emilsoftware-utilities 2.0.0-dev.7 → 2.0.0-dev.70

package/dist/accessi/contracts/dtos.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * DTO server-side Accessi.
+ *
+ * Questi modelli usano `class-validator`, `class-transformer` e i decoratori
+ * OpenAPI di Nest. Sono adatti a backend e test, non a bundle frontend leggeri:
+ * per i frontend usare i tipi generati dal client OpenAPI.
+ */
+__exportStar(require("../../accessi-module/Dtos"), exports);
+//# sourceMappingURL=dtos.js.map

package/dist/accessi/contracts/dtos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dtos.js","sourceRoot":"","sources":["../../../src/accessi/contracts/dtos.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,4DAA0C","sourcesContent":["/**\n * DTO server-side Accessi.\n *\n * Questi modelli usano `class-validator`, `class-transformer` e i decoratori\n * OpenAPI di Nest. Sono adatti a backend e test, non a bundle frontend leggeri:\n * per i frontend usare i tipi generati dal client OpenAPI.\n */\nexport * from \"../../accessi-module/Dtos\";\n"]}

package/dist/accessi/contracts/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Contratti Accessi browser-safe.
+ *
+ * Questo entry point non importa NestJS, il database, SMTP o servizi server.
+ * Contiene solo tipi, enum e helper puri condivisibili da backend, frontend e
+ * resource server.
+ */
+export { StatoRegistrazione, StatoRegistrazioneValues } from "../../accessi-module/Dtos/StatoRegistrazione";
+export { TipoAbilitazione } from "../../accessi-module/Dtos/TipoAbilitazione";
+export { accessiRequirement, buildRequirementTree, evaluateRequirement, RequirementEvaluationError, } from "../../accessi-module/middleware/accessiRequirements";
+export type { AccessiGrant, GrantsResult, AccessiPermissionRequirement, AccessiAllRequirement, AccessiAnyRequirement, AccessiNotRequirement, AccessiCustomRequirement, AccessiRequirementNode, AccessiAuthorizationOptions, AccessiCustomRequirementContext, AccessiCustomRequirementHandler, } from "../../accessi-module/middleware/accessiRequirements";
+export { extractAccessiBearerToken, resolveCodiceUtenteFromTokenPayload, buildAuthenticatedTokenPayload, isLoginAsTokenPayload, isAccessiTokenAllowedForUser, isAuthenticatedUserEnabledForJwt, } from "../../accessi-module/security/authenticatedToken";
+export type { AccessiAuthenticatedUserSnapshot, } from "../../accessi-module/security/authenticatedToken";
+/** Payload di un access token Accessi verificato. Le claim extra restano disponibili. */
+export interface AccessiAccessTokenPayload extends Record<string, unknown> {
+    /** Obbligatorio: distingue un access token da reset token e token 2FA. */
+    typ: "access";
+    /** Metodi di autenticazione usati (es. `password`, `otp`, `login_as`). */
+    amr?: string[];
+    codiceUtente?: number;
+    utente?: Record<string, unknown>;
+    userData?: {
+        utente?: Record<string, unknown>;
+    };
+}

