emilsoftware-utilities 2.0.0-dev.7 → 2.0.0-dev.70

package/dist/accessi-module/security/sessionRevocation.js

@@ -0,0 +1,170 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemorySessionRevocationStore = createMemorySessionRevocationStore;
+exports.createRedisSessionRevocationStore = createRedisSessionRevocationStore;
+exports.getSessionRevocationStore = getSessionRevocationStore;
+exports.resolveAccessiTokenIssuedAtMs = resolveAccessiTokenIssuedAtMs;
+exports.isAccessiTokenRevoked = isAccessiTokenRevoked;
+exports.revokeAccessiUserSessions = revokeAccessiUserSessions;
+exports.revokeAccessiUserSessionsIfConfigured = revokeAccessiUserSessionsIfConfigured;
+exports.clearDefaultSessionRevocations = clearDefaultSessionRevocations;
+const audit_1 = require("./audit");
+const accessTokenRevocation_1 = require("./accessTokenRevocation");
+const refreshTokenRotation_1 = require("./refreshTokenRotation");
+const REVOKE_USER_SCRIPT = "if tonumber(ARGV[2]) > 0 then return redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2]) else return redis.call('SET', KEYS[1], ARGV[1]) end";
+const GET_USER_SCRIPT = "return redis.call('GET', KEYS[1])";
+function createMemorySessionRevocationStore() {
+    const revokedAt = new Map();
+    return {
+        revokeUser(codiceUtente, timestamp) {
+            return __awaiter(this, void 0, void 0, function* () {
+                revokedAt.set(codiceUtente, timestamp);
+            });
+        },
+        getUserRevocation(codiceUtente) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                return (_a = revokedAt.get(codiceUtente)) !== null && _a !== void 0 ? _a : null;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                return true;
+            });
+        },
+        clear() {
+            revokedAt.clear();
+        },
+    };
+}
+/**
+ * Store Redis per la revoca sessioni.
+ *
+ * `revokeUser` scrive un timestamp con TTL; `getUserRevocation` lo legge.
+ * Il TTL deve essere maggiore della durata massima dei token.
+ */
+function createRedisSessionRevocationStore(options) {
+    var _a, _b;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis session revocation store: client.eval non configurato.');
+    }
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:revoked-user:').replace(/:+$/, ':');
+    const ttlMs = Math.max(0, Math.trunc((_b = options.ttlMs) !== null && _b !== void 0 ? _b : 365 * 24 * 60 * 60 * 1000));
+    return {
+        revokeUser(codiceUtente, revokedAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield options.client.eval(REVOKE_USER_SCRIPT, 1, `${keyPrefix}${codiceUtente}`, String(revokedAtMs), ttlMs);
+            });
+        },
+        getUserRevocation(codiceUtente) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const value = yield options.client.eval(GET_USER_SCRIPT, 1, `${keyPrefix}${codiceUtente}`);
+                if (typeof value !== 'string' && typeof value !== 'number')
+                    return null;
+                const timestamp = Number(value);
+                return Number.isFinite(timestamp) ? timestamp : null;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const result = yield options.client.eval("return redis.call('PING')", 0);
+                    return String(result).toUpperCase() === 'PONG';
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+    };
+}
+const defaultMemoryStore = createMemorySessionRevocationStore();
+/** Store di default in memoria, usato quando `sessionRevocation.store` non e configurato ma la revoca e abilitata. */
+function getSessionRevocationStore(options) {
+    var _a, _b, _c;
+    if (((_a = options.sessionRevocation) === null || _a === void 0 ? void 0 : _a.enabled) === false)
+        return undefined;
+    if ((_b = options.sessionRevocation) === null || _b === void 0 ? void 0 : _b.store)
+        return options.sessionRevocation.store;
+    return ((_c = options.sessionRevocation) === null || _c === void 0 ? void 0 : _c.enabled) === true ? defaultMemoryStore : undefined;
+}
+/**
+ * Issued-at in millisecondi. I token emessi da questa versione includono `iatMs`;
+ * per quelli legacy si ricade su `iat` (secondi) per restare compatibili.
+ */
+function resolveAccessiTokenIssuedAtMs(payload) {
+    const issuedAtMs = Number(payload.iatMs);
+    if (Number.isFinite(issuedAtMs) && issuedAtMs > 0)
+        return issuedAtMs;
+    const issuedAt = Number(payload.iat);
+    if (!Number.isFinite(issuedAt))
+        return null;
+    return issuedAt * 1000;
+}
+/**
+ * True se il token e stato revocato: famiglia refresh revocata, `jti` revocato
+ * oppure sessione utente revocata prima dell'emissione del token.
+ */
+function isAccessiTokenRevoked(options, payload, codiceUtente) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (yield (0, refreshTokenRotation_1.isRefreshTokenFamilyRevoked)(options, payload.fid))
+            return true;
+        if (yield (0, accessTokenRevocation_1.isAccessiAccessTokenRevoked)(options, payload))
+            return true;
+        const store = getSessionRevocationStore(options);
+        if (!store)
+            return false;
+        const issuedAtMs = resolveAccessiTokenIssuedAtMs(payload);
+        if (issuedAtMs === null)
+            return true;
+        const revokedAt = yield store.getUserRevocation(codiceUtente);
+        if (revokedAt === null)
+            return false;
+        // I token emessi da questa versione hanno `iatMs`: un token emesso nello
+        // stesso millisecondo della revoca e considerato revocato. Per i token
+        // legacy (solo `iat`, secondi) si mantiene il confronto per secondo.
+        const preciseIssuedAtMs = Number(payload.iatMs);
+        if (Number.isFinite(preciseIssuedAtMs) && preciseIssuedAtMs > 0) {
+            return issuedAtMs <= revokedAt;
+        }
+        return issuedAtMs < Math.floor(revokedAt / 1000) * 1000;
+    });
+}
+/** Revoca tutte le sessioni dell'utente. Richiede uno store configurato. */
+function revokeAccessiUserSessions(options_1, codiceUtente_1) {
+    return __awaiter(this, arguments, void 0, function* (options, codiceUtente, revokedAtMs = Date.now(), reason = 'manual') {
+        const store = getSessionRevocationStore(options);
+        if (!store) {
+            throw new Error('Session revocation store non configurato.');
+        }
+        yield store.revokeUser(codiceUtente, revokedAtMs);
+        (0, audit_1.auditAccessi)('accessi_sessions_revoked', { codiceUtente, revokedAtMs, reason });
+    });
+}
+/**
+ * Variante per i flussi applicativi (cambio password, blocco, cancellazione):
+ * se la revoca non e configurata non fallisce, perche quei flussi devono
+ * continuare a funzionare anche senza store condiviso.
+ */
+function revokeAccessiUserSessionsIfConfigured(options_1, codiceUtente_1) {
+    return __awaiter(this, arguments, void 0, function* (options, codiceUtente, reason = 'manual', revokedAtMs = Date.now()) {
+        if (!getSessionRevocationStore(options))
+            return false;
+        yield revokeAccessiUserSessions(options, codiceUtente, revokedAtMs, reason);
+        return true;
+    });
+}
+/** Solo per test: azzera lo store in memoria di default. */
+function clearDefaultSessionRevocations() {
+    defaultMemoryStore.clear();
+}
+//# sourceMappingURL=sessionRevocation.js.map

