emilsoftware-utilities 2.0.0-dev.7 → 2.0.0-dev.71

package/dist/accessi-module/Controllers/ConfiguratorController.d.ts

@@ -1,13 +1,9 @@
 import { Request, Response } from 'express';
-import { AccessiOptions } from '../AccessiModule';
 import { UpdateEnabledStatusRequest } from '../Dtos';
 import { ConfiguratorService } from '../Services/ConfiguratorService/ConfiguratorService';
-import { UserService } from '../Services/UserService/UserService';
 export declare class ConfiguratorController {
-    private readonly options;
-    private userService;
     private configuratorService;
-    constructor(options: AccessiOptions, userService: UserService, configuratorService: ConfiguratorService);
+    constructor(configuratorService: ConfiguratorService);
     setMenuEnabled(codiceMenu: string, body: UpdateEnabledStatusRequest, req: Request, res: Response): Promise<Response<any, Record<string, any>>>;
     setGroupEnabled(codiceGruppo: string, body: UpdateEnabledStatusRequest, req: Request, res: Response): Promise<Response<any, Record<string, any>>>;
 }

package/dist/accessi-module/Controllers/ConfiguratorController.js

@@ -28,35 +28,24 @@ const swagger_1 = require("@nestjs/swagger");
 const Utilities_1 = require("../../Utilities");
 const Dtos_1 = require("../Dtos");
 const ConfiguratorService_1 = require("../Services/ConfiguratorService/ConfiguratorService");
-const UserService_1 = require("../Services/UserService/UserService");
 const jwt_strategy_1 = require("../jwt/jwt.strategy");
+const accessControl_1 = require("../security/accessControl");
 let ConfiguratorController = ConfiguratorController_1 = class ConfiguratorController {
-    constructor(options, userService, configuratorService) {
-        this.options = options;
-        this.userService = userService;
+    constructor(configuratorService) {
         this.configuratorService = configuratorService;
     }
     setMenuEnabled(codiceMenu, body, req, res) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
             try {
                 if (!codiceMenu)
-                    throw new Error('Il codice del menu � obbligatorio.');
+                    throw new common_1.BadRequestException('Il codice del menu e obbligatorio.');
                 if ((body === null || body === void 0 ? void 0 : body.enabled) === undefined)
-                    throw new Error('Lo stato di abilitazione � obbligatorio.');
-                const user = req === null || req === void 0 ? void 0 : req.user;
-                const codiceUtente = (_a = user === null || user === void 0 ? void 0 : user.utente) === null || _a === void 0 ? void 0 : _a.codiceUtente;
-                if (!codiceUtente) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Utente non riconosciuto dal token.', ConfiguratorController_1.name, 401);
-                }
-                const canConfigure = ((_b = user === null || user === void 0 ? void 0 : user.utente) === null || _b === void 0 ? void 0 : _b.flagAdminConfigurator) ||
-                    (yield this.userService.isAdminConfigurator(codiceUtente));
-                if (!canConfigure) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Utente non autorizzato ad aggiornare i menu.', ConfiguratorController_1.name, 403);
-                }
+                    throw new common_1.BadRequestException('Lo stato di abilitazione e obbligatorio.');
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(req);
+                (0, accessControl_1.ensureAdmin)(authenticatedUser, 'Utente non autorizzato ad aggiornare i menu.');
                 yield this.configuratorService.setMenuEnabled(codiceMenu, body.enabled);
                 const action = body.enabled ? 'abilitato' : 'disabilitato';
-                return Utilities_1.RestUtilities.sendOKMessage(res, `Il menu ${codiceMenu} � stato ${action} con successo.`);
+                return Utilities_1.RestUtilities.sendOKMessage(res, `Il menu ${codiceMenu} e stato ${action} con successo.`);
             }
             catch (error) {
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, ConfiguratorController_1.name);
@@ -65,25 +54,16 @@ let ConfiguratorController = ConfiguratorController_1 = class ConfiguratorContro
     }
     setGroupEnabled(codiceGruppo, body, req, res) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
             try {
                 if (!codiceGruppo)
-                    throw new Error('Il codice del gruppo � obbligatorio.');
+                    throw new common_1.BadRequestException('Il codice del gruppo e obbligatorio.');
                 if ((body === null || body === void 0 ? void 0 : body.enabled) === undefined)
-                    throw new Error('Lo stato di abilitazione � obbligatorio.');
-                const user = req === null || req === void 0 ? void 0 : req.user;
-                const codiceUtente = (_a = user === null || user === void 0 ? void 0 : user.utente) === null || _a === void 0 ? void 0 : _a.codiceUtente;
