     [key: string]: unknown;
 };
+/** Richiede l'accesso a un menu con almeno il livello indicato. Valori convenzionali: 10 lettura, 20 scrittura. */
 export type AccessiPermissionRequirement = {
     type: "permission";
     menuCode: string;
     minPermissionLevel: number;
 };
+/** Tutti i requisiti figli devono essere soddisfatti. Una lista vuota e una configurazione non valida. */
 export type AccessiAllRequirement = {
     type: "and";
     requirements: AccessiRequirementNode[];
 };
+/** Almeno un requisito figlio deve essere soddisfatto. Una lista vuota e una configurazione non valida. */
 export type AccessiAnyRequirement = {
     type: "or";
     requirements: AccessiRequirementNode[];
 };
+/** Nega il risultato del requisito figlio. Usarlo con cautela per non creare policy difficili da verificare. */
 export type AccessiNotRequirement = {
     type: "not";
     requirement: AccessiRequirementNode;
 };
+/** Delega una condizione applicativa a un handler registrato dal backend. */
 export type AccessiCustomRequirement = {
     type: "custom";
     key: string;
     payload?: unknown;
 };
+/** Nodo composabile dell'albero di autorizzazione valutato da `authorizeAccessi`. */
 export type AccessiRequirementNode = AccessiPermissionRequirement | AccessiAllRequirement | AccessiAnyRequirement | AccessiNotRequirement | AccessiCustomRequirement;
+/** Contesto in sola lettura consegnato a un requisito personalizzato. */
 export type AccessiCustomRequirementContext = {
     req: Request;
-    decodedToken: any;
+    decodedToken: Record<string, unknown>;
     userCode: number;
     getGrantsResult: () => Promise<GrantsResult>;
 };
+/** Handler applicativo per `accessiRequirement.custom`; `false` nega la richiesta, un errore produce 500. */
 export type AccessiCustomRequirementHandler = (context: AccessiCustomRequirementContext, payload?: unknown) => boolean | Promise<boolean>;
+/**
+ * Policy passata a `authorizeAccessi`.
+ * `requirements` e la forma compatibile storica ed equivale a un AND; `requirementTree`
+ * permette policy annidate e ha precedenza quando entrambi sono presenti.
+ */
 export type AccessiAuthorizationOptions = {
     requirements?: {
         menuCode: string;
@@ -45,10 +60,12 @@ export type AccessiAuthorizationOptions = {
     requirementTree?: AccessiRequirementNode;
     customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;
 };
+/** Errore di configurazione di una policy, distinto dal normale diniego 403. */
 export declare class RequirementEvaluationError extends Error {
     readonly code: string;
     constructor(code: string, message: string);
 }
+/** Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. */
 export declare const accessiRequirement: {
     permission: (menuCode: string, minPermissionLevel: number) => AccessiPermissionRequirement;
     and: (...requirements: AccessiRequirementNode[]) => AccessiAllRequirement;
@@ -56,5 +73,10 @@ export declare const accessiRequirement: {
     not: (requirement: AccessiRequirementNode) => AccessiNotRequirement;
     custom: (key: string, payload?: unknown) => AccessiCustomRequirement;
 };
+/** Normalizza la forma compatibile `requirements` nell'albero interno. */
 export declare function buildRequirementTree(options?: AccessiAuthorizationOptions): AccessiRequirementNode | undefined;
+/**
+ * Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.
+ * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.
+ */
 export declare function evaluateRequirement(requirement: AccessiRequirementNode, context: AccessiCustomRequirementContext, options?: AccessiAuthorizationOptions): Promise<boolean>;

package/dist/accessi-module/middleware/accessiRequirements.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.accessiRequirement = exports.RequirementEvaluationError = void 0;
 exports.buildRequirementTree = buildRequirementTree;
 exports.evaluateRequirement = evaluateRequirement;
+/** Errore di configurazione di una policy, distinto dal normale diniego 403. */
 class RequirementEvaluationError extends Error {
     constructor(code, message) {
         super(message);
@@ -23,6 +24,7 @@ exports.RequirementEvaluationError = RequirementEvaluationError;
 function requirementError(code, message) {
     return new RequirementEvaluationError(code, message);
 }
+/** Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. */
 exports.accessiRequirement = {
     permission: (menuCode, minPermissionLevel) => ({
         type: "permission",
@@ -47,6 +49,7 @@ exports.accessiRequirement = {
         payload,
     }),
 };
+/** Normalizza la forma compatibile `requirements` nell'albero interno. */
 function buildRequirementTree(options) {
     var _a;
     if (options === null || options === void 0 ? void 0 : options.requirementTree)
@@ -57,6 +60,10 @@ function buildRequirementTree(options) {
     const nodes = requirements.map((requirement) => exports.accessiRequirement.permission(requirement.menuCode, requirement.minPermissionLevel));
     return exports.accessiRequirement.and(...nodes);
 }
+/**
+ * Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.
+ * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.