package/dist/accessi/contracts/index.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAuthenticatedUserEnabledForJwt = exports.isAccessiTokenAllowedForUser = exports.isLoginAsTokenPayload = exports.buildAuthenticatedTokenPayload = exports.resolveCodiceUtenteFromTokenPayload = exports.extractAccessiBearerToken = exports.RequirementEvaluationError = exports.evaluateRequirement = exports.buildRequirementTree = exports.accessiRequirement = exports.TipoAbilitazione = exports.StatoRegistrazioneValues = exports.StatoRegistrazione = void 0;
+/**
+ * Contratti Accessi browser-safe.
+ *
+ * Questo entry point non importa NestJS, il database, SMTP o servizi server.
+ * Contiene solo tipi, enum e helper puri condivisibili da backend, frontend e
+ * resource server.
+ */
+var StatoRegistrazione_1 = require("../../accessi-module/Dtos/StatoRegistrazione");
+Object.defineProperty(exports, "StatoRegistrazione", { enumerable: true, get: function () { return StatoRegistrazione_1.StatoRegistrazione; } });
+Object.defineProperty(exports, "StatoRegistrazioneValues", { enumerable: true, get: function () { return StatoRegistrazione_1.StatoRegistrazioneValues; } });
+var TipoAbilitazione_1 = require("../../accessi-module/Dtos/TipoAbilitazione");
+Object.defineProperty(exports, "TipoAbilitazione", { enumerable: true, get: function () { return TipoAbilitazione_1.TipoAbilitazione; } });
+var accessiRequirements_1 = require("../../accessi-module/middleware/accessiRequirements");
+Object.defineProperty(exports, "accessiRequirement", { enumerable: true, get: function () { return accessiRequirements_1.accessiRequirement; } });
+Object.defineProperty(exports, "buildRequirementTree", { enumerable: true, get: function () { return accessiRequirements_1.buildRequirementTree; } });
+Object.defineProperty(exports, "evaluateRequirement", { enumerable: true, get: function () { return accessiRequirements_1.evaluateRequirement; } });
+Object.defineProperty(exports, "RequirementEvaluationError", { enumerable: true, get: function () { return accessiRequirements_1.RequirementEvaluationError; } });
+var authenticatedToken_1 = require("../../accessi-module/security/authenticatedToken");
+Object.defineProperty(exports, "extractAccessiBearerToken", { enumerable: true, get: function () { return authenticatedToken_1.extractAccessiBearerToken; } });
+Object.defineProperty(exports, "resolveCodiceUtenteFromTokenPayload", { enumerable: true, get: function () { return authenticatedToken_1.resolveCodiceUtenteFromTokenPayload; } });
+Object.defineProperty(exports, "buildAuthenticatedTokenPayload", { enumerable: true, get: function () { return authenticatedToken_1.buildAuthenticatedTokenPayload; } });
+Object.defineProperty(exports, "isLoginAsTokenPayload", { enumerable: true, get: function () { return authenticatedToken_1.isLoginAsTokenPayload; } });
+Object.defineProperty(exports, "isAccessiTokenAllowedForUser", { enumerable: true, get: function () { return authenticatedToken_1.isAccessiTokenAllowedForUser; } });
+Object.defineProperty(exports, "isAuthenticatedUserEnabledForJwt", { enumerable: true, get: function () { return authenticatedToken_1.isAuthenticatedUserEnabledForJwt; } });
+//# sourceMappingURL=index.js.map

package/dist/accessi/contracts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/contracts/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,mFAA4G;AAAnG,wHAAA,kBAAkB,OAAA;AAAE,8HAAA,wBAAwB,OAAA;AACrD,+EAA8E;AAArE,oHAAA,gBAAgB,OAAA;AAEzB,2FAK6D;AAJ3D,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,0HAAA,mBAAmB,OAAA;AACnB,iIAAA,0BAA0B,OAAA;AAiB5B,uFAO0D;AANxD,+HAAA,yBAAyB,OAAA;AACzB,yIAAA,mCAAmC,OAAA;AACnC,oIAAA,8BAA8B,OAAA;AAC9B,2HAAA,qBAAqB,OAAA;AACrB,kIAAA,4BAA4B,OAAA;AAC5B,sIAAA,gCAAgC,OAAA","sourcesContent":["/**\n * Contratti Accessi browser-safe.\n *\n * Questo entry point non importa NestJS, il database, SMTP o servizi server.\n * Contiene solo tipi, enum e helper puri condivisibili da backend, frontend e\n * resource server.\n */\nexport { StatoRegistrazione, StatoRegistrazioneValues } from \"../../accessi-module/Dtos/StatoRegistrazione\";\nexport { TipoAbilitazione } from \"../../accessi-module/Dtos/TipoAbilitazione\";\n\nexport {\n  accessiRequirement,\n  buildRequirementTree,\n  evaluateRequirement,\n  RequirementEvaluationError,\n} from \"../../accessi-module/middleware/accessiRequirements\";\n\nexport type {\n  AccessiGrant,\n  GrantsResult,\n  AccessiPermissionRequirement,\n  AccessiAllRequirement,\n  AccessiAnyRequirement,\n  AccessiNotRequirement,\n  AccessiCustomRequirement,\n  AccessiRequirementNode,\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  AccessiCustomRequirementHandler,\n} from \"../../accessi-module/middleware/accessiRequirements\";\n\nexport {\n  extractAccessiBearerToken,\n  resolveCodiceUtenteFromTokenPayload,\n  buildAuthenticatedTokenPayload,\n  isLoginAsTokenPayload,\n  isAccessiTokenAllowedForUser,\n  isAuthenticatedUserEnabledForJwt,\n} from \"../../accessi-module/security/authenticatedToken\";\n\nexport type {\n  AccessiAuthenticatedUserSnapshot,\n} from \"../../accessi-module/security/authenticatedToken\";\n\n/** Payload di un access token Accessi verificato. Le claim extra restano disponibili. */\nexport interface AccessiAccessTokenPayload extends Record<string, unknown> {\n  /** Obbligatorio: distingue un access token da reset token e token 2FA. */\n  typ: \"access\";\n  /** Metodi di autenticazione usati (es. `password`, `otp`, `login_as`). */\n  amr?: string[];\n  codiceUtente?: number;\n  utente?: Record<string, unknown>;\n  userData?: { utente?: Record<string, unknown> };\n}\n"]}