-                if (!codiceUtente) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Utente non riconosciuto dal token.', ConfiguratorController_1.name, 401);
-                }
-                const canConfigure = ((_b = user === null || user === void 0 ? void 0 : user.utente) === null || _b === void 0 ? void 0 : _b.flagAdminConfigurator) ||
-                    (yield this.userService.isAdminConfigurator(codiceUtente));
-                if (!canConfigure) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Utente non autorizzato ad aggiornare i gruppi menu.', ConfiguratorController_1.name, 403);
-                }
+                    throw new common_1.BadRequestException('Lo stato di abilitazione e obbligatorio.');
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(req);
+                (0, accessControl_1.ensureAdmin)(authenticatedUser, 'Utente non autorizzato ad aggiornare i gruppi menu.');
                 yield this.configuratorService.setGroupEnabled(codiceGruppo, body.enabled);
                 const action = body.enabled ? 'abilitato' : 'disabilitato';
-                return Utilities_1.RestUtilities.sendOKMessage(res, `Il gruppo ${codiceGruppo} � stato ${action} con successo.`);
+                return Utilities_1.RestUtilities.sendOKMessage(res, `Il gruppo ${codiceGruppo} e stato ${action} con successo.`);
             }
             catch (error) {
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, ConfiguratorController_1.name);
@@ -104,10 +84,11 @@ __decorate([
         example: 'MNU001',
     }),
     (0, swagger_1.ApiBody)({ type: Dtos_1.UpdateEnabledStatusRequest }),
-    (0, swagger_1.ApiResponse)({ status: 200, description: 'Stato del menu aggiornato con successo' }),
-    (0, swagger_1.ApiResponse)({ status: 400, description: 'Errore di validazione nei dati inviati' }),
-    (0, swagger_1.ApiResponse)({ status: 403, description: "Utente non autorizzato ad eseguire l'operazione" }),
-    (0, swagger_1.ApiResponse)({ status: 500, description: 'Errore interno del server' }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'Stato del menu aggiornato con successo', type: Dtos_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'Errore di validazione nei dati inviati', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, description: 'Utente non autenticato o token non valido', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: "Utente non autorizzato ad eseguire l'operazione", type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 500, description: 'Errore interno del server', type: Dtos_1.ErrorResponse }),
     (0, common_1.Patch)('menus/:codiceMenu/enabled'),
     __param(0, (0, common_1.Param)('codiceMenu')),
     __param(1, (0, common_1.Body)()),
@@ -129,10 +110,11 @@ __decorate([
         example: 'GRP01',
     }),
     (0, swagger_1.ApiBody)({ type: Dtos_1.UpdateEnabledStatusRequest }),
-    (0, swagger_1.ApiResponse)({ status: 200, description: 'Stato del gruppo aggiornato con successo' }),
-    (0, swagger_1.ApiResponse)({ status: 400, description: 'Errore di validazione nei dati inviati' }),
-    (0, swagger_1.ApiResponse)({ status: 403, description: "Utente non autorizzato ad eseguire l'operazione" }),
-    (0, swagger_1.ApiResponse)({ status: 500, description: 'Errore interno del server' }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'Stato del gruppo aggiornato con successo', type: Dtos_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'Errore di validazione nei dati inviati', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, description: 'Utente non autenticato o token non valido', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: "Utente non autorizzato ad eseguire l'operazione", type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 500, description: 'Errore interno del server', type: Dtos_1.ErrorResponse }),
     (0, common_1.Patch)('groups/:codiceGruppo/enabled'),
     __param(0, (0, common_1.Param)('codiceGruppo')),
     __param(1, (0, common_1.Body)()),
@@ -146,9 +128,9 @@ exports.ConfiguratorController = ConfiguratorController = ConfiguratorController
     (0, swagger_1.ApiBearerAuth)(),
     (0, swagger_1.ApiTags)('Configurator'),
     (0, common_1.Controller)('accessi/configurator'),
-    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard),
-    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
-    __metadata("design:paramtypes", [Object, UserService_1.UserService,
-        ConfiguratorService_1.ConfiguratorService])
+    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard)
+    /** Endpoint amministrativi per abilitare o disabilitare cataloghi menu senza cancellarne lo storico. */
+    ,
+    __metadata("design:paramtypes", [ConfiguratorService_1.ConfiguratorService])
 ], ConfiguratorController);
 //# sourceMappingURL=ConfiguratorController.js.map