+ */
 function evaluateRequirement(requirement, context, options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;

package/dist/accessi-module/middleware/accessiRequirements.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessiRequirements.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/accessiRequirements.ts"],"names":[],"mappings":";;;;;;;;;;;;AAuGA,oDAgBC;AAED,kDAwDC;AAjHD,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAEY,QAAA,kBAAkB,GAAG;IAChC,UAAU,EAAE,CACV,QAAgB,EAChB,kBAA0B,EACI,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,kBAAkB;KACnB,CAAC;IACF,GAAG,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,KAAK;QACX,YAAY;KACb,CAAC;IACF,EAAE,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,IAAI;QACV,YAAY;KACb,CAAC;IACF,GAAG,EAAE,CAAC,WAAmC,EAAyB,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,KAAK;QACX,WAAW;KACZ,CAAC;IACF,MAAM,EAAE,CAAC,GAAW,EAAE,OAAiB,EAA4B,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,OAAO;KACR,CAAC;CACH,CAAC;AAEF,SAAgB,oBAAoB,CAClC,OAAqC;;IAErC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC;IAE7D,MAAM,YAAY,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE,CAAC;IACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,KAAK,GAA6B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACvE,0BAAkB,CAAC,UAAU,CAC3B,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,kBAAkB,CAC/B,CACF,CAAC;IAEF,OAAO,0BAAkB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,SAAsB,mBAAmB,CACvC,WAAmC,EACnC,OAAwC,EACxC,OAAqC;;;QAErC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAA,YAAY,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE;;oBACR,OAAA,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ;wBACxC,MAAM,CAAC,MAAA,KAAK,CAAC,gBAAgB,mCAAI,CAAC,CAAC,IAAI,WAAW,CAAC,kBAAkB,CAAA;iBAAA,CACxE,CAAC;YACJ,CAAC;YACD,KAAK,KAAK;gBACR,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,6DAA6D,CAC9D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAC1E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,KAAK,IAAI;gBACP,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,4DAA4D,CAC7D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtE,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,KAAK,KAAK;gBACR,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,yBAAyB,mCAAI,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,WAAW,CAAC,GAAG,aAAa,CAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD;gBACE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,CAChC,CAAC;QACN,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { Request } from \"express\";\r\n\r\nexport type AccessiGrant = {\r\n  codiceMenu: string;\r\n  tipoAbilitazione?: number;\r\n};\r\n\r\nexport type GrantsResult = {\r\n  grants?: AccessiGrant[];\r\n  [key: string]: unknown;\r\n};\r\n\r\nexport type AccessiPermissionRequirement = {\r\n  type: \"permission\";\r\n  menuCode: string;\r\n  minPermissionLevel: number;\r\n};\r\n\r\nexport type AccessiAllRequirement = {\r\n  type: \"and\";\r\n  requirements: AccessiRequirementNode[];\r\n};\r\n\r\nexport type AccessiAnyRequirement = {\r\n  type: \"or\";\r\n  requirements: AccessiRequirementNode[];\r\n};\r\n\r\nexport type AccessiNotRequirement = {\r\n  type: \"not\";\r\n  requirement: AccessiRequirementNode;\r\n};\r\n\r\nexport type AccessiCustomRequirement = {\r\n  type: \"custom\";\r\n  key: string;\r\n  payload?: unknown;\r\n};\r\n\r\nexport type AccessiRequirementNode =\r\n  | AccessiPermissionRequirement\r\n  | AccessiAllRequirement\r\n  | AccessiAnyRequirement\r\n  | AccessiNotRequirement\r\n  | AccessiCustomRequirement;\r\n\r\nexport type AccessiCustomRequirementContext = {\r\n  req: Request;\r\n  decodedToken: any;\r\n  userCode: number;\r\n  getGrantsResult: () => Promise<GrantsResult>;\r\n};\r\n\r\nexport type AccessiCustomRequirementHandler = (\r\n  context: AccessiCustomRequirementContext,\r\n  payload?: unknown\r\n) => boolean | Promise<boolean>;\r\n\r\nexport type AccessiAuthorizationOptions = {\r\n  requirements?: { menuCode: string; minPermissionLevel: number }[];\r\n  requirementTree?: AccessiRequirementNode;\r\n  customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;\r\n};\r\n\r\nexport class RequirementEvaluationError extends Error {\r\n  constructor(public readonly code: string, message: string) {\r\n    super(message);\r\n    this.name = \"RequirementEvaluationError\";\r\n  }\r\n}\r\n\r\nfunction requirementError(code: string, message: string): RequirementEvaluationError {\r\n  return new RequirementEvaluationError(code, message);\r\n}\r\n\r\nexport const accessiRequirement = {\r\n  permission: (\r\n    menuCode: string,\r\n    minPermissionLevel: number\r\n  ): AccessiPermissionRequirement => ({\r\n    type: \"permission\",\r\n    menuCode,\r\n    minPermissionLevel,\r\n  }),\r\n  and: (...requirements: AccessiRequirementNode[]): AccessiAllRequirement => ({\r\n    type: \"and\",\r\n    requirements,\r\n  }),\r\n  or: (...requirements: AccessiRequirementNode[]): AccessiAnyRequirement => ({\r\n    type: \"or\",\r\n    requirements,\r\n  }),\r\n  not: (requirement: AccessiRequirementNode): AccessiNotRequirement => ({\r\n    type: \"not\",\r\n    requirement,\r\n  }),\r\n  custom: (key: string, payload?: unknown): AccessiCustomRequirement => ({\r\n    type: \"custom\",\r\n    key,\r\n    payload,\r\n  }),\r\n};\r\n\r\nexport function buildRequirementTree(\r\n  options?: AccessiAuthorizationOptions\r\n): AccessiRequirementNode | undefined {\r\n  if (options?.requirementTree) return options.requirementTree;\r\n\r\n  const requirements = options?.requirements ?? [];\r\n  if (requirements.length === 0) return undefined;\r\n\r\n  const nodes: AccessiRequirementNode[] = requirements.map((requirement) =>\r\n    accessiRequirement.permission(\r\n      requirement.menuCode,\r\n      requirement.minPermissionLevel\r\n    )\r\n  );\r\n\r\n  return accessiRequirement.and(...nodes);\r\n}\r\n\r\nexport async function evaluateRequirement(\r\n  requirement: AccessiRequirementNode,\r\n  context: AccessiCustomRequirementContext,\r\n  options?: AccessiAuthorizationOptions\r\n): Promise<boolean> {\r\n  switch (requirement.type) {\r\n    case \"permission\": {\r\n      const grantsResult = await context.getGrantsResult();\r\n      const grants = grantsResult.grants ?? [];\r\n      return grants.some(\r\n        (grant) =>\r\n          grant.codiceMenu == requirement.menuCode &&\r\n          Number(grant.tipoAbilitazione ?? 0) >= requirement.minPermissionLevel\r\n      );\r\n    }\r\n    case \"and\":\r\n      if (!requirement.requirements || requirement.requirements.length === 0) {\r\n        throw requirementError(\r\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n          \"AND requirement must contain at least one child requirement\"\r\n        );\r\n      }\r\n      for (const child of requirement.requirements) {\r\n        if (!(await evaluateRequirement(child, context, options))) return false;\r\n      }\r\n      return true;\r\n    case \"or\":\r\n      if (!requirement.requirements || requirement.requirements.length === 0) {\r\n        throw requirementError(\r\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n          \"OR requirement must contain at least one child requirement\"\r\n        );\r\n      }\r\n      for (const child of requirement.requirements) {\r\n        if (await evaluateRequirement(child, context, options)) return true;\r\n      }\r\n      return false;\r\n    case \"not\":\r\n      return !(await evaluateRequirement(requirement.requirement, context, options));\r\n    case \"custom\": {\r\n      const handlers = options?.customRequirementHandlers ?? {};\r\n      const handler = handlers[requirement.key];\r\n      if (!handler) {\r\n        throw requirementError(\r\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n          `Custom requirement handler \"${requirement.key}\" not found`\r\n        );\r\n      }\r\n      return Boolean(await handler(context, requirement.payload));\r\n    }\r\n    default:\r\n      throw requirementError(\r\n        \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n        \"Unknown requirement node type\"\r\n      );\r\n  }\r\n}\r\n"]}