package/dist/accessi/openapi/index.d.ts

@@ -0,0 +1,2 @@
+export * from "../../openapi/OpenApiConfig";
+export * from "../../openapi/OpenApiMerge";

package/dist/accessi/openapi/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../../openapi/OpenApiConfig"), exports);
+__exportStar(require("../../openapi/OpenApiMerge"), exports);
+//# sourceMappingURL=index.js.map

package/dist/accessi/openapi/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/openapi/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8DAA4C;AAC5C,6DAA2C","sourcesContent":["export * from \"../../openapi/OpenApiConfig\";\nexport * from \"../../openapi/OpenApiMerge\";\n"]}

package/dist/accessi/resource-server/core.d.ts

@@ -0,0 +1,6 @@
+export * from "./types";
+export * from "./keys";
+export * from "./errors";
+export * from "./token";
+export * from "./introspection";
+export * from "./runtime";

package/dist/accessi/resource-server/core.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./keys"), exports);
+__exportStar(require("./errors"), exports);
+__exportStar(require("./token"), exports);
+__exportStar(require("./introspection"), exports);
+__exportStar(require("./runtime"), exports);
+//# sourceMappingURL=core.js.map

package/dist/accessi/resource-server/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/core.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,yCAAuB;AACvB,2CAAyB;AACzB,0CAAwB;AACxB,kDAAgC;AAChC,4CAA0B","sourcesContent":["export * from \"./types\";\nexport * from \"./keys\";\nexport * from \"./errors\";\nexport * from \"./token\";\nexport * from \"./introspection\";\nexport * from \"./runtime\";\n"]}

package/dist/accessi/resource-server/errors.d.ts

@@ -0,0 +1,10 @@
+/** Codici stabili del resource server, allineati al contratto HTTP Accessi. */
+export type AccessiResourceServerErrorCode = "AUTH_HEADER_MISSING" | "AUTH_TOKEN_MISSING" | "AUTH_TOKEN_INVALID" | "AUTH_USER_CODE_MISSING" | "AUTH_USER_DISABLED" | "AUTH_TOKEN_REVOKED" | "AUTH_INSUFFICIENT_PERMISSIONS" | "AUTH_CONFIG_INVALID" | "AUTH_GRANTS_SOURCE_MISSING" | "AUTH_INTROSPECTION_UNAVAILABLE" | "AUTH_INTROSPECTION_UNAUTHORIZED" | "AUTH_JWKS_UNAVAILABLE" | "AUTH_INTERNAL_ERROR";
+/** Errore tipizzato del resource server, convertibile in risposta HTTP o eccezione Nest. */
+export declare class AccessiResourceServerError extends Error {
+    readonly status: number;
+    readonly code: AccessiResourceServerErrorCode;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(status: number, code: AccessiResourceServerErrorCode, message: string, details?: Record<string, unknown> | undefined);
+}
+export declare function accessiAuthError(status: number, code: AccessiResourceServerErrorCode, message: string, details?: Record<string, unknown>): AccessiResourceServerError;

package/dist/accessi/resource-server/errors.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiResourceServerError = void 0;
+exports.accessiAuthError = accessiAuthError;
+/** Errore tipizzato del resource server, convertibile in risposta HTTP o eccezione Nest. */
+class AccessiResourceServerError extends Error {
+    constructor(status, code, message, details) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.details = details;
+        this.name = "AccessiResourceServerError";
+    }
+}
+exports.AccessiResourceServerError = AccessiResourceServerError;
+function accessiAuthError(status, code, message, details) {
+    return new AccessiResourceServerError(status, code, message, details);
+}
+//# sourceMappingURL=errors.js.map

package/dist/accessi/resource-server/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/errors.ts"],"names":[],"mappings":";;;AA6BA,4CAOC;AApBD,4FAA4F;AAC5F,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YACkB,MAAc,EACd,IAAoC,EACpD,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAgC;QAEpC,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAVD,gEAUC;AAED,SAAgB,gBAAgB,CAC9B,MAAc,EACd,IAAoC,EACpC,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,0BAA0B,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC","sourcesContent":["/** Codici stabili del resource server, allineati al contratto HTTP Accessi. */\nexport type AccessiResourceServerErrorCode =\n  | \"AUTH_HEADER_MISSING\"\n  | \"AUTH_TOKEN_MISSING\"\n  | \"AUTH_TOKEN_INVALID\"\n  | \"AUTH_USER_CODE_MISSING\"\n  | \"AUTH_USER_DISABLED\"\n  | \"AUTH_TOKEN_REVOKED\"\n  | \"AUTH_INSUFFICIENT_PERMISSIONS\"\n  | \"AUTH_CONFIG_INVALID\"\n  | \"AUTH_GRANTS_SOURCE_MISSING\"\n  | \"AUTH_INTROSPECTION_UNAVAILABLE\"\n  | \"AUTH_INTROSPECTION_UNAUTHORIZED\"\n  | \"AUTH_JWKS_UNAVAILABLE\"\n  | \"AUTH_INTERNAL_ERROR\";\n\n/** Errore tipizzato del resource server, convertibile in risposta HTTP o eccezione Nest. */\nexport class AccessiResourceServerError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: AccessiResourceServerErrorCode,\n    message: string,\n    public readonly details?: Record<string, unknown>,\n  ) {\n    super(message);\n    this.name = \"AccessiResourceServerError\";\n  }\n}\n\nexport function accessiAuthError(\n  status: number,\n  code: AccessiResourceServerErrorCode,\n  message: string,\n  details?: Record<string, unknown>,\n): AccessiResourceServerError {\n  return new AccessiResourceServerError(status, code, message, details);\n}\n"]}