package/dist/accessi-module/security/sessionRevocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRevocation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/sessionRevocation.ts"],"names":[],"mappings":";;;;;;;;;;;AAsCA,gFAgBC;AAoBD,8EAyCC;AAKD,8DAIC;AAMD,sEAOC;AAMD,sDAyBC;AAGD,8DAYC;AAOD,sFASC;AAGD,wEAEC;AA3MD,mCAAuC;AACvC,mEAAsE;AACtE,iEAAqE;AA+BrE,MAAM,kBAAkB,GACtB,6IAA6I,CAAC;AAChJ,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,SAAgB,kCAAkC;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,OAAO;QACC,UAAU,CAAC,YAAY,EAAE,SAAS;;gBACtC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACzC,CAAC;SAAA;QACK,iBAAiB,CAAC,YAAY;;;gBAClC,OAAO,MAAA,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,mCAAI,IAAI,CAAC;YAC7C,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACD,KAAK;YACH,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAcD;;;;;GAKG;AACH,SAAgB,iCAAiC,CAC/C,OAA2C;;IAE3C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAElF,OAAO;QACC,UAAU,CAAC,YAAY,EAAE,WAAW;;gBACxC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACvB,kBAAkB,EAClB,CAAC,EACD,GAAG,SAAS,GAAG,YAAY,EAAE,EAC7B,MAAM,CAAC,WAAW,CAAC,EACnB,KAAK,CACN,CAAC;YACJ,CAAC;SAAA;QAEK,iBAAiB,CAAC,YAAY;;gBAClC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACrC,eAAe,EACf,CAAC,EACD,GAAG,SAAS,GAAG,YAAY,EAAE,CAC9B,CAAC;gBACF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBACxE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,CAAC;SAAA;QAEK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,kCAAkC,EAAE,CAAC;AAEhE,sHAAsH;AACtH,SAAgB,yBAAyB,CAAC,OAAuB;;IAC/D,IAAI,CAAA,MAAA,OAAO,CAAC,iBAAiB,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,MAAA,OAAO,CAAC,iBAAiB,0CAAE,KAAK;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;IAC7E,OAAO,CAAA,MAAA,OAAO,CAAC,iBAAiB,0CAAE,OAAO,MAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,SAAgB,6BAA6B,CAAC,OAAgC;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAErE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,QAAQ,GAAG,IAAI,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAsB,qBAAqB,CACzC,OAAuB,EACvB,OAAgC,EAChC,YAAoB;;QAEpB,IAAI,MAAM,IAAA,kDAA2B,EAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzE,IAAI,MAAM,IAAA,mDAA2B,EAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAErE,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAErC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAErC,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,UAAU,IAAI,SAAS,CAAC;QACjC,CAAC;QACD,OAAO,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,CAAC;CAAA;AAED,4EAA4E;AAC5E,SAAsB,yBAAyB;yDAC7C,OAAuB,EACvB,YAAoB,EACpB,cAAsB,IAAI,CAAC,GAAG,EAAE,EAChC,SAAiB,QAAQ;QAEzB,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAClD,IAAA,oBAAY,EAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;CAAA;AAED;;;;GAIG;AACH,SAAsB,qCAAqC;yDACzD,OAAuB,EACvB,YAAoB,EACpB,SAAiB,QAAQ,EACzB,cAAsB,IAAI,CAAC,GAAG,EAAE;QAEhC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,yBAAyB,CAAC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,4DAA4D;AAC5D,SAAgB,8BAA8B;IAC5C,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\nimport { auditAccessi } from './audit';\nimport { isAccessiAccessTokenRevoked } from './accessTokenRevocation';\nimport { isRefreshTokenFamilyRevoked } from './refreshTokenRotation';\n\n/**\n * Revoca delle sessioni per utente.\n *\n * La revoca e un timestamp: un token emesso prima del cutoff viene rifiutato.\n * I token emessi dopo il cutoff restano validi. I token includono `iatMs`\n * (millisecondi) per rendere la revoca deterministica anche quando il cambio\n * password e il login avvengono nello stesso secondo; per i token legacy senza\n * `iatMs` si usa `iat` in secondi.\n */\nexport interface SessionRevocationStore {\n  revokeUser(codiceUtente: number, revokedAtMs: number): Promise<void>;\n  getUserRevocation(codiceUtente: number): Promise<number | null>;\n  /** Health check opzionale per readiness del servizio. */\n  healthCheck?(): Promise<boolean>;\n}\n\nexport interface SessionRevocationOptions {\n  /** Default: disabilitata se non viene fornito uno store. */\n  enabled?: boolean;\n  /** Store condiviso (es. Redis) per invalidare le sessioni tra istanze. */\n  store?: SessionRevocationStore;\n  /** TTL delle chiavi Redis. Default: 365 giorni. */\n  ttlMs?: number;\n}\n\nexport interface MemorySessionRevocationStore extends SessionRevocationStore {\n  clear(): void;\n}\n\nconst REVOKE_USER_SCRIPT =\n  \"if tonumber(ARGV[2]) > 0 then return redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2]) else return redis.call('SET', KEYS[1], ARGV[1]) end\";\nconst GET_USER_SCRIPT = \"return redis.call('GET', KEYS[1])\";\n\nexport function createMemorySessionRevocationStore(): MemorySessionRevocationStore {\n  const revokedAt = new Map<number, number>();\n  return {\n    async revokeUser(codiceUtente, timestamp) {\n      revokedAt.set(codiceUtente, timestamp);\n    },\n    async getUserRevocation(codiceUtente) {\n      return revokedAt.get(codiceUtente) ?? null;\n    },\n    async healthCheck() {\n      return true;\n    },\n    clear() {\n      revokedAt.clear();\n    },\n  };\n}\n\nexport interface SessionRevocationRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisSessionRevocationStoreOptions {\n  client: SessionRevocationRedisClient;\n  /** Default: `accessi:revoked-user:`. */\n  keyPrefix?: string;\n  /** Default: 365 giorni. */\n  ttlMs?: number;\n}\n\n/**\n * Store Redis per la revoca sessioni.