+{"version":3,"file":"accessiRequirements.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/accessiRequirements.ts"],"names":[],"mappings":";;;;;;;;;;;;AAyHA,oDAgBC;AAMD,kDAwDC;AAxHD,gFAAgF;AAChF,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,yGAAyG;AAC5F,QAAA,kBAAkB,GAAG;IAChC,UAAU,EAAE,CACV,QAAgB,EAChB,kBAA0B,EACI,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,kBAAkB;KACnB,CAAC;IACF,GAAG,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,KAAK;QACX,YAAY;KACb,CAAC;IACF,EAAE,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,IAAI;QACV,YAAY;KACb,CAAC;IACF,GAAG,EAAE,CAAC,WAAmC,EAAyB,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,KAAK;QACX,WAAW;KACZ,CAAC;IACF,MAAM,EAAE,CAAC,GAAW,EAAE,OAAiB,EAA4B,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,OAAO;KACR,CAAC;CACH,CAAC;AAEF,0EAA0E;AAC1E,SAAgB,oBAAoB,CAClC,OAAqC;;IAErC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC;IAE7D,MAAM,YAAY,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE,CAAC;IACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,KAAK,GAA6B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACvE,0BAAkB,CAAC,UAAU,CAC3B,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,kBAAkB,CAC/B,CACF,CAAC;IAEF,OAAO,0BAAkB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAsB,mBAAmB,CACvC,WAAmC,EACnC,OAAwC,EACxC,OAAqC;;;QAErC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAA,YAAY,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE;;oBACR,OAAA,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ;wBACxC,MAAM,CAAC,MAAA,KAAK,CAAC,gBAAgB,mCAAI,CAAC,CAAC,IAAI,WAAW,CAAC,kBAAkB,CAAA;iBAAA,CACxE,CAAC;YACJ,CAAC;YACD,KAAK,KAAK;gBACR,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,6DAA6D,CAC9D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAC1E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,KAAK,IAAI;gBACP,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,4DAA4D,CAC7D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtE,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,KAAK,KAAK;gBACR,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,yBAAyB,mCAAI,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,WAAW,CAAC,GAAG,aAAa,CAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD;gBACE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,CAChC,CAAC;QACN,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { Request } from \"express\";\n\n/** Grant effettivo letto da Accessi. Il confronto usa `tipoAbilitazione >= minPermissionLevel`. */\nexport type AccessiGrant = {\n  codiceMenu: string;\n  tipoAbilitazione?: number;\n};\n\n/** Risultato memoizzato durante una singola autorizzazione. Non modificarlo nel custom handler. */\nexport type GrantsResult = {\n  grants?: AccessiGrant[];\n  [key: string]: unknown;\n};\n\n/** Richiede l'accesso a un menu con almeno il livello indicato. Valori convenzionali: 10 lettura, 20 scrittura. */\nexport type AccessiPermissionRequirement = {\n  type: \"permission\";\n  menuCode: string;\n  minPermissionLevel: number;\n};\n\n/** Tutti i requisiti figli devono essere soddisfatti. Una lista vuota e una configurazione non valida. */\nexport type AccessiAllRequirement = {\n  type: \"and\";\n  requirements: AccessiRequirementNode[];\n};\n\n/** Almeno un requisito figlio deve essere soddisfatto. Una lista vuota e una configurazione non valida. */\nexport type AccessiAnyRequirement = {\n  type: \"or\";\n  requirements: AccessiRequirementNode[];\n};\n\n/** Nega il risultato del requisito figlio. Usarlo con cautela per non creare policy difficili da verificare. */\nexport type AccessiNotRequirement = {\n  type: \"not\";\n  requirement: AccessiRequirementNode;\n};\n\n/** Delega una condizione applicativa a un handler registrato dal backend. */\nexport type AccessiCustomRequirement = {\n  type: \"custom\";\n  key: string;\n  payload?: unknown;\n};\n\n/** Nodo composabile dell'albero di autorizzazione valutato da `authorizeAccessi`. */\nexport type AccessiRequirementNode =\n  | AccessiPermissionRequirement\n  | AccessiAllRequirement\n  | AccessiAnyRequirement\n  | AccessiNotRequirement\n  | AccessiCustomRequirement;\n\n/** Contesto in sola lettura consegnato a un requisito personalizzato. */\nexport type AccessiCustomRequirementContext = {\n  req: Request;\n  decodedToken: Record<string, unknown>;\n  userCode: number;\n  getGrantsResult: () => Promise<GrantsResult>;\n};\n\n/** Handler applicativo per `accessiRequirement.custom`; `false` nega la richiesta, un errore produce 500. */\nexport type AccessiCustomRequirementHandler = (\n  context: AccessiCustomRequirementContext,\n  payload?: unknown\n) => boolean | Promise<boolean>;\n\n/**\n * Policy passata a `authorizeAccessi`.\n * `requirements` e la forma compatibile storica ed equivale a un AND; `requirementTree`\n * permette policy annidate e ha precedenza quando entrambi sono presenti.\n */\nexport type AccessiAuthorizationOptions = {\n  requirements?: { menuCode: string; minPermissionLevel: number }[];\n  requirementTree?: AccessiRequirementNode;\n  customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;\n};\n\n/** Errore di configurazione di una policy, distinto dal normale diniego 403. */\nexport class RequirementEvaluationError extends Error {\n  constructor(public readonly code: string, message: string) {\n    super(message);\n    this.name = \"RequirementEvaluationError\";\n  }\n}\n\nfunction requirementError(code: string, message: string): RequirementEvaluationError {\n  return new RequirementEvaluationError(code, message);\n}\n\n/** Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. */\nexport const accessiRequirement = {\n  permission: (\n    menuCode: string,\n    minPermissionLevel: number\n  ): AccessiPermissionRequirement => ({\n    type: \"permission\",\n    menuCode,\n    minPermissionLevel,\n  }),\n  and: (...requirements: AccessiRequirementNode[]): AccessiAllRequirement => ({\n    type: \"and\",\n    requirements,\n  }),\n  or: (...requirements: AccessiRequirementNode[]): AccessiAnyRequirement => ({\n    type: \"or\",\n    requirements,\n  }),\n  not: (requirement: AccessiRequirementNode): AccessiNotRequirement => ({\n    type: \"not\",\n    requirement,\n  }),\n  custom: (key: string, payload?: unknown): AccessiCustomRequirement => ({\n    type: \"custom\",\n    key,\n    payload,\n  }),\n};\n\n/** Normalizza la forma compatibile `requirements` nell'albero interno. */\nexport function buildRequirementTree(\n  options?: AccessiAuthorizationOptions\n): AccessiRequirementNode | undefined {\n  if (options?.requirementTree) return options.requirementTree;\n\n  const requirements = options?.requirements ?? [];\n  if (requirements.length === 0) return undefined;\n\n  const nodes: AccessiRequirementNode[] = requirements.map((requirement) =>\n    accessiRequirement.permission(\n      requirement.menuCode,\n      requirement.minPermissionLevel\n    )\n  );\n\n  return accessiRequirement.and(...nodes);\n}\n\n/**\n * Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.\n * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.\n */\nexport async function evaluateRequirement(\n  requirement: AccessiRequirementNode,\n  context: AccessiCustomRequirementContext,\n  options?: AccessiAuthorizationOptions\n): Promise<boolean> {\n  switch (requirement.type) {\n    case \"permission\": {\n      const grantsResult = await context.getGrantsResult();\n      const grants = grantsResult.grants ?? [];\n      return grants.some(\n        (grant) =>\n          grant.codiceMenu == requirement.menuCode &&\n          Number(grant.tipoAbilitazione ?? 0) >= requirement.minPermissionLevel\n      );\n    }\n    case \"and\":\n      if (!requirement.requirements || requirement.requirements.length === 0) {\n        throw requirementError(\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n          \"AND requirement must contain at least one child requirement\"\n        );\n      }\n      for (const child of requirement.requirements) {\n        if (!(await evaluateRequirement(child, context, options))) return false;\n      }\n      return true;\n    case \"or\":\n      if (!requirement.requirements || requirement.requirements.length === 0) {\n        throw requirementError(\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n          \"OR requirement must contain at least one child requirement\"\n        );\n      }\n      for (const child of requirement.requirements) {\n        if (await evaluateRequirement(child, context, options)) return true;\n      }\n      return false;\n    case \"not\":\n      return !(await evaluateRequirement(requirement.requirement, context, options));\n    case \"custom\": {\n      const handlers = options?.customRequirementHandlers ?? {};\n      const handler = handlers[requirement.key];\n      if (!handler) {\n        throw requirementError(\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n          `Custom requirement handler \"${requirement.key}\" not found`\n        );\n      }\n      return Boolean(await handler(context, requirement.payload));\n    }\n    default:\n      throw requirementError(\n        \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n        \"Unknown requirement node type\"\n      );\n  }\n}\n"]}