package/dist/accessi/resource-server/express.d.ts

@@ -0,0 +1,17 @@
+import type { NextFunction, Request, Response } from "express";
+import { AccessiResourceServerError } from "./errors";
+import type { AccessiResourceServerRuntime } from "./runtime";
+import type { AccessiResourceServerOptions } from "./types";
+/** Normalizza un errore sconosciuto nel contratto di errore Accessi. */
+export declare function toAccessiResourceServerError(error: unknown): AccessiResourceServerError;
+/** Invia la risposta di errore Accessi senza esporre stack trace o dettagli interni. */
+export declare function sendAccessiResourceServerError(res: Response, error: unknown): Response;
+/**
+ * Middleware Express per backend che non possiedono il database Accessi.
+ *
+ * Popola `req.user`, `req.data` e `req.accessi`; con una policy di autorizzazione
+ * popola anche `req.userGrants`.
+ */
+export declare function createAccessiAuthMiddleware(options: AccessiResourceServerOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/** Variante con runtime gia creato, utile per test o bootstrap manuale. */
+export declare function createAccessiAuthMiddlewareFromRuntime(runtime: AccessiResourceServerRuntime): (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/accessi/resource-server/express.js

@@ -0,0 +1,87 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toAccessiResourceServerError = toAccessiResourceServerError;
+exports.sendAccessiResourceServerError = sendAccessiResourceServerError;
+exports.createAccessiAuthMiddleware = createAccessiAuthMiddleware;
+exports.createAccessiAuthMiddlewareFromRuntime = createAccessiAuthMiddlewareFromRuntime;
+const audit_1 = require("../../accessi-module/security/audit");
+const errors_1 = require("./errors");
+const runtime_1 = require("./runtime");
+/** Normalizza un errore sconosciuto nel contratto di errore Accessi. */
+function toAccessiResourceServerError(error) {
+    if (error instanceof errors_1.AccessiResourceServerError)
+        return error;
+    return (0, errors_1.accessiAuthError)(500, "AUTH_INTERNAL_ERROR", "Errore interno durante l'autenticazione.");
+}
+/** Invia la risposta di errore Accessi senza esporre stack trace o dettagli interni. */
+function sendAccessiResourceServerError(res, error) {
+    const normalized = toAccessiResourceServerError(error);
+    return res.status(normalized.status).json({
+        severity: "error",
+        status: normalized.status,
+        statusCode: 2,
+        code: normalized.code,
+        error: normalized.code,
+        message: normalized.message,
+    });
+}
+/**
+ * Middleware Express per backend che non possiedono il database Accessi.
+ *
+ * Popola `req.user`, `req.data` e `req.accessi`; con una policy di autorizzazione
+ * popola anche `req.userGrants`.
+ */
+function createAccessiAuthMiddleware(options) {
+    const runtime = (0, runtime_1.createAccessiResourceServer)(options);
+    return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield (0, runtime_1.authenticateAccessiRequest)(req, runtime);
+            next();
+        }
+        catch (error) {
+            const normalized = toAccessiResourceServerError(error);
+            if (runtime.options.audit !== false) {
+                (0, audit_1.auditAccessi)("auth_failure", {
+                    code: normalized.code,
+                    status: normalized.status,
+                    method: req.method,
+                    path: req.path,
+                    ip: req.ip,
+                });
+            }
+            sendAccessiResourceServerError(res, error);
+        }
+    });
+}
+/** Variante con runtime gia creato, utile per test o bootstrap manuale. */
+function createAccessiAuthMiddlewareFromRuntime(runtime) {
+    return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield (0, runtime_1.authenticateAccessiRequest)(req, runtime);
+            next();
+        }
+        catch (error) {
+            const normalized = toAccessiResourceServerError(error);
+            if (runtime.options.audit !== false) {
+                (0, audit_1.auditAccessi)("auth_failure", {
+                    code: normalized.code,
+                    status: normalized.status,
+                    method: req.method,
+                    path: req.path,
+                    ip: req.ip,
+                });
+            }
+            sendAccessiResourceServerError(res, error);
+        }
+    });
+}
+//# sourceMappingURL=express.js.map