\n *\n * `revokeUser` scrive un timestamp con TTL; `getUserRevocation` lo legge.\n * Il TTL deve essere maggiore della durata massima dei token.\n */\nexport function createRedisSessionRevocationStore(\n  options: RedisSessionRevocationStoreOptions,\n): SessionRevocationStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis session revocation store: client.eval non configurato.');\n  }\n\n  const keyPrefix = (options.keyPrefix ?? 'accessi:revoked-user:').replace(/:+$/, ':');\n  const ttlMs = Math.max(0, Math.trunc(options.ttlMs ?? 365 * 24 * 60 * 60 * 1000));\n\n  return {\n    async revokeUser(codiceUtente, revokedAtMs) {\n      await options.client.eval(\n        REVOKE_USER_SCRIPT,\n        1,\n        `${keyPrefix}${codiceUtente}`,\n        String(revokedAtMs),\n        ttlMs,\n      );\n    },\n\n    async getUserRevocation(codiceUtente) {\n      const value = await options.client.eval(\n        GET_USER_SCRIPT,\n        1,\n        `${keyPrefix}${codiceUtente}`,\n      );\n      if (typeof value !== 'string' && typeof value !== 'number') return null;\n      const timestamp = Number(value);\n      return Number.isFinite(timestamp) ? timestamp : null;\n    },\n\n    async healthCheck() {\n      try {\n        const result = await options.client.eval(\"return redis.call('PING')\", 0);\n        return String(result).toUpperCase() === 'PONG';\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n\nconst defaultMemoryStore = createMemorySessionRevocationStore();\n\n/** Store di default in memoria, usato quando `sessionRevocation.store` non e configurato ma la revoca e abilitata. */\nexport function getSessionRevocationStore(options: AccessiOptions): SessionRevocationStore | undefined {\n  if (options.sessionRevocation?.enabled === false) return undefined;\n  if (options.sessionRevocation?.store) return options.sessionRevocation.store;\n  return options.sessionRevocation?.enabled === true ? defaultMemoryStore : undefined;\n}\n\n/**\n * Issued-at in millisecondi. I token emessi da questa versione includono `iatMs`;\n * per quelli legacy si ricade su `iat` (secondi) per restare compatibili.\n */\nexport function resolveAccessiTokenIssuedAtMs(payload: Record<string, unknown>): number | null {\n  const issuedAtMs = Number(payload.iatMs);\n  if (Number.isFinite(issuedAtMs) && issuedAtMs > 0) return issuedAtMs;\n\n  const issuedAt = Number(payload.iat);\n  if (!Number.isFinite(issuedAt)) return null;\n  return issuedAt * 1000;\n}\n\n/**\n * True se il token e stato revocato: famiglia refresh revocata, `jti` revocato\n * oppure sessione utente revocata prima dell'emissione del token.\n */\nexport async function isAccessiTokenRevoked(\n  options: AccessiOptions,\n  payload: Record<string, unknown>,\n  codiceUtente: number,\n): Promise<boolean> {\n  if (await isRefreshTokenFamilyRevoked(options, payload.fid)) return true;\n  if (await isAccessiAccessTokenRevoked(options, payload)) return true;\n\n  const store = getSessionRevocationStore(options);\n  if (!store) return false;\n\n  const issuedAtMs = resolveAccessiTokenIssuedAtMs(payload);\n  if (issuedAtMs === null) return true;\n\n  const revokedAt = await store.getUserRevocation(codiceUtente);\n  if (revokedAt === null) return false;\n\n  // I token emessi da questa versione hanno `iatMs`: un token emesso nello\n  // stesso millisecondo della revoca e considerato revocato. Per i token\n  // legacy (solo `iat`, secondi) si mantiene il confronto per secondo.\n  const preciseIssuedAtMs = Number(payload.iatMs);\n  if (Number.isFinite(preciseIssuedAtMs) && preciseIssuedAtMs > 0) {\n    return issuedAtMs <= revokedAt;\n  }\n  return issuedAtMs < Math.floor(revokedAt / 1000) * 1000;\n}\n\n/** Revoca tutte le sessioni dell'utente. Richiede uno store configurato. */\nexport async function revokeAccessiUserSessions(\n  options: AccessiOptions,\n  codiceUtente: number,\n  revokedAtMs: number = Date.now(),\n  reason: string = 'manual',\n): Promise<void> {\n  const store = getSessionRevocationStore(options);\n  if (!store) {\n    throw new Error('Session revocation store non configurato.');\n  }\n  await store.revokeUser(codiceUtente, revokedAtMs);\n  auditAccessi('accessi_sessions_revoked', { codiceUtente, revokedAtMs, reason });\n}\n\n/**\n * Variante per i flussi applicativi (cambio password, blocco, cancellazione):\n * se la revoca non e configurata non fallisce, perche quei flussi devono\n * continuare a funzionare anche senza store condiviso.\n */\nexport async function revokeAccessiUserSessionsIfConfigured(\n  options: AccessiOptions,\n  codiceUtente: number,\n  reason: string = 'manual',\n  revokedAtMs: number = Date.now(),\n): Promise<boolean> {\n  if (!getSessionRevocationStore(options)) return false;\n  await revokeAccessiUserSessions(options, codiceUtente, revokedAtMs, reason);\n  return true;\n}\n\n/** Solo per test: azzera lo store in memoria di default. */\nexport function clearDefaultSessionRevocations(): void {\n  defaultMemoryStore.clear();\n}\n"]}