package/dist/accessi-module/middleware/authenticateGen.d.ts

@@ -1,5 +1,5 @@
 import { NextFunction, Request, Response } from "express";
-import { AccessiOptions } from "../AccessiModule";
+import type { AccessiOptions } from "../AccessiModule";
 import { PermissionService } from "../Services/PermissionService/PermissionService";
 import { UserService } from "../Services/UserService/UserService";
 import { AccessiAuthorizationOptions } from "./accessiRequirements";
@@ -8,10 +8,25 @@ export declare class AuthenticateGenService {
     private readonly permissionService;
     private readonly userService;
     constructor(accessiOptions: AccessiOptions, permissionService: PermissionService, userService: UserService);
+    /**
+     * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.
+     * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.
+     */
     authorize(req: Request, res: Response, next: NextFunction, options?: AccessiAuthorizationOptions): Promise<void | Response<any, Record<string, any>>>;
 }
+/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */
 export declare function beginAccessiAuthInitialization(): void;
+/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */
 export declare function setAccessiAuthService(service: AuthenticateGenService): void;
+/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */
 export declare function failAccessiAuthInitialization(error: unknown): void;
+/**
+ * Middleware Express pubblico di Accessi.
+ *
+ * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente
+ * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente
+ * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.
+ */
 export declare function authorizeAccessi(req: Request, res: Response, next: NextFunction, options?: AccessiAuthorizationOptions): Promise<void | Response<any, Record<string, any>>>;
+/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */
 export declare const authenticateGen: typeof authorizeAccessi;

package/dist/accessi-module/middleware/authenticateGen.js

@@ -66,6 +66,8 @@ const UserService_1 = require("../Services/UserService/UserService");
 const Logger_1 = require("../../Logger");
 const accessiRequirements_1 = require("./accessiRequirements");
 const authenticatedToken_1 = require("../security/authenticatedToken");
+const jwtTokenOptions_1 = require("../security/jwtTokenOptions");
+const sessionRevocation_1 = require("../security/sessionRevocation");
 const logger = new Logger_1.Logger("AuthenticateGen");
 const ACCESSI_AUTH_SERVICE_LOCALS_KEY = "accessiAuthService";
 const ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for("emilsoftware.accessiAuthService");
@@ -112,35 +114,58 @@ function logAuthFailure(req, authErr) {
     else
         logger.warning(message);
 }
+/** Sends the documented Accessi error contract from Express middleware. */
+function sendAuthenticationError(res, authErr) {
+    const message = authErr.status === 403
+        ? 'Operazione non autorizzata.'
+        : authErr.status >= 500
+            ? 'Errore interno del modulo Accessi.'
+            : 'Autenticazione non valida o scaduta.';
+    return res.status(authErr.status).json({
+        severity: 'error',
+        status: authErr.status,
+        statusCode: 2,
+        code: authErr.code,
+        // Kept for callers of older versions which already inspected `error`.
+        error: authErr.code,
+        message,
+    });
+}
 function authorizeWithDependencies(req, res, next, options, accessiOptions, permissionService, userService) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
+        const authenticatedRequest = req;
         try {
             const authHeader = req.headers.authorization;
             if (!authHeader) {
                 throw authError(401, "AUTH_HEADER_MISSING", "Authorization header not found");
             }
-            const token = authHeader.split(" ")[1];
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(authHeader);
             if (!token) {
                 throw authError(401, "AUTH_TOKEN_MISSING", "Token not found in Authorization header");
             }
-            const secret = (_b = (_a = accessiOptions === null || accessiOptions === void 0 ? void 0 : accessiOptions.jwtOptions) === null || _a === void 0 ? void 0 : _a.secret) !== null && _b !== void 0 ? _b : process.env.ACC_JWT_SECRET;
-            if (!secret) {
-                throw authError(500, "AUTH_JWT_SECRET_MISSING", "JWT secret not configured");
+            let verification;
+            try {
+                verification = (0, jwtTokenOptions_1.getAccessiAccessTokenVerificationConfig)(accessiOptions);
+            }
+            catch (_a) {
+                throw authError(500, "AUTH_JWT_SECRET_MISSING", "JWT signing key not configured");
             }
             let decoded;
             try {
-                decoded = jwt.verify(token, secret);
+                decoded = jwt.verify(token, verification.key, verification.verifyOptions);
             }
-            catch (_c) {
+            catch (_b) {
                 throw authError(401, "AUTH_TOKEN_INVALID", "Invalid JWT token");
             }
             const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(decoded);
             if (!codiceUtente) {
                 throw authError(401, "AUTH_USER_CODE_MISSING", "codiceUtente not found in token payload");
             }
+            if (yield (0, sessionRevocation_1.isAccessiTokenRevoked)(accessiOptions, decoded, codiceUtente)) {
+                throw authError(401, "AUTH_TOKEN_REVOKED", "Session revoked");
+            }
             const currentUser = yield userService.getAuthenticatedUserSnapshot(codiceUtente);
-            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(decoded, currentUser)) {
                 throw authError(401, "AUTH_USER_DISABLED", "User is no longer authorized");
             }
             const authenticatedPayload = (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(decoded, currentUser);
@@ -166,23 +191,16 @@ function authorizeWithDependencies(req, res, next, options, accessiOptions, perm
                 if (!hasPermissions) {
                     throw authError(403, "AUTH_INSUFFICIENT_PERMISSIONS", "User does not have required permissions");
                 }
-                req.userGrants = yield getGrantsResult();
+                authenticatedRequest.userGrants = yield getGrantsResult();
             }
-            req.user = authenticatedPayload;
-            req.data = authenticatedPayload;
+            authenticatedRequest.user = authenticatedPayload;
+            authenticatedRequest.data = authenticatedPayload;
             return next();
         }
         catch (error) {
             const authErr = normalizeAuthError(error);
             logAuthFailure(req, authErr);
-            const publicMessage = authErr.status === 403
-                ? "Forbidden"
-                : authErr.status >= 500
-                    ? "Internal server error"
-                    : "Unauthorized";
-            return res
-                .status(authErr.status)
-                .json({ message: publicMessage, error: authErr.message, code: authErr.code });
+            return sendAuthenticationError(res, authErr);
         }
     });
 }
@@ -192,6 +210,10 @@ let AuthenticateGenService = class AuthenticateGenService {
         this.permissionService = permissionService;
         this.userService = userService;
     }
+    /**
+     * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.