package/dist/accessi/resource-server/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/express.ts"],"names":[],"mappings":";;;;;;;;;;;AAQA,oEAGC;AAGD,wEAUC;AAQD,kEAuBC;AAGD,wFAqBC;AA9ED,+DAAmE;AACnE,qCAAwE;AACxE,uCAAoF;AAIpF,wEAAwE;AACxE,SAAgB,4BAA4B,CAAC,KAAc;IACzD,IAAI,KAAK,YAAY,mCAA0B;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;AAClG,CAAC;AAED,wFAAwF;AACxF,SAAgB,8BAA8B,CAAC,GAAa,EAAE,KAAc;IAC1E,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACxC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,IAAI;QACtB,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAErD,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;oBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YACD,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sCAAsC,CACpD,OAAqC;IAErC,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;oBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YACD,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from \"express\";\nimport { auditAccessi } from \"../../accessi-module/security/audit\";\nimport { AccessiResourceServerError, accessiAuthError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerRuntime } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\n/** Normalizza un errore sconosciuto nel contratto di errore Accessi. */\nexport function toAccessiResourceServerError(error: unknown): AccessiResourceServerError {\n  if (error instanceof AccessiResourceServerError) return error;\n  return accessiAuthError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n}\n\n/** Invia la risposta di errore Accessi senza esporre stack trace o dettagli interni. */\nexport function sendAccessiResourceServerError(res: Response, error: unknown): Response {\n  const normalized = toAccessiResourceServerError(error);\n  return res.status(normalized.status).json({\n    severity: \"error\",\n    status: normalized.status,\n    statusCode: 2,\n    code: normalized.code,\n    error: normalized.code,\n    message: normalized.message,\n  });\n}\n\n/**\n * Middleware Express per backend che non possiedono il database Accessi.\n *\n * Popola `req.user`, `req.data` e `req.accessi`; con una policy di autorizzazione\n * popola anche `req.userGrants`.\n */\nexport function createAccessiAuthMiddleware(\n  options: AccessiResourceServerOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  const runtime = createAccessiResourceServer(options);\n\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      const normalized = toAccessiResourceServerError(error);\n      if (runtime.options.audit !== false) {\n        auditAccessi(\"auth_failure\", {\n          code: normalized.code,\n          status: normalized.status,\n          method: req.method,\n          path: req.path,\n          ip: req.ip,\n        });\n      }\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n\n/** Variante con runtime gia creato, utile per test o bootstrap manuale. */\nexport function createAccessiAuthMiddlewareFromRuntime(\n  runtime: AccessiResourceServerRuntime,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      const normalized = toAccessiResourceServerError(error);\n      if (runtime.options.audit !== false) {\n        auditAccessi(\"auth_failure\", {\n          code: normalized.code,\n          status: normalized.status,\n          method: req.method,\n          path: req.path,\n          ip: req.ip,\n        });\n      }\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n"]}

package/dist/accessi/resource-server/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./core";
+export * from "./express";
+export * from "./nest";

package/dist/accessi/resource-server/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./core"), exports);
+__exportStar(require("./express"), exports);
+__exportStar(require("./nest"), exports);
+//# sourceMappingURL=index.js.map

package/dist/accessi/resource-server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AACvB,4CAA0B;AAC1B,yCAAuB","sourcesContent":["export * from \"./core\";\nexport * from \"./express\";\nexport * from \"./nest\";\n"]}

package/dist/accessi/resource-server/introspection.d.ts

@@ -0,0 +1,16 @@
+import type { AccessiIntrospectionOptions, AccessiIntrospectionResult } from "./types";
+/** Client di introspection verso Accessi Service, con cache locale dei risultati attivi. */
+export interface AccessiIntrospectionClient {
+    introspect(token: string, options?: {
+        forceRefresh?: boolean;
+    }): Promise<AccessiIntrospectionResult>;
+    clearCache(): void;
+}
+/**
+ * Crea il client di introspection.
+ *
+ * Il service token deve avere scope `accessi:introspect`. I risultati attivi
+ * sono memorizzati per `cacheTtlMs` (default 30s); i risultati inattivi non
+ * vengono cachati per permettere un retry immediato dopo un login.
+ */
+export declare function createAccessiIntrospectionClient(options: AccessiIntrospectionOptions): AccessiIntrospectionClient;