package/dist/accessi-module/security/validateOptions.d.ts

@@ -0,0 +1,19 @@
+import type { AccessiOptions } from '../AccessiModule';
+export interface AccessiOptionsValidationIssue {
+    code: string;
+    message: string;
+}
+export interface AccessiOptionsValidationResult {
+    errors: AccessiOptionsValidationIssue[];
+    warnings: AccessiOptionsValidationIssue[];
+}
+/**
+ * Validazione fail-fast della configurazione Accessi.
+ *
+ * `createAccessiService` usa `assertValidAccessiOptions`; i bootstrap esistenti
+ * possono usare `validateAccessiOptions` per loggare warning senza rompere il
+ * comportamento storico.
+ */
+export declare function validateAccessiOptions(options: AccessiOptions): AccessiOptionsValidationResult;
+/** Lancia un errore aggregato se la configurazione non e valida. */
+export declare function assertValidAccessiOptions(options: AccessiOptions): void;

package/dist/accessi-module/security/validateOptions.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAccessiOptions = validateAccessiOptions;
+exports.assertValidAccessiOptions = assertValidAccessiOptions;
+function isHttpUrl(value) {
+    if (!value)
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:';
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function positive(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0;
+}
+/**
+ * Validazione fail-fast della configurazione Accessi.
+ *
+ * `createAccessiService` usa `assertValidAccessiOptions`; i bootstrap esistenti
+ * possono usare `validateAccessiOptions` per loggare warning senza rompere il
+ * comportamento storico.
+ */
+function validateAccessiOptions(options) {
+    var _a, _b, _c, _d;
+    const errors = [];
+    const warnings = [];
+    const addError = (code, message) => errors.push({ code, message });
+    const addWarning = (code, message) => warnings.push({ code, message });
+    if (!(options === null || options === void 0 ? void 0 : options.databaseOptions)) {
+        addError('ACCESSI_DB_OPTIONS_MISSING', 'databaseOptions e obbligatorio.');
+    }
+    const jwt = options === null || options === void 0 ? void 0 : options.jwtOptions;
+    const secret = (jwt === null || jwt === void 0 ? void 0 : jwt.secret) || process.env.ACC_JWT_SECRET;
+    if (!secret) {
+        addError('ACCESSI_JWT_SECRET_MISSING', 'jwtOptions.secret e obbligatorio.');
+    }
+    else if (secret.length < 32) {
+        addWarning('ACCESSI_JWT_SECRET_WEAK', 'jwtOptions.secret dovrebbe avere almeno 32 caratteri.');
+    }
+    if (!(jwt === null || jwt === void 0 ? void 0 : jwt.expiresIn)) {
+        addError('ACCESSI_JWT_EXPIRES_MISSING', 'jwtOptions.expiresIn e obbligatorio.');
+    }
+    const algorithm = (_a = jwt === null || jwt === void 0 ? void 0 : jwt.algorithm) !== null && _a !== void 0 ? _a : 'HS256';
+    if (algorithm.startsWith('HS')) {
+        if ((jwt === null || jwt === void 0 ? void 0 : jwt.privateKey) || (jwt === null || jwt === void 0 ? void 0 : jwt.publicKey)) {
+            addWarning('ACCESSI_JWT_ASYMMETRIC_KEYS_WITH_HMAC', 'Sono configurate chiavi asimmetriche ma algorithm e HS256: verranno ignorate.');
+        }
+    }
+    else {
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.privateKey)) {
+            addError('ACCESSI_JWT_PRIVATE_KEY_MISSING', `jwtOptions.privateKey e obbligatoria per ${algorithm}.`);
+        }
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.publicKey) && !(jwt === null || jwt === void 0 ? void 0 : jwt.privateKey)) {
+            addError('ACCESSI_JWT_PUBLIC_KEY_MISSING', `jwtOptions.publicKey e obbligatoria per ${algorithm}.`);
+        }
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.keyId)) {
+            addWarning('ACCESSI_JWT_KEY_ID_MISSING', 'jwtOptions.keyId e consigliato per la rotazione JWKS.');
+        }
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.jwksPath)) {
+            addWarning('ACCESSI_JWKS_PATH_DEFAULT', 'jwksPath non configurato: verra usato accessi/.well-known/jwks.json.');
+        }
+    }
+    if (!(jwt === null || jwt === void 0 ? void 0 : jwt.issuer)) {
+        addWarning('ACCESSI_JWT_ISSUER_MISSING', 'jwtOptions.issuer e consigliato in multi-servizio.');
+    }
+    if (!(jwt === null || jwt === void 0 ? void 0 : jwt.audience)) {
+        addWarning('ACCESSI_JWT_AUDIENCE_MISSING', 'jwtOptions.audience e consigliato in multi-servizio.');
+    }
+    if (!(options === null || options === void 0 ? void 0 : options.encryptionKey)) {
+        addError('ACCESSI_ENCRYPTION_KEY_MISSING', 'encryptionKey e obbligatoria.');
+    }
+    else if (options.encryptionKey.length < 16) {
+        addWarning('ACCESSI_ENCRYPTION_KEY_WEAK', 'encryptionKey dovrebbe avere almeno 16 caratteri.');
+    }
+    if (!isHttpUrl(options === null || options === void 0 ? void 0 : options.confirmationEmailUrl)) {
+        addWarning('ACCESSI_CONFIRMATION_URL_INVALID', 'confirmationEmailUrl dovrebbe essere un URL http/https.');
+    }
+    if (!isHttpUrl(options === null || options === void 0 ? void 0 : options.confirmationEmailReturnUrl)) {
+        addWarning('ACCESSI_CONFIRMATION_RETURN_URL_INVALID', 'confirmationEmailReturnUrl dovrebbe essere un URL http/https.');
+    }
+    if ((options === null || options === void 0 ? void 0 : options.publicBaseUrl) && !isHttpUrl(options.publicBaseUrl)) {
+        addWarning('ACCESSI_PUBLIC_BASE_URL_INVALID', 'publicBaseUrl dovrebbe essere un URL http/https.');
+    }
+    if (((_b = options === null || options === void 0 ? void 0 : options.publicAuthRateLimit) === null || _b === void 0 ? void 0 : _b.login) && !positive(options.publicAuthRateLimit.login.windowMs)) {
+        addError('ACCESSI_RATE_LIMIT_WINDOW_INVALID', 'publicAuthRateLimit.login.windowMs deve essere positivo.');
+    }
+    if (((_c = options === null || options === void 0 ? void 0 : options.publicAuthRateLimit) === null || _c === void 0 ? void 0 : _c.login) && !positive(options.publicAuthRateLimit.login.maxAttempts)) {
+        addError('ACCESSI_RATE_LIMIT_ATTEMPTS_INVALID', 'publicAuthRateLimit.login.maxAttempts deve essere positivo.');
+    }
+    if (options === null || options === void 0 ? void 0 : options.edgeRateLimit) {
+        if (options.edgeRateLimit.windowMs !== undefined && !positive(options.edgeRateLimit.windowMs)) {
+            addError('ACCESSI_EDGE_RATE_LIMIT_WINDOW_INVALID', 'edgeRateLimit.windowMs deve essere positivo.');
+        }
+        if (options.edgeRateLimit.maxAttempts !== undefined && !positive(options.edgeRateLimit.maxAttempts)) {
+            addError('ACCESSI_EDGE_RATE_LIMIT_ATTEMPTS_INVALID', 'edgeRateLimit.maxAttempts deve essere positivo.');
+        }
+    }
+    if (((_d = options === null || options === void 0 ? void 0 : options.consoleEntry) === null || _d === void 0 ? void 0 : _d.ttlMs) !== undefined && !positive(options.consoleEntry.ttlMs)) {
+        addError('ACCESSI_CONSOLE_ENTRY_TTL_INVALID', 'consoleEntry.ttlMs deve essere positivo.');
+    }
+    return { errors, warnings };
+}
+/** Lancia un errore aggregato se la configurazione non e valida. */
+function assertValidAccessiOptions(options) {
+    const result = validateAccessiOptions(options);
+    if (result.errors.length === 0)
+        return;
+    throw new Error(`Configurazione Accessi non valida:\n${result.errors
+        .map((issue) => `- ${issue.code}: ${issue.message}`)
+        .join('\n')}`);
+}
+//# sourceMappingURL=validateOptions.js.map