+     * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.
+     */
     authorize(req, res, next, options) {
         return __awaiter(this, void 0, void 0, function* () {
             return authorizeWithDependencies(req, res, next, options, this.accessiOptions, this.permissionService, this.userService);
@@ -200,7 +222,9 @@ let AuthenticateGenService = class AuthenticateGenService {
 };
 exports.AuthenticateGenService = AuthenticateGenService;
 exports.AuthenticateGenService = AuthenticateGenService = __decorate([
-    (0, common_1.Injectable)(),
+    (0, common_1.Injectable)()
+    /** Nest service behind the Express-compatible `authorizeAccessi` middleware. */
+    ,
     __param(0, (0, common_1.Inject)("ACCESSI_OPTIONS")),
     __metadata("design:paramtypes", [Object, PermissionService_1.PermissionService,
         UserService_1.UserService])
@@ -220,11 +244,13 @@ function isAuthenticateGenService(value) {
     return Boolean(value &&
         typeof value.authorize === "function");
 }
+/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */
 function beginAccessiAuthInitialization() {
     if (!authServiceBootstrapDeferred) {
         authServiceBootstrapDeferred = createDeferred();
     }
 }
+/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */
 function setAccessiAuthService(service) {
     authenticateGenServiceRef = service;
     globalThis[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;
@@ -233,6 +259,7 @@ function setAccessiAuthService(service) {
         authServiceBootstrapDeferred = null;
     }
 }
+/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */
 function failAccessiAuthInitialization(error) {
     if (authServiceBootstrapDeferred) {
         authServiceBootstrapDeferred.reject(error);
@@ -282,26 +309,41 @@ function resolveAccessiAuthService(req) {
         return getAccessiAuthServiceFromRequest(req);
     });
 }
+/**
+ * Middleware Express pubblico di Accessi.
+ *
+ * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente
+ * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente
+ * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.
+ */
 function authorizeAccessi(req, res, next, options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         const authService = yield resolveAccessiAuthService(req);
         if (!authService) {
             const status = authServiceBootstrapDeferred ? 503 : 500;
-            const message = authServiceBootstrapDeferred
-                ? "Accessi authentication service is still initializing"
-                : "Accessi authentication service not initialized";
+            const code = authServiceBootstrapDeferred
+                ? 'ACCESSI_AUTH_INITIALIZING'
+                : 'ACCESSI_AUTH_NOT_INITIALIZED';
             logger.error(`Authentication service not initialized ${JSON.stringify({
                 method: req.method,
                 path: (_a = req.originalUrl) !== null && _a !== void 0 ? _a : req.url,
                 status,
             })}`);
-            return res
-                .status(status)
-                .json({ message });
+            return res.status(status).json({
+                severity: 'error',
+                status,
+                statusCode: 2,
+                code,
+                error: code,
+                message: status === 503
+                    ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'
+                    : 'Il modulo Accessi non e disponibile.',
+            });
         }
         return authService.authorize(req, res, next, options);
     });
 }
+/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */
 exports.authenticateGen = authorizeAccessi;
 //# sourceMappingURL=authenticateGen.js.map

package/dist/accessi-module/middleware/authenticateGen.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuPA,wEAIC;AAED,sDAOC;AAED,sEAKC;AAqDD,4CA0BC;AAzVD,kDAAoC;AACpC,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAIwC;AAExC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;;QAExB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAA,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,UAAU,0CAAE,MAAM,mCAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAChF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,OAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAEA,GAAW,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YACpD,CAAC;YAEA,GAAW,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACxC,GAAW,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACzC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,aAAa,GACjB,OAAO,CAAC,MAAM,KAAK,GAAG;gBACpB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;oBACrB,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,cAAc,CAAC;YACvB,OAAO,GAAG;iBACP,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;iBACtB,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CAAA;AAGM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEC,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AAxBY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CAwBlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,OAAO,GAAG,4BAA4B;gBAC1C,CAAC,CAAC,sDAAsD;gBACxD,CAAC,CAAC,gDAAgD,CAAC;YACrD,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG;iBACP,MAAM,CAAC,MAAM,CAAC;iBACd,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvB,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAEY,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\r\nimport * as jwt from \"jsonwebtoken\";\r\nimport { Inject, Injectable } from \"@nestjs/common\";\r\nimport { AccessiOptions } from \"../AccessiModule\";\r\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\r\nimport { UserService } from \"../Services/UserService/UserService\";\r\nimport { Logger } from \"../../Logger\";\r\nimport {\r\n  AccessiAuthorizationOptions,\r\n  AccessiCustomRequirementContext,\r\n  GrantsResult,\r\n  RequirementEvaluationError,\r\n  buildRequirementTree,\r\n  evaluateRequirement,\r\n} from \"./accessiRequirements\";\r\nimport {\r\n  buildAuthenticatedTokenPayload,\r\n  isAuthenticatedUserEnabledForJwt,\r\n  resolveCodiceUtenteFromTokenPayload,\r\n} from \"../security/authenticatedToken\";\r\n\r\nconst logger = new Logger(\"AuthenticateGen\");\r\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\r\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\r\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\r\n\r\ntype Deferred<T> = {\r\n  promise: Promise<T>;\r\n  resolve: (value: T) => void;\r\n  reject: (reason?: unknown) => void;\r\n};\r\n\r\nclass AuthMiddlewareError extends Error {\r\n  constructor(\r\n    public readonly status: number,\r\n    public readonly code: string,\r\n    message: string,\r\n    public readonly details?: Record<string, unknown>\r\n  ) {\r\n    super(message);\r\n    this.name = \"AuthMiddlewareError\";\r\n  }\r\n}\r\n\r\nfunction authError(\r\n  status: number,\r\n  code: string,\r\n  message: string,\r\n  details?: Record<string, unknown>\r\n) {\r\n  return new AuthMiddlewareError(status, code, message, details);\r\n}\r\n\r\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\r\n  if (error instanceof AuthMiddlewareError) return error;\r\n  if (error instanceof RequirementEvaluationError) {\r\n    return authError(500, error.code, error.message);\r\n  }\r\n  if (error instanceof Error) {\r\n    