package/dist/accessi/resource-server/introspection.js

@@ -0,0 +1,115 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiIntrospectionClient = createAccessiIntrospectionClient;
+const crypto_1 = require("crypto");
+const errors_1 = require("./errors");
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function unwrapResult(payload) {
+    if (isRecord(payload) && isRecord(payload.Result))
+        return payload.Result;
+    if (isRecord(payload))
+        return payload;
+    return {};
+}
+function parseResult(payload) {
+    var _a;
+    const result = unwrapResult(payload);
+    const active = result.active === true;
+    const user = isRecord(result.user) ? result.user : undefined;
+    const grants = isRecord(result.grants) ? result.grants : undefined;
+    const rawCode = (_a = user === null || user === void 0 ? void 0 : user.codiceUtente) !== null && _a !== void 0 ? _a : result.codiceUtente;
+    const codiceUtente = Number(rawCode);
+    return Object.assign(Object.assign(Object.assign({ active }, (user ? { user } : {})), (Number.isSafeInteger(codiceUtente) && codiceUtente > 0 ? { codiceUtente } : {})), (grants ? { grants } : {}));
+}
+/**
+ * Crea il client di introspection.
+ *
+ * Il service token deve avere scope `accessi:introspect`. I risultati attivi
+ * sono memorizzati per `cacheTtlMs` (default 30s); i risultati inattivi non
+ * vengono cachati per permettere un retry immediato dopo un login.
+ */
+function createAccessiIntrospectionClient(options) {
+    var _a, _b, _c;
+    if (!(options === null || options === void 0 ? void 0 : options.url) || !(options === null || options === void 0 ? void 0 : options.serviceToken)) {
+        throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "introspection.url e introspection.serviceToken sono obbligatori.");
+    }
+    const fetchImpl = (_a = options.fetch) !== null && _a !== void 0 ? _a : globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+        throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "fetch non disponibile per l'introspection.");
+    }
+    const cacheTtlMs = Math.max(1000, (_b = options.cacheTtlMs) !== null && _b !== void 0 ? _b : 30000);
+    const timeoutMs = Math.max(500, (_c = options.timeoutMs) !== null && _c !== void 0 ? _c : 3000);
+    const cache = new Map();
+    const clearCache = () => {
+        cache.clear();
+    };
+    const introspect = (token_1, ...args_1) => __awaiter(this, [token_1, ...args_1], void 0, function* (token, callOptions = {}) {
+        if (typeof token !== "string" || token.trim() === "") {
+            return { active: false };
+        }
+        const cacheKey = (0, crypto_1.createHash)("sha256").update(token).digest("hex");
+        const cached = cache.get(cacheKey);
+        if (!callOptions.forceRefresh && cached && cached.expiresAt > Date.now()) {
+            return cached.result;
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
+        let response;
+        try {
+            response = yield fetchImpl(options.url, {
+                method: "POST",
+                headers: {
+                    Accept: "application/json",
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${options.serviceToken}`,
+                },
+                body: JSON.stringify({ token }),
+                signal: controller.signal,
+            });
+        }
+        catch (_a) {
+            cache.delete(cacheKey);
+            throw (0, errors_1.accessiAuthError)(503, "AUTH_INTROSPECTION_UNAVAILABLE", "Accessi Service non raggiungibile per l'introspection.");
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+        if (response.status === 401 || response.status === 403) {
+            throw (0, errors_1.accessiAuthError)(503, "AUTH_INTROSPECTION_UNAUTHORIZED", "Service token non valido o privo dello scope accessi:introspect.");
+        }
+        if (response.status >= 500) {
+            throw (0, errors_1.accessiAuthError)(503, "AUTH_INTROSPECTION_UNAVAILABLE", `Accessi Service ha risposto ${response.status} all'introspection.`);
+        }
+        if (response.status === 400 || response.status === 404) {
+            return { active: false };
+        }
+        let payload;
+        try {
+            payload = yield response.json();
+        }
+        catch (_b) {
+            throw (0, errors_1.accessiAuthError)(503, "AUTH_INTROSPECTION_UNAVAILABLE", "Risposta introspection non JSON.");
+        }
+        const result = parseResult(payload);
+        if (result.active) {
+            cache.set(cacheKey, { result, expiresAt: Date.now() + cacheTtlMs });
+        }
+        else {
+            cache.delete(cacheKey);
+        }
+        return result;
+    });
+    return { introspect, clearCache };
+}
+//# sourceMappingURL=introspection.js.map