package/dist/accessi-module/security/validateOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateOptions.js","sourceRoot":"","sources":["../../../src/accessi-module/security/validateOptions.ts"],"names":[],"mappings":";;AAiCA,wDA2FC;AAGD,8DAQC;AA3HD,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC/D,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,OAAuB;;IAC5D,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAoC,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAEvF,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe,CAAA,EAAE,CAAC;QAC9B,QAAQ,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,CAAC;IAChC,MAAM,MAAM,GAAG,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,EAAE,mCAAmC,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC9B,UAAU,CAAC,yBAAyB,EAAE,uDAAuD,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,EAAE,CAAC;QACpB,QAAQ,CAAC,6BAA6B,EAAE,sCAAsC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,mCAAI,OAAO,CAAC;IAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,MAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,EAAE,CAAC;YACtC,UAAU,CACR,uCAAuC,EACvC,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAA,EAAE,CAAC;YACrB,QAAQ,CAAC,iCAAiC,EAAE,4CAA4C,SAAS,GAAG,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAA,EAAE,CAAC;YACxC,QAAQ,CAAC,gCAAgC,EAAE,2CAA2C,SAAS,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,KAAK,CAAA,EAAE,CAAC;YAChB,UAAU,CAAC,4BAA4B,EAAE,uDAAuD,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,CAAA,EAAE,CAAC;YACnB,UAAU,CACR,2BAA2B,EAC3B,sEAAsE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,EAAE,CAAC;QACjB,UAAU,CAAC,4BAA4B,EAAE,oDAAoD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,CAAA,EAAE,CAAC;QACnB,UAAU,CAAC,8BAA8B,EAAE,sDAAsD,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,CAAA,EAAE,CAAC;QAC5B,QAAQ,CAAC,gCAAgC,EAAE,+BAA+B,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7C,UAAU,CAAC,6BAA6B,EAAE,mDAAmD,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9C,UAAU,CAAC,kCAAkC,EAAE,yDAAyD,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0BAA0B,CAAC,EAAE,CAAC;QACpD,UAAU,CAAC,yCAAyC,EAAE,+DAA+D,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,KAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,UAAU,CAAC,iCAAiC,EAAE,kDAAkD,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,mBAAmB,0CAAE,KAAK,KAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjG,QAAQ,CAAC,mCAAmC,EAAE,0DAA0D,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,mBAAmB,0CAAE,KAAK,KAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACpG,QAAQ,CAAC,qCAAqC,EAAE,6DAA6D,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9F,QAAQ,CAAC,wCAAwC,EAAE,8CAA8C,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACpG,QAAQ,CAAC,0CAA0C,EAAE,iDAAiD,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,0CAAE,KAAK,MAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,QAAQ,CAAC,mCAAmC,EAAE,0CAA0C,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,SAAgB,yBAAyB,CAAC,OAAuB;IAC/D,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;AACJ,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\n\nexport interface AccessiOptionsValidationIssue {\n  code: string;\n  message: string;\n}\n\nexport interface AccessiOptionsValidationResult {\n  errors: AccessiOptionsValidationIssue[];\n  warnings: AccessiOptionsValidationIssue[];\n}\n\nfunction isHttpUrl(value: string | undefined): boolean {\n  if (!value) return false;\n  try {\n    const url = new URL(value);\n    return url.protocol === 'http:' || url.protocol === 'https:';\n  } catch {\n    return false;\n  }\n}\n\nfunction positive(value: number | undefined): boolean {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0;\n}\n\n/**\n * Validazione fail-fast della configurazione Accessi.\n *\n * `createAccessiService` usa `assertValidAccessiOptions`; i bootstrap esistenti\n * possono usare `validateAccessiOptions` per loggare warning senza rompere il\n * comportamento storico.\n */\nexport function validateAccessiOptions(options: AccessiOptions): AccessiOptionsValidationResult {\n  const errors: AccessiOptionsValidationIssue[] = [];\n  const warnings: AccessiOptionsValidationIssue[] = [];\n\n  const addError = (code: string, message: string) => errors.push({ code, message });\n  const addWarning = (code: string, message: string) => warnings.push({ code, message });\n\n  if (!options?.databaseOptions) {\n    addError('ACCESSI_DB_OPTIONS_MISSING', 'databaseOptions e obbligatorio.');\n  }\n\n  const jwt = options?.jwtOptions;\n  const secret = jwt?.secret || process.env.ACC_JWT_SECRET;\n  if (!secret) {\n    addError('ACCESSI_JWT_SECRET_MISSING', 'jwtOptions.secret e obbligatorio.');\n  } else if (secret.length < 32) {\n    addWarning('ACCESSI_JWT_SECRET_WEAK', 'jwtOptions.secret dovrebbe avere almeno 32 caratteri.');\n  }\n\n  if (!jwt?.expiresIn) {\n    addError('ACCESSI_JWT_EXPIRES_MISSING', 'jwtOptions.expiresIn e obbligatorio.');\n  }\n\n  const algorithm = jwt?.algorithm ?? 'HS256';\n  if (algorithm.startsWith('HS')) {\n    if (jwt?.privateKey || jwt?.publicKey) {\n      addWarning(\n        'ACCESSI_JWT_ASYMMETRIC_KEYS_WITH_HMAC',\n        'Sono configurate chiavi asimmetriche ma algorithm e HS256: verranno ignorate.',\n      );\n    }\n  } else {\n    if (!jwt?.privateKey) {\n      addError('ACCESSI_JWT_PRIVATE_KEY_MISSING', `jwtOptions.privateKey e obbligatoria per ${algorithm}.`);\n    }\n    if (!jwt?.publicKey && !jwt?.privateKey) {\n      addError('ACCESSI_JWT_PUBLIC_KEY_MISSING', `jwtOptions.publicKey e obbligatoria per ${algorithm}.`);\n    }\n    if (!jwt?.keyId) {\n      addWarning('ACCESSI_JWT_KEY_ID_MISSING', 'jwtOptions.keyId e consigliato per la rotazione JWKS.');\n    }\n    if (!jwt?.jwksPath) {\n      addWarning(\n        'ACCESSI_JWKS_PATH_DEFAULT',\n        'jwksPath non configurato: verra usato accessi/.well-known/jwks.json.',\n      );\n    }\n  }\n\n  if (!jwt?.issuer) {\n    addWarning('ACCESSI_JWT_ISSUER_MISSING', 'jwtOptions.issuer e consigliato in multi-servizio.');\n  }\n  if (!jwt?.audience) {\n    addWarning('ACCESSI_JWT_AUDIENCE_MISSING', 'jwtOptions.audience e consigliato in multi-servizio.');\n  }\n\n  if (!options?.encryptionKey) {\n    addError('ACCESSI_ENCRYPTION_KEY_MISSING', 'encryptionKey e obbligatoria.');\n  } else if (options.encryptionKey.length < 16) {\n    addWarning('ACCESSI_ENCRYPTION_KEY_WEAK', 'encryptionKey dovrebbe avere almeno 16 caratteri.');\n  }\n\n  if (!isHttpUrl(options?.confirmationEmailUrl)) {\n    addWarning('ACCESSI_CONFIRMATION_URL_INVALID', 'confirmationEmailUrl dovrebbe essere un URL http/https.');\n  }\n  if (!isHttpUrl(options?.confirmationEmailReturnUrl)) {\n    addWarning('ACCESSI_CONFIRMATION_RETURN_URL_INVALID', 'confirmationEmailReturnUrl dovrebbe essere un URL http/https.');\n  }\n  if (options?.publicBaseUrl && !isHttpUrl(options.publicBaseUrl)) {\n    addWarning('ACCESSI_PUBLIC_BASE_URL_INVALID', 'publicBaseUrl dovrebbe essere un URL http/https.');\n  }\n\n  if (options?.publicAuthRateLimit?.login && !positive(options.publicAuthRateLimit.login.windowMs)) {\n    addError('ACCESSI_RATE_LIMIT_WINDOW_INVALID', 'publicAuthRateLimit.login.windowMs deve essere positivo.');\n  }\n  if (options?.publicAuthRateLimit?.login && !positive(options.publicAuthRateLimit.login.maxAttempts)) {\n    addError('ACCESSI_RATE_LIMIT_ATTEMPTS_INVALID', 'publicAuthRateLimit.login.maxAttempts deve essere positivo.');\n  }\n  if (options?.edgeRateLimit) {\n    if (options.edgeRateLimit.windowMs !== undefined && !positive(options.edgeRateLimit.windowMs)) {\n      addError('ACCESSI_EDGE_RATE_LIMIT_WINDOW_INVALID', 'edgeRateLimit.windowMs deve essere positivo.');\n    }\n    if (options.edgeRateLimit.maxAttempts !== undefined && !positive(options.edgeRateLimit.maxAttempts)) {\n      addError('ACCESSI_EDGE_RATE_LIMIT_ATTEMPTS_INVALID', 'edgeRateLimit.maxAttempts deve essere positivo.');\n    }\n  }\n  if (options?.consoleEntry?.ttlMs !== undefined && !positive(options.consoleEntry.ttlMs)) {\n    addError('ACCESSI_CONSOLE_ENTRY_TTL_INVALID', 'consoleEntry.ttlMs deve essere positivo.');\n  }\n\n  return { errors, warnings };\n}\n\n/** Lancia un errore aggregato se la configurazione non e valida. */\nexport function assertValidAccessiOptions(options: AccessiOptions): void {\n  const result = validateAccessiOptions(options);\n  if (result.errors.length === 0) return;\n  throw new Error(\n    `Configurazione Accessi non valida:\\n${result.errors\n      .map((issue) => `- ${issue.code}: ${issue.message}`)\n      .join('\\n')}`,\n  );\n}\n"]}