return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\r\n      originalError: error.name,\r\n    });\r\n  }\r\n  return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\r\n}\r\n\r\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\r\n  const payload = {\r\n    code: authErr.code,\r\n    status: authErr.status,\r\n    message: authErr.message,\r\n    details: authErr.details,\r\n    method: req.method,\r\n    path: req.originalUrl ?? req.url,\r\n    ip: req.ip,\r\n  };\r\n\r\n  const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\r\n  if (authErr.status >= 500) logger.error(message);\r\n  else logger.warning(message);\r\n}\r\n\r\nasync function authorizeWithDependencies(\r\n  req: Request,\r\n  res: Response,\r\n  next: NextFunction,\r\n  options: AccessiAuthorizationOptions | undefined,\r\n  accessiOptions: AccessiOptions,\r\n  permissionService: PermissionService,\r\n  userService: UserService\r\n) {\r\n  try {\r\n    const authHeader = req.headers.authorization;\r\n    if (!authHeader) {\r\n      throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\r\n    }\r\n\r\n    const token = authHeader.split(\" \")[1];\r\n    if (!token) {\r\n      throw authError(\r\n        401,\r\n        \"AUTH_TOKEN_MISSING\",\r\n        \"Token not found in Authorization header\"\r\n      );\r\n    }\r\n\r\n    const secret = accessiOptions?.jwtOptions?.secret ?? process.env.ACC_JWT_SECRET;\r\n    if (!secret) {\r\n      throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT secret not configured\");\r\n    }\r\n\r\n    let decoded: any;\r\n    try {\r\n      decoded = jwt.verify(token, secret);\r\n    } catch {\r\n      throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\r\n    }\r\n\r\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\r\n    if (!codiceUtente) {\r\n      throw authError(\r\n        401,\r\n        \"AUTH_USER_CODE_MISSING\",\r\n        \"codiceUtente not found in token payload\"\r\n      );\r\n    }\r\n\r\n    const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\r\n    if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\r\n      throw authError(\r\n        401,\r\n        \"AUTH_USER_DISABLED\",\r\n        \"User is no longer authorized\"\r\n      );\r\n    }\r\n\r\n    const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\r\n\r\n    const requirementTree = buildRequirementTree(options);\r\n    if (requirementTree) {\r\n      if (!accessiOptions?.databaseOptions) {\r\n        throw authError(\r\n          500,\r\n          \"AUTH_DATABASE_OPTIONS_MISSING\",\r\n          \"Database options not configured\"\r\n        );\r\n      }\r\n\r\n      let grantsResultCache: GrantsResult | null = null;\r\n      const getGrantsResult = async () => {\r\n        if (!grantsResultCache) {\r\n          grantsResultCache = await permissionService.getUserRolesAndGrants(\r\n            codiceUtente\r\n          );\r\n        }\r\n        return grantsResultCache;\r\n      };\r\n\r\n      const requirementContext: AccessiCustomRequirementContext = {\r\n        req,\r\n        decodedToken: authenticatedPayload,\r\n        userCode: codiceUtente,\r\n        getGrantsResult,\r\n      };\r\n\r\n      const hasPermissions = await evaluateRequirement(\r\n        requirementTree,\r\n        requirementContext,\r\n        options\r\n      );\r\n\r\n      if (!hasPermissions) {\r\n        throw authError(\r\n          403,\r\n          \"AUTH_INSUFFICIENT_PERMISSIONS\",\r\n          \"User does not have required permissions\"\r\n        );\r\n      }\r\n\r\n      (req as any).userGrants = await getGrantsResult();\r\n    }\r\n\r\n    (req as any).user = authenticatedPayload;\r\n    (req as any).data = authenticatedPayload;\r\n    return next();\r\n  } catch (error: unknown) {\r\n    const authErr = normalizeAuthError(error);\r\n    logAuthFailure(req, authErr);\r\n    const publicMessage =\r\n      authErr.status === 403\r\n        ? \"Forbidden\"\r\n        : authErr.status >= 500\r\n          ? \"Internal server error\"\r\n          : \"Unauthorized\";\r\n    return res\r\n      .status(authErr.status)\r\n      .json({ message: publicMessage, error: authErr.message, code: authErr.code });\r\n  }\r\n}\r\n\r\n@Injectable()\r\nexport class AuthenticateGenService {\r\n  constructor(\r\n    @Inject(\"ACCESSI_OPTIONS\")\r\n    private readonly accessiOptions: AccessiOptions,\r\n    private readonly permissionService: PermissionService,\r\n    private readonly userService: UserService\r\n  ) { }\r\n\r\n  async authorize(\r\n    req: Request,\r\n    res: Response,\r\n    next: NextFunction,\r\n    options?: AccessiAuthorizationOptions\r\n  ) {\r\n    return authorizeWithDependencies(\r\n      req,\r\n      res,\r\n      next,\r\n      options,\r\n      this.accessiOptions,\r\n      this.permissionService,\r\n      this.userService\r\n    );\r\n  }\r\n}\r\n\r\nlet authenticateGenServiceRef: AuthenticateGenService | null = null;\r\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> | null = null;\r\n\r\nfunction createDeferred<T>(): Deferred<T> {\r\n  let resolve!: (value: T) => void;\r\n  let reject!: (reason?: unknown) => void;\r\n  const promise = new Promise<T>((res, rej) => {\r\n    resolve = res;\r\n    reject = rej;\r\n  });\r\n  return { promise, resolve, reject };\r\n}\r\n\r\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\r\n  return Boolean(\r\n    value &&\r\n    typeof (value as { authorize?: unknown }).authorize === \"function\"\r\n  );\r\n}\r\n\r\nexport function beginAccessiAuthInitialization() {\r\n  if (!authServiceBootstrapDeferred) {\r\n    authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\r\n  }\r\n}\r\n\r\nexport function setAccessiAuthService(service: AuthenticateGenService) {\r\n  authenticateGenServiceRef = service;\r\n  (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\r\n  if (authServiceBootstrapDeferred) {\r\n    authServiceBootstrapDeferred.resolve(service);\r\n    authServiceBootstrapDeferred = null;\r\n  }\r\n}\r\n\r\nexport function failAccessiAuthInitialization(error: unknown) {\r\n  if (authServiceBootstrapDeferred) {\r\n    authServiceBootstrapDeferred.reject(error);\r\n    authServiceBootstrapDeferred = null;\r\n  }\r\n}\r\n\r\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService | null {\r\n  const appLocalsService = (req.app?.locals as Record<string, unknown> | undefined)?.[\r\n    ACCESSI_AUTH_SERVICE_LOCALS_KEY\r\n  ];\r\n\r\n  if (isAuthenticateGenService(appLocalsService)) {\r\n    return appLocalsService as AuthenticateGenService;\r\n  }\r\n\r\n  const globalService = (globalThis as Record<symbol, unknown>)[\r\n    ACCESSI_AUTH_SERVICE_GLOBAL_KEY\r\n  ];\r\n  if (isAuthenticateGenService(globalService)) {\r\n    return globalService as AuthenticateGenService;\r\n  }\r\n\r\n  return authenticateGenServiceRef;\r\n}\r\n\r\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService | null> {\r\n  if (!authServiceBootstrapDeferred) {\r\n    return null;\r\n  }\r\n\r\n  const bootstrapPromise = authServiceBootstrapDeferred.promise;\r\n  const timeoutPromise = new Promise<null>((resolve) => {\r\n    setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\r\n  });\r\n\r\n  try {\r\n    const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\r\n    return isAuthenticateGenService(resolved) ? resolved : null;\r\n  } catch {\r\n    return null;\r\n  }\r\n}\r\n\r\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService | null> {\r\n  const immediateService = getAccessiAuthServiceFromRequest(req);\r\n  if (immediateService) {\r\n    return immediateService;\r\n  }\r\n\r\n  const bootstrappedService = await waitForBootstrappedService();\r\n  if (bootstrappedService) {\r\n    return bootstrappedService;\r\n  }\r\n\r\n  return getAccessiAuthServiceFromRequest(req);\r\n}\r\n\r\nexport async function authorizeAccessi(\r\n  req: Request,\r\n  res: Response,\r\n  next: NextFunction,\r\n  options?: AccessiAuthorizationOptions\r\n) {\r\n  const authService = await resolveAccessiAuthService(req);\r\n\r\n  if (!authService) {\r\n    const status = authServiceBootstrapDeferred ? 