package/dist/accessi/resource-server/introspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/introspection.ts"],"names":[],"mappings":";;;;;;;;;;;AAgDA,4EAsGC;AAtJD,mCAAoC;AACpC,qCAA4C;AAc5C,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACpC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACzE,IAAI,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACtC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;;IACnC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,MAAM,OAAO,GAAG,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,mCAAI,MAAM,CAAC,YAAY,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAErC,mDACE,MAAM,IACH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACtB,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChF,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC7B;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gCAAgC,CAC9C,OAAoC;;IAEpC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAA,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,CAAA,EAAE,CAAC;QAC5C,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,UAAU,CAAC,KAAK,CAAC;IACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,UAAU,mCAAI,KAAM,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAA,OAAO,CAAC,SAAS,mCAAI,IAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,qBAGoB,EAAE,0DAFvC,KAAa,EACb,cAA0C,EAAE;QAE5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACzE,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;iBAChD;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;gBAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,gCAAgC,EAChC,wDAAwD,CACzD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,iCAAiC,EACjC,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,gCAAgC,EAChC,+BAA+B,QAAQ,CAAC,MAAM,qBAAqB,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,gCAAgC,EAChC,kCAAkC,CACnC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAA,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import { createHash } from \"crypto\";\nimport { accessiAuthError } from \"./errors\";\nimport type { AccessiIntrospectionOptions, AccessiIntrospectionResult } from \"./types\";\n\ninterface CacheEntry {\n  result: AccessiIntrospectionResult;\n  expiresAt: number;\n}\n\n/** Client di introspection verso Accessi Service, con cache locale dei risultati attivi. */\nexport interface AccessiIntrospectionClient {\n  introspect(token: string, options?: { forceRefresh?: boolean }): Promise<AccessiIntrospectionResult>;\n  clearCache(): void;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction unwrapResult(payload: unknown): Record<string, unknown> {\n  if (isRecord(payload) && isRecord(payload.Result)) return payload.Result;\n  if (isRecord(payload)) return payload;\n  return {};\n}\n\nfunction parseResult(payload: unknown): AccessiIntrospectionResult {\n  const result = unwrapResult(payload);\n  const active = result.active === true;\n  const user = isRecord(result.user) ? result.user : undefined;\n  const grants = isRecord(result.grants) ? result.grants : undefined;\n  const rawCode = user?.codiceUtente ?? result.codiceUtente;\n  const codiceUtente = Number(rawCode);\n\n  return {\n    active,\n    ...(user ? { user } : {}),\n    ...(Number.isSafeInteger(codiceUtente) && codiceUtente > 0 ? { codiceUtente } : {}),\n    ...(grants ? { grants } : {}),\n  };\n}\n\n/**\n * Crea il client di introspection.\n *\n * Il service token deve avere scope `accessi:introspect`. I risultati attivi\n * sono memorizzati per `cacheTtlMs` (default 30s); i risultati inattivi non\n * vengono cachati per permettere un retry immediato dopo un login.\n */\nexport function createAccessiIntrospectionClient(\n  options: AccessiIntrospectionOptions,\n): AccessiIntrospectionClient {\n  if (!options?.url || !options?.serviceToken) {\n    throw accessiAuthError(\n      500,\n      \"AUTH_CONFIG_INVALID\",\n      \"introspection.url e introspection.serviceToken sono obbligatori.\",\n    );\n  }\n\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"fetch non disponibile per l'introspection.\");\n  }\n\n  const cacheTtlMs = Math.max(1_000, options.cacheTtlMs ?? 30_000);\n  const timeoutMs = Math.max(500, options.timeoutMs ?? 3_000);\n  const cache = new Map<string, CacheEntry>();\n\n  const clearCache = (): void => {\n    cache.clear();\n  };\n\n  const introspect = async (\n    token: string,\n    callOptions: { forceRefresh?: boolean } = {},\n  ): Promise<AccessiIntrospectionResult> => {\n    if (typeof token !== \"string\" || token.trim() === \"\") {\n      return { active: false };\n    }\n\n    const cacheKey = createHash(\"sha256\").update(token).digest(\"hex\");\n    const cached = cache.get(cacheKey);\n    if (!callOptions.forceRefresh && cached && cached.expiresAt > Date.now()) {\n      return cached.result;\n    }\n\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), timeoutMs);\n    let response: Response;\n    try {\n      response = await fetchImpl(options.url, {\n        method: \"POST\",\n        headers: {\n          Accept: \"application/json\",\n          \"Content-Type\": \"application/json\",\n          Authorization: `Bearer ${options.serviceToken}`,\n        },\n        body: JSON.stringify({ token }),\n        signal: controller.signal,\n      });\n    } catch {\n      cache.delete(cacheKey);\n      throw accessiAuthError(\n        503,\n        \"AUTH_INTROSPECTION_UNAVAILABLE\",\n        \"Accessi Service non raggiungibile per l'introspection.\",\n      );\n    } finally {\n      clearTimeout(timeout);\n    }\n\n    if (response.status === 401 || response.status === 403) {\n      throw accessiAuthError(\n        503,\n        \"AUTH_INTROSPECTION_UNAUTHORIZED\",\n        \"Service token non valido o privo dello scope accessi:introspect.\",\n      );\n    }\n    if (response.status >= 500) {\n      throw accessiAuthError(\n        503,\n        \"AUTH_INTROSPECTION_UNAVAILABLE\",\n        `Accessi Service ha risposto ${response.status} all'introspection.`,\n      );\n    }\n    if (response.status === 400 || response.status === 404) {\n      return { active: false };\n    }\n\n    let payload: unknown;\n    try {\n      payload = await response.json();\n    } catch {\n      throw accessiAuthError(\n        503,\n        \"AUTH_INTROSPECTION_UNAVAILABLE\",\n        \"Risposta introspection non JSON.\",\n      );\n    }\n\n    const result = parseResult(payload);\n    if (result.active) {\n      cache.set(cacheKey, { result, expiresAt: Date.now() + cacheTtlMs });\n    } else {\n      cache.delete(cacheKey);\n    }\n    return result;\n  };\n\n  return { introspect, clearCache };\n}\n"]}