package/dist/accessi-module/startupLog.d.ts

@@ -0,0 +1,7 @@
+import type { AccessiOptions } from './AccessiModule';
+import type { ResolvedOpenApiSetupOptions } from '../openapi/OpenApiConfig';
+/**
+ * Logga gli indirizzi utili del modulo Accessi appena il bootstrap e completato, cosi che
+ * console, OpenAPI e API siano visibili insieme nei log di avvio.
+ */
+export declare function logAccessiStartup(options: AccessiOptions, openApiOverride?: ResolvedOpenApiSetupOptions): void;

package/dist/accessi-module/startupLog.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logAccessiStartup = logAccessiStartup;
+const Logger_1 = require("../Logger");
+const adminBootstrap_1 = require("./security/adminBootstrap");
+const OpenApiConfig_1 = require("../openapi/OpenApiConfig");
+/**
+ * Logga gli indirizzi utili del modulo Accessi appena il bootstrap e completato, cosi che
+ * console, OpenAPI e API siano visibili insieme nei log di avvio.
+ */
+function logAccessiStartup(options, openApiOverride) {
+    var _a, _b;
+    const logger = new Logger_1.Logger('Accessi');
+    const base = ((_a = options.publicBaseUrl) !== null && _a !== void 0 ? _a : '').replace(/\/+$/, '');
+    const url = (path) => `${base}${path}`;
+    const openApi = openApiOverride !== null && openApiOverride !== void 0 ? openApiOverride : (0, OpenApiConfig_1.resolveAccessiOpenApiOptions)(options.openapi);
+    logger.info('Accessi pronto. Indirizzi utili:');
+    logger.info(`  Console:      ${url('/api/accessi/console')}`);
+    if (openApi.enabled) {
+        logger.info(`  OpenAPI UI:   ${url(`/${openApi.openApiPath}`)}`);
+        logger.info(`  OpenAPI JSON: ${url(`/${openApi.openApiJsonPath}`)}`);
+    }
+    logger.info(`  API:          ${url('/api/accessi')}`);
+    if (((_b = options.adminBootstrap) === null || _b === void 0 ? void 0 : _b.enabled) === true) {
+        const token = (0, adminBootstrap_1.getOrCreateAdminBootstrapToken)();
+        logger.warning(`  Bootstrap admin abilitato. Token di avvio (monouso, valido fino al riavvio): ${token}`);
+    }
+}
+//# sourceMappingURL=startupLog.js.map

package/dist/accessi-module/startupLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startupLog.js","sourceRoot":"","sources":["../../src/accessi-module/startupLog.ts"],"names":[],"mappings":";;AAUA,8CAqBC;AA/BD,sCAAmC;AAEnC,8DAA2E;AAC3E,4DAAwE;AAGxE;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,OAAuB,EACvB,eAA6C;;IAE7C,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,MAAA,OAAO,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,IAAA,4CAA4B,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjF,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAA,MAAA,OAAO,CAAC,cAAc,0CAAE,OAAO,MAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAA,+CAA8B,GAAE,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,kFAAkF,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC","sourcesContent":["import { Logger } from '../Logger';\nimport type { AccessiOptions } from './AccessiModule';\nimport { getOrCreateAdminBootstrapToken } from './security/adminBootstrap';\nimport { resolveAccessiOpenApiOptions } from '../openapi/OpenApiConfig';\nimport type { ResolvedOpenApiSetupOptions } from '../openapi/OpenApiConfig';\n\n/**\n * Logga gli indirizzi utili del modulo Accessi appena il bootstrap e completato, cosi che\n * console, OpenAPI e API siano visibili insieme nei log di avvio.\n */\nexport function logAccessiStartup(\n  options: AccessiOptions,\n  openApiOverride?: ResolvedOpenApiSetupOptions\n): void {\n  const logger = new Logger('Accessi');\n  const base = (options.publicBaseUrl ?? '').replace(/\\/+$/, '');\n  const url = (path: string) => `${base}${path}`;\n  const openApi = openApiOverride ?? resolveAccessiOpenApiOptions(options.openapi);\n\n  logger.info('Accessi pronto. Indirizzi utili:');\n  logger.info(`  Console:      ${url('/api/accessi/console')}`);\n  if (openApi.enabled) {\n    logger.info(`  OpenAPI UI:   ${url(`/${openApi.openApiPath}`)}`);\n    logger.info(`  OpenAPI JSON: ${url(`/${openApi.openApiJsonPath}`)}`);\n  }\n  logger.info(`  API:          ${url('/api/accessi')}`);\n\n  if (options.adminBootstrap?.enabled === true) {\n    const token = getOrCreateAdminBootstrapToken();\n    logger.warning(`  Bootstrap admin abilitato. Token di avvio (monouso, valido fino al riavvio): ${token}`);\n  }\n}\n"]}

package/dist/allegati-module/AllegatiModule.d.ts

@@ -1,7 +1,18 @@
 import { DynamicModule } from "@nestjs/common";
+import { Request } from "express";
 import { Options } from "node-firebird";
 export interface AllegatiOptions {
     databaseOptions: Options;
+    /**
+     * Guard applicato a ogni richiesta dei controller Allegati.
+     * Se definito e restituisce `false`, la richiesta viene rifiutata con 403.
+     */
+    authorize?: (request: Request) => boolean | Promise<boolean>;
+    /**
+     * Sicurezza by default: se `authorize` non e configurato, le richieste vengono rifiutate con 403.
+     * Impostare `false` per ripristinare il comportamento storico (endpoint aperti) durante la migrazione.
+     */
+    requireAuthorization?: boolean;
 }
 export declare class AllegatiModule {
     static forRoot(options: AllegatiOptions): DynamicModule;