503 : 500;\r\n    const message = authServiceBootstrapDeferred\r\n      ? \"Accessi authentication service is still initializing\"\r\n      : \"Accessi authentication service not initialized\";\r\n    logger.error(\r\n      `Authentication service not initialized ${JSON.stringify({\r\n        method: req.method,\r\n        path: req.originalUrl ?? req.url,\r\n        status,\r\n      })}`\r\n    );\r\n    return res\r\n      .status(status)\r\n      .json({ message });\r\n  }\r\n\r\n  return authService.authorize(req, res, next, options);\r\n}\r\n\r\nexport const authenticateGen = authorizeAccessi;\r\n"]}
+{"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyRA,wEAIC;AAGD,sDAOC;AAGD,sEAKC;AA4DD,4CAiCC;AA3YD,kDAAoC;AACpC,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAMwC;AACxC,iEAAsF;AACtF,qEAAsE;AAEtE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,GAAa,EAAE,OAA4B;IAC1E,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;YACrB,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,sCAAsC,CAAC;IAE/C,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,sEAAsE;QACtE,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;QAOxB,MAAM,oBAAoB,GAAG,GAA2B,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,IAAI,YAAwE,CAAC;YAC7E,IAAI,CAAC;gBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,cAAc,CAAC,CAAC;YACzE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,gCAAgC,CAAC,CAAC;YACpF,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5E,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBAClG,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,oBAAoB,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5D,CAAC;YAED,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CAAA;AAIM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEL;;;OAGG;IACG,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA5BY,wDAAsB;iCAAtB,sBAAsB;IAFlC,IAAA,mBAAU,GAAE;IACb,gFAAgF;;IAG3E,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CA4BlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED;;;;;;GAMG;AACH,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,IAAI,GAAG,4BAA4B;gBACvC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,8BAA8B,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,CAAC;gBACb,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,sCAAsC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAED,mIAAmI;AACtH,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\nimport * as jwt from \"jsonwebtoken\";\nimport { Inject, Injectable } from \"@nestjs/common\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\nimport { UserService } from \"../Services/UserService/UserService\";\nimport { Logger } from \"../../Logger\";\nimport {\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  GrantsResult,\n  RequirementEvaluationError,\n  buildRequirementTree,\n  evaluateRequirement,\n} from \"./accessiRequirements\";\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../security/authenticatedToken\";\nimport { getAccessiAccessTokenVerificationConfig } from \"../security/jwtTokenOptions\";\nimport { isAccessiTokenRevoked } from \"../security/sessionRevocation\";\n\nconst logger = new Logger(\"AuthenticateGen\");\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\n\ntype Deferred<T> = {\n  promise: Promise<T>;\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n};\n\nclass AuthMiddlewareError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n    public readonly details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = \"AuthMiddlewareError\";\n  }\n}\n\nfunction authError(\n  status: number,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>\n) {\n  return new AuthMiddlewareError(status, code, message, details);\n}\n\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\n  if (error instanceof AuthMiddlewareError) return error;\n  if (error instanceof RequirementEvaluationError) {\n    return authError(500, error.code, error.message);\n  }\n  if (error instanceof Error) {\n    return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\n      originalError: error.name,\n    });\n  }\n  return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\n}\n\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\n  const payload = {\n    code: authErr.code,\n    status: authErr.status,\n    message: authErr.message,\n    details: authErr.details,\n    method: req.method,\n    path: req.originalUrl ?? req.url,\n    ip: req.ip,\n  };\n\n  const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\n  if (authErr.status >= 500) logger.error(message);\n  else logger.warning(message);\n}\n\n/** Sends the documented Accessi error contract from Express middleware. */\nfunction sendAuthenticationError(res: Response, authErr: AuthMiddlewareError): Response {\n  const message =\n    authErr.status === 403\n      ? 'Operazione non autorizzata.'\n      : authErr.status >= 500\n        ? 'Errore interno del modulo Accessi.'\n        : 'Autenticazione non valida o scaduta.';\n\n  return res.status(authErr.status).json({\n    severity: 'error',\n    status: authErr.status,\n    statusCode: 2,\n    code: authErr.code,\n    // Kept for callers of older versions which already inspected `error`.\n    error: authErr.code,\n    message,\n  });\n}\n\nasync function authorizeWithDependencies(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options: AccessiAuthorizationOptions | undefined,\n  accessiOptions: AccessiOptions,\n  permissionService: PermissionService,\n  userService: UserService\n) {\n  type AuthenticatedRequest = Request & {\n    userGrants?: unknown;\n    user?: unknown;\n    data?: unknown;\n  };\n  const authenticatedRequest = req as AuthenticatedRequest;\n\n  try {\n    const authHeader = req.headers.authorization;\n    if (!authHeader) {\n      throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\n    }\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) {\n      throw authError(\n        401,\n        \"AUTH_TOKEN_MISSING\",\n        \"Token not found in Authorization header\"\n      );\n    }\n\n    let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n    try {\n      verification = getAccessiAccessTokenVerificationConfig(accessiOptions);\n    } catch {\n      throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT signing key not configured\");\n    }\n\n    let decoded: unknown;\n    try {\n      decoded = jwt.verify(token, verification.key, verification.verifyOptions);\n    } catch {\n      throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n    if (!codiceUtente) {\n      throw authError(\n        401,\n        \"AUTH_USER_CODE_MISSING\",\n        \"codiceUtente not found in token payload\"\n      );\n    }\n    if (await isAccessiTokenRevoked(accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n      throw authError(401, \"AUTH_TOKEN_REVOKED\", \"Session revoked\");\n    }\n\n    const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw authError(\n        401,\n        \"AUTH_USER_DISABLED\",\n        \"User is no longer authorized\"\n      );\n    }\n\n    const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\n\n    const requirementTree = buildRequirementTree(options);\n    if (requirementTree) {\n      if (!accessiOptions?.databaseOptions) {\n        throw authError(\n          500,\n          \"AUTH_DATABASE_OPTIONS_MISSING\",\n          \"Database options not configured\"\n        );\n      }\n\n      let grantsResultCache: GrantsResult | null = null;\n      const getGrantsResult = async () => {\n        if (!grantsResultCache) {\n          grantsResultCache = await permissionService.getUserRolesAndGrants(\n            codiceUtente\n          );\n        }\n        return grantsResultCache;\n      };\n\n      const requirementContext: AccessiCustomRequirementContext = {\n        req,\n        decodedToken: authenticatedPayload,\n        userCode: codiceUtente,\n        getGrantsResult,\n      };\n\n      const hasPermissions = await evaluateRequirement(\n        requirementTree,\n        requirementContext,\n        options\n      );\n\n      if (!hasPermissions) {\n        throw authError(\n          403,\n          \"AUTH_INSUFFICIENT_PERMISSIONS\",\n          \"User does not have required permissions\"\n        );\n      }\n\n      authenticatedRequest.userGrants = await getGrantsResult();\n    }\n\n    authenticatedRequest.user = authenticatedPayload;\n    authenticatedRequest.data = authenticatedPayload;\n    return next();\n  } catch (error: unknown) {\n    const authErr = normalizeAuthError(error);\n    logAuthFailure(req, authErr);\n    return sendAuthenticationError(res, authErr);\n  }\n}\n\n@Injectable()\n/** Nest service behind the Express-compatible `authorizeAccessi` middleware. */\nexport class AuthenticateGenService {\n  constructor(\n    @Inject(\"ACCESSI_OPTIONS\")\n    private readonly accessiOptions: AccessiOptions,\n    private readonly permissionService: PermissionService,\n    private readonly userService: UserService\n  ) { }\n\n  /**\n   * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.\n   * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.\n   */\n  async authorize(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    options?: AccessiAuthorizationOptions\n  ) {\n    return authorizeWithDependencies(\n      req,\n      res,\n      next,\n      options,\n      this.accessiOptions,\n      this.permissionService,\n      this.userService\n    );\n  }\n}\n\nlet authenticateGenServiceRef: AuthenticateGenService | null = null;\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> | null = null;\n\nfunction createDeferred<T>(): Deferred<T> {\n  let resolve!: (value: T) => void;\n  let reject!: (reason?: unknown) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej;\n  });\n  return { promise, resolve, reject };\n}\n\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\n  return Boolean(\n    value &&\n    typeof (value as { authorize?: unknown }).authorize === \"function\"\n  );\n}\n\n/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */\nexport function beginAccessiAuthInitialization() {\n  if (!authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\n  }\n}\n\n/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */\nexport function setAccessiAuthService(service: AuthenticateGenService) {\n  authenticateGenServiceRef = service;\n  (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.resolve(service);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\n/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */\nexport function failAccessiAuthInitialization(error: unknown) {\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.reject(error);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService | null {\n  const appLocalsService = (req.app?.locals as Record<string, unknown> | undefined)?.[\n    ACCESSI_AUTH_SERVICE_LOCALS_KEY\n  ];\n\n  if (isAuthenticateGenService(appLocalsService)) {\n    return appLocalsService as AuthenticateGenService;\n  }\n\n  const globalService = (globalThis as Record<symbol, unknown>)[\n    ACCESSI_AUTH_SERVICE_GLOBAL_KEY\n  ];\n  if (isAuthenticateGenService(globalService)) {\n    return globalService as AuthenticateGenService;\n  }\n\n  return authenticateGenServiceRef;\n}\n\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService | null> {\n  if (!authServiceBootstrapDeferred) {\n    return null;\n  }\n\n  const bootstrapPromise = authServiceBootstrapDeferred.promise;\n  const timeoutPromise = new Promise<null>((resolve) => {\n    setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\n  });\n\n  try {\n    const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\n    return isAuthenticateGenService(resolved) ? resolved : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService | null> {\n  const immediateService = getAccessiAuthServiceFromRequest(req);\n  if (immediateService) {\n    return immediateService;\n  }\n\n  const bootstrappedService = await waitForBootstrappedService();\n  if (bootstrappedService) {\n    return bootstrappedService;\n  }\n\n  return getAccessiAuthServiceFromRequest(req);\n}\n\n/**\n * Middleware Express pubblico di Accessi.\n *\n * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente\n * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente\n * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.\n */\nexport async function authorizeAccessi(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options?: AccessiAuthorizationOptions\n) {\n  const authService = await resolveAccessiAuthService(req);\n\n  if (!authService) {\n    const status = authServiceBootstrapDeferred ? 503 : 500;\n    const code = authServiceBootstrapDeferred\n      ? 'ACCESSI_AUTH_INITIALIZING'\n      : 'ACCESSI_AUTH_NOT_INITIALIZED';\n    logger.error(\n      `Authentication service not initialized ${JSON.stringify({\n        method: req.method,\n        path: req.originalUrl ?? req.url,\n        status,\n      })}`\n    );\n    return res.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: 2,\n      code,\n      error: code,\n      message: status === 503\n        ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'\n        : 'Il modulo Accessi non e disponibile.',\n    });\n  }\n\n  return authService.authorize(req, res, next, options);\n}\n\n/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */\nexport const authenticateGen = authorizeAccessi;\n"]}

package/dist/accessi-module/security/AccessiHttpExceptionFilter.d.ts

@@ -0,0 +1,12 @@
+import { ArgumentsHost, ExceptionFilter } from '@nestjs/common';
+/**
+ * Finalizes every exception raised before an Accessi controller can reply.
+ *
+ * This includes invalid JSON, validation-pipe errors and guard failures. The
+ * filter deliberately never return SQL, stack traces or provider diagnostics.
+ */
+export declare class AccessiHttpExceptionFilter implements ExceptionFilter {
+    catch(exception: unknown, host: ArgumentsHost): void;
+    private getPayload;
+    private isInvalidJson;
+}