package/dist/accessi/resource-server/keys.d.ts

@@ -0,0 +1,11 @@
+/** Derivazione usata dal server Accessi per separare le chiavi JWT per scopo. */
+export declare const ACCESSI_JWT_ACCESS_PURPOSE = "accessi:jwt:access:v1";
+/**
+ * Deriva la chiave HMAC degli access token dal segreto configurato in
+ * `ACCESSI_JWT_SECRET`.
+ *
+ * Serve ai resource server che condividono il segreto grezzo con Accessi ma non
+ * vogliono replicare la KDF: passare il risultato come `jwt.secret`, oppure
+ * usare direttamente `jwt.serverSecret`.
+ */
+export declare function deriveAccessiAccessSecret(serverSecret: string): string;

package/dist/accessi/resource-server/keys.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCESSI_JWT_ACCESS_PURPOSE = void 0;
+exports.deriveAccessiAccessSecret = deriveAccessiAccessSecret;
+const crypto_1 = require("crypto");
+/** Derivazione usata dal server Accessi per separare le chiavi JWT per scopo. */
+exports.ACCESSI_JWT_ACCESS_PURPOSE = "accessi:jwt:access:v1";
+/**
+ * Deriva la chiave HMAC degli access token dal segreto configurato in
+ * `ACCESSI_JWT_SECRET`.
+ *
+ * Serve ai resource server che condividono il segreto grezzo con Accessi ma non
+ * vogliono replicare la KDF: passare il risultato come `jwt.secret`, oppure
+ * usare direttamente `jwt.serverSecret`.
+ */
+function deriveAccessiAccessSecret(serverSecret) {
+    if (typeof serverSecret !== "string" || serverSecret.length === 0) {
+        throw new Error("serverSecret Accessi non configurato.");
+    }
+    return (0, crypto_1.createHmac)("sha256", serverSecret).update(exports.ACCESSI_JWT_ACCESS_PURPOSE).digest("hex");
+}
+//# sourceMappingURL=keys.js.map

package/dist/accessi/resource-server/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/keys.ts"],"names":[],"mappings":";;;AAaA,8DAKC;AAlBD,mCAAoC;AAEpC,iFAAiF;AACpE,QAAA,0BAA0B,GAAG,uBAAuB,CAAC;AAElE;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,YAAoB;IAC5D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,kCAA0B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC","sourcesContent":["import { createHmac } from \"crypto\";\n\n/** Derivazione usata dal server Accessi per separare le chiavi JWT per scopo. */\nexport const ACCESSI_JWT_ACCESS_PURPOSE = \"accessi:jwt:access:v1\";\n\n/**\n * Deriva la chiave HMAC degli access token dal segreto configurato in\n * `ACCESSI_JWT_SECRET`.\n *\n * Serve ai resource server che condividono il segreto grezzo con Accessi ma non\n * vogliono replicare la KDF: passare il risultato come `jwt.secret`, oppure\n * usare direttamente `jwt.serverSecret`.\n */\nexport function deriveAccessiAccessSecret(serverSecret: string): string {\n  if (typeof serverSecret !== \"string\" || serverSecret.length === 0) {\n    throw new Error(\"serverSecret Accessi non configurato.\");\n  }\n  return createHmac(\"sha256\", serverSecret).update(ACCESSI_JWT_ACCESS_PURPOSE).digest(\"hex\");\n}\n"]}

package/dist/accessi/resource-server/nest.d.ts

@@ -0,0 +1,9 @@
+import { CanActivate, Type } from "@nestjs/common";
+import type { AccessiResourceServerOptions } from "./types";
+/**
+ * Crea un guard Nest configurato con le opzioni del resource server.
+ *
+ * Uso:
+ * `@UseGuards(createAccessiAuthGuard(options))`
+ */
+export declare function createAccessiAuthGuard(options: AccessiResourceServerOptions): Type<CanActivate>;