package/dist/allegati-module/AllegatiModule.js

@@ -9,10 +9,19 @@ var AllegatiModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AllegatiModule = void 0;
 const common_1 = require("@nestjs/common");
+const Logger_1 = require("../Logger");
 const AllegatiService_1 = require("./Services/AllegatiService/AllegatiService");
 const AllegatiController_1 = require("./Controllers/AllegatiController");
+const allegatiAuthorizationGuard_1 = require("./security/allegatiAuthorizationGuard");
 let AllegatiModule = AllegatiModule_1 = class AllegatiModule {
     static forRoot(options) {
+        const logger = new Logger_1.Logger(AllegatiModule_1.name);
+        if ((options === null || options === void 0 ? void 0 : options.requireAuthorization) === false) {
+            logger.warning('Allegati con requireAuthorization: false: gli endpoint sono accessibili senza controllo di autorizzazione. Configurare authorize e rimuovere l opt-out.');
+        }
+        else if (!(options === null || options === void 0 ? void 0 : options.authorize)) {
+            logger.error('Allegati senza authorize: tutte le richieste saranno rifiutate con 403. Configurare allegatiOptions.authorize (oppure requireAuthorization: false per il comportamento storico).');
+        }
         return {
             module: AllegatiModule_1,
             providers: [
@@ -21,6 +30,7 @@ let AllegatiModule = AllegatiModule_1 = class AllegatiModule {
                     useValue: options,
                 },
                 AllegatiService_1.AllegatiService,
+                allegatiAuthorizationGuard_1.AllegatiAuthorizationGuard,
             ],
             exports: ['ALLEGATI_OPTIONS', AllegatiService_1.AllegatiService],
         };
@@ -31,7 +41,7 @@ exports.AllegatiModule = AllegatiModule = AllegatiModule_1 = __decorate([
     (0, common_1.Global)(),
     (0, common_1.Module)({
         controllers: [AllegatiController_1.AllegatiController],
-        providers: [AllegatiService_1.AllegatiService],
+        providers: [AllegatiService_1.AllegatiService, allegatiAuthorizationGuard_1.AllegatiAuthorizationGuard],
         exports: [AllegatiService_1.AllegatiService],
     })
 ], AllegatiModule);

package/dist/allegati-module/AllegatiModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"AllegatiModule.js","sourceRoot":"","sources":["../../src/allegati-module/AllegatiModule.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAA6E;AAC7E,yEAAsE;AAc/D,IAAM,cAAc,sBAApB,MAAM,cAAc;IAEvB,MAAM,CAAC,OAAO,CAAC,OAAwB;QACnC,OAAO;YACH,MAAM,EAAE,gBAAc;YACtB,SAAS,EAAE;gBACP;oBACI,OAAO,EAAE,kBAAkB;oBAC3B,QAAQ,EAAE,OAAO;iBACpB;gBACD,iCAAe;aAClB;YACD,OAAO,EAAE,CAAC,kBAAkB,EAAE,iCAAe,CAAC;SACjD,CAAC;IACN,CAAC;CACJ,CAAA;AAfY,wCAAc;yBAAd,cAAc;IAN1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACJ,WAAW,EAAE,CAAC,uCAAkB,CAAC;QACjC,SAAS,EAAE,CAAC,iCAAe,CAAC;QAC5B,OAAO,EAAE,CAAC,iCAAe,CAAC;KAC7B,CAAC;GACW,cAAc,CAe1B","sourcesContent":["import { DynamicModule, Global, Module } from \"@nestjs/common\";\r\nimport { AllegatiService } from \"./Services/AllegatiService/AllegatiService\";\r\nimport { AllegatiController } from \"./Controllers/AllegatiController\";\r\nimport { Options } from \"node-firebird\";\nimport { Logger } from \"../Logger\";\r\n\r\nexport interface AllegatiOptions {\r\n    databaseOptions: Options;\r\n}\r\n\r\n@Global()\r\n@Module({\r\n    controllers: [AllegatiController],\r\n    providers: [AllegatiService],\r\n    exports: [AllegatiService],\r\n})\r\nexport class AllegatiModule {\r\n\r\n    static forRoot(options: AllegatiOptions): DynamicModule {\r\n        return {\r\n            module: AllegatiModule,\r\n            providers: [\r\n                {\r\n                    provide: 'ALLEGATI_OPTIONS',\r\n                    useValue: options,\r\n                },\r\n                AllegatiService,\r\n            ],\r\n            exports: ['ALLEGATI_OPTIONS', AllegatiService],\r\n        };\r\n    }\r\n}\n"]}
+{"version":3,"file":"AllegatiModule.js","sourceRoot":"","sources":["../../src/allegati-module/AllegatiModule.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA+D;AAG/D,sCAAmC;AACnC,gFAA6E;AAC7E,yEAAsE;AACtE,sFAAmF;AAsB5E,IAAM,cAAc,sBAApB,MAAM,cAAc;IAEvB,MAAM,CAAC,OAAO,CAAC,OAAwB;QACnC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,oBAAoB,MAAK,KAAK,EAAE,CAAC;YAC1C,MAAM,CAAC,OAAO,CAAC,yJAAyJ,CAAC,CAAC;QAC9K,CAAC;aAAM,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,CAAA,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,kLAAkL,CAAC,CAAC;QACrM,CAAC;QAED,OAAO;YACH,MAAM,EAAE,gBAAc;YACtB,SAAS,EAAE;gBACP;oBACI,OAAO,EAAE,kBAAkB;oBAC3B,QAAQ,EAAE,OAAO;iBACpB;gBACD,iCAAe;gBACf,uDAA0B;aAC7B;YACD,OAAO,EAAE,CAAC,kBAAkB,EAAE,iCAAe,CAAC;SACjD,CAAC;IACN,CAAC;CACJ,CAAA;AAvBY,wCAAc;yBAAd,cAAc;IAN1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACJ,WAAW,EAAE,CAAC,uCAAkB,CAAC;QACjC,SAAS,EAAE,CAAC,iCAAe,EAAE,uDAA0B,CAAC;QACxD,OAAO,EAAE,CAAC,iCAAe,CAAC;KAC7B,CAAC;GACW,cAAc,CAuB1B","sourcesContent":["import { DynamicModule, Global, Module } from \"@nestjs/common\";\nimport { Request } from \"express\";\nimport { Options } from \"node-firebird\";\nimport { Logger } from \"../Logger\";\nimport { AllegatiService } from \"./Services/AllegatiService/AllegatiService\";\nimport { AllegatiController } from \"./Controllers/AllegatiController\";\nimport { AllegatiAuthorizationGuard } from \"./security/allegatiAuthorizationGuard\";\n\nexport interface AllegatiOptions {\n    databaseOptions: Options;\n    /**\n     * Guard applicato a ogni richiesta dei controller Allegati.\n     * Se definito e restituisce `false`, la richiesta viene rifiutata con 403.\n     */\n    authorize?: (request: Request) => boolean | Promise<boolean>;\n    /**\n     * Sicurezza by default: se `authorize` non e configurato, le richieste vengono rifiutate con 403.\n     * Impostare `false` per ripristinare il comportamento storico (endpoint aperti) durante la migrazione.\n     */\n    requireAuthorization?: boolean;\n}\n\n@Global()\n@Module({\n    controllers: [AllegatiController],\n    providers: [AllegatiService, AllegatiAuthorizationGuard],\n    exports: [AllegatiService],\n})\nexport class AllegatiModule {\n\n    static forRoot(options: AllegatiOptions): DynamicModule {\n        const logger = new Logger(AllegatiModule.name);\n        if (options?.requireAuthorization === false) {\n            logger.warning('Allegati con requireAuthorization: false: gli endpoint sono accessibili senza controllo di autorizzazione. Configurare authorize e rimuovere l opt-out.');\n        } else if (!options?.authorize) {\n            logger.error('Allegati senza authorize: tutte le richieste saranno rifiutate con 403. Configurare allegatiOptions.authorize (oppure requireAuthorization: false per il comportamento storico).');\n        }\n\n        return {\n            module: AllegatiModule,\n            providers: [\n                {\n                    provide: 'ALLEGATI_OPTIONS',\n                    useValue: options,\n                },\n                AllegatiService,\n                AllegatiAuthorizationGuard,\n            ],\n            exports: ['ALLEGATI_OPTIONS', AllegatiService],\n        };\n    }\n}\n"]}

package/dist/allegati-module/Controllers/AllegatiController.d.ts

@@ -6,6 +6,7 @@ import { UploadSingleFileRequest } from "../Dtos/UploadSingleFileRequest";
 import e from "express";
 export declare class AllegatiController {
     private readonly allegatiService;
+    private readonly logger;
     constructor(allegatiService: AllegatiService);
     upload(files: Express.Multer.File[], uploadRequest: UploadSingleFileRequest): Promise<UploadAllegatoResponseDto>;
     download(id: number): Promise<DownloadAllegatoResponseDto>;
@@ -23,7 +24,7 @@ export declare class AllegatiController {
         codice?: number;
         docrif?: string;
         idxtipoall?: number;
-    }): Promise<AllegatoDto>;
+    }): Promise<AllegatoDto | null>;
     updateFieldsById(id: number, body: {
         tipcod?: string;
         codice?: number;

package/dist/allegati-module/Controllers/AllegatiController.js

@@ -23,21 +23,25 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
+var AllegatiController_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AllegatiController = void 0;
 const swagger_1 = require("@nestjs/swagger");
 const common_1 = require("@nestjs/common");
 const platform_express_1 = require("@nestjs/platform-express");
+const allegatiAuthorizationGuard_1 = require("../security/allegatiAuthorizationGuard");
 const AllegatiService_1 = require("../Services/AllegatiService/AllegatiService");
 const UploadAllegatoResponseDto_1 = require("../Dtos/responses/UploadAllegatoResponseDto");
 const AllegatoDto_1 = require("../Dtos/AllegatoDto");
 const DownloadAllegatoResponseDto_1 = require("../Dtos/responses/DownloadAllegatoResponseDto");
 const UploadSingleFileRequest_1 = require("../Dtos/UploadSingleFileRequest");
 const Utilities_1 = require("../../Utilities");
+const Logger_1 = require("../../Logger");
 const express_1 = __importDefault(require("express"));
-let AllegatiController = class AllegatiController {
+let AllegatiController = AllegatiController_1 = class AllegatiController {
     constructor(allegatiService) {
         this.allegatiService = allegatiService;
+        this.logger = new Logger_1.Logger(AllegatiController_1.name);
     }
     upload(files, uploadRequest) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -47,7 +51,11 @@ let AllegatiController = class AllegatiController {
             if (files.length > 1) {
                 throw new common_1.BadRequestException('Questo endpoint accetta un solo file alla volta');
             }
-            return yield this.allegatiService.uploadFile(files[0], uploadRequest);
+            const file = files[0];
+            if (!file) {
+                throw new common_1.BadRequestException('Nessun file fornito');
+            }
+            return yield this.allegatiService.uploadFile(file, uploadRequest);
         });
     }
     download(id) {
@@ -57,28 +65,27 @@ let AllegatiController = class AllegatiController {
     }
     downloadFile(id, res) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             try {
                 const file = yield this.allegatiService.downloadFile(id);
-                // Convert base64 to buffer in chunks
+                // Convert base64 to buffer in chunks; Buffer.concat evita i NUL finali del prealloc.
                 const chunkSize = 1024 * 1024; // 1MB chunks
                 const base64Content = file.contentBase64;
-                const bufferSize = Math.ceil((base64Content.length * 3) / 4);
-                const buffer = Buffer.alloc(bufferSize);
-                let bufferIndex = 0;
+                const chunks = [];
                 for (let i = 0; i < base64Content.length; i += chunkSize) {
                     const chunk = base64Content.slice(i, i + chunkSize);
-                    const chunkBuffer = Buffer.from(chunk, 'base64');
-                    chunkBuffer.copy(buffer, bufferIndex);
-                    bufferIndex += chunkBuffer.length;
+                    chunks.push(Buffer.from(chunk, 'base64'));
                 }
-                // Set headers for file download
-                res.setHeader('Content-Type', file.mimetype);
-                res.setHeader('Content-Disposition', `attachment; filename="${file.filename}"`);
+                const buffer = Buffer.concat(chunks);
+                // Set headers for file download; filename* (RFC 5987) per i nomi non ASCII.
+                const asciiName = file.filename.replace(/[^\x20-\x7e]/g, '_').replace(/["\\]/g, '_');
+                res.setHeader('Content-Type', (_a = file.mimetype) !== null && _a !== void 0 ? _a : 'application/octet-stream');
+                res.setHeader('Content-Disposition', `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(file.filename)}`);
                 res.setHeader('Content-Length', buffer.length);
                 res.status(200).end(buffer);
             }
             catch (error) {
-                console.error('[AllegatiController] downloadFile - Errore:', error);
+                this.logger.error('[AllegatiController] downloadFile - Errore:', error);
                 throw error;
             }
         });
@@ -119,7 +126,7 @@ let AllegatiController = class AllegatiController {
 exports.AllegatiController = AllegatiController;
 __decorate([
     (0, common_1.Post)('upload'),
-    (0, common_1.UseInterceptors)((0, platform_express_1.FilesInterceptor)('file')),
+    (0, common_1.UseInterceptors)((0, platform_express_1.FilesInterceptor)('file', 1, { limits: { fileSize: 90 * 1024 * 1024, files: 1 } })),
     (0, swagger_1.ApiConsumes)('multipart/form-data'),
     (0, swagger_1.ApiResponse)({ status: 201, description: 'File caricato con successo.', type: UploadAllegatoResponseDto_1.UploadAllegatoResponseDto }),
     (0, swagger_1.ApiBody)({
@@ -215,7 +222,8 @@ __decorate([
     __metadata("design:paramtypes", [Number, Object]),
     __metadata("design:returntype", Promise)
 ], AllegatiController.prototype, "updateFieldsById", null);
-exports.AllegatiController = AllegatiController = __decorate([
+exports.AllegatiController = AllegatiController = AllegatiController_1 = __decorate([
+    (0, common_1.UseGuards)(allegatiAuthorizationGuard_1.AllegatiAuthorizationGuard),
     (0, common_1.Controller)('allegati'),
     __metadata("design:paramtypes", [AllegatiService_1.AllegatiService])
 ], AllegatiController);