package/dist/accessi-module/Controllers/ConfiguratorController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfiguratorController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/ConfiguratorController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAOyB;AAEzB,+CAAgD;AAEhD,kCAAqD;AACrD,6FAA0F;AAC1F,qEAAkE;AAClE,sDAAqD;AAM9C,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,YAC8C,OAAuB,EAC3D,WAAwB,EACxB,mBAAwC;QAFJ,YAAO,GAAP,OAAO,CAAgB;QAC3D,gBAAW,GAAX,WAAW,CAAa;QACxB,wBAAmB,GAAnB,mBAAmB,CAAqB;IAC/C,CAAC;IAkBE,cAAc,CACG,UAAkB,EAC/B,IAAgC,EACjC,GAAY,EACZ,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACvE,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,MAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAE7F,MAAM,IAAI,GAAI,GAAW,aAAX,GAAG,uBAAH,GAAG,CAAU,IAAI,CAAC;gBAChC,MAAM,YAAY,GAAG,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,YAAY,CAAC;gBAChD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,oCAAoC,EACpC,wBAAsB,CAAC,IAAI,EAC3B,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAED,MAAM,YAAY,GAChB,CAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,qBAAqB;oBACnC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,8CAA8C,EAC9C,wBAAsB,CAAC,IAAI,EAC3B,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAExE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,WAAW,UAAU,YAAY,MAAM,gBAAgB,CACxD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;IAkBK,eAAe,CACI,YAAoB,EACnC,IAAgC,EACjC,GAAY,EACZ,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAC3E,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,MAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAE7F,MAAM,IAAI,GAAI,GAAW,aAAX,GAAG,uBAAH,GAAG,CAAU,IAAI,CAAC;gBAChC,MAAM,YAAY,GAAG,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,YAAY,CAAC;gBAChD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,oCAAoC,EACpC,wBAAsB,CAAC,IAAI,EAC3B,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAED,MAAM,YAAY,GAChB,CAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,qBAAqB;oBACnC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,qDAAqD,EACrD,wBAAsB,CAAC,IAAI,EAC3B,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAE3E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,aAAa,YAAY,YAAY,MAAM,gBAAgB,CAC5D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAhIY,wDAAsB;AAuB3B;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,gBAAgB;KAC9B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,8CAA8C;QAC3D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,QAAQ;KAClB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAA0B,EAAE,CAAC;IAC7C,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACnF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACnF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IACtE,IAAA,cAAK,EAAC,2BAA2B,CAAC;IAEhC,WAAA,IAAA,cAAK,EAAC,YAAY,CAAC,CAAA;IACnB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAFQ,iCAA0B;;4DAyCzC;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,iBAAiB;KAC/B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,OAAO;KACjB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAA0B,EAAE,CAAC;IAC7C,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;IACrF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACnF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IACtE,IAAA,cAAK,EAAC,8BAA8B,CAAC;IAEnC,WAAA,IAAA,cAAK,EAAC,cAAc,CAAC,CAAA;IACrB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAFQ,iCAA0B;;6DAyCzC;iCA/HU,sBAAsB;IAJlC,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAO,EAAC,cAAc,CAAC;IACvB,IAAA,mBAAU,EAAC,sBAAsB,CAAC;IAClC,IAAA,kBAAS,EAAC,6BAAc,CAAC;IAGrB,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACL,yBAAW;QACH,yCAAmB;GAJvC,sBAAsB,CAgIlC","sourcesContent":["import {\r\n    Body,\r\n    Controller,\r\n    Inject,\r\n    Param,\r\n    Patch,\r\n    Res,\r\n    UseGuards,\r\n    Req\r\n} from '@nestjs/common';\r\nimport {\r\n    ApiBearerAuth,\r\n    ApiBody,\r\n    ApiOperation,\r\n    ApiParam,\r\n    ApiResponse,\r\n    ApiTags\r\n} from '@nestjs/swagger';\r\nimport { Request, Response } from 'express';\r\nimport { RestUtilities } from '../../Utilities';\r\nimport { AccessiOptions } from '../AccessiModule';\r\nimport { UpdateEnabledStatusRequest } from '../Dtos';\r\nimport { ConfiguratorService } from '../Services/ConfiguratorService/ConfiguratorService';\r\nimport { UserService } from '../Services/UserService/UserService';\r\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\r\n\r\n@ApiBearerAuth()\r\n@ApiTags('Configurator')\r\n@Controller('accessi/configurator')\r\n@UseGuards(JwtSimpleGuard)\r\nexport class ConfiguratorController {\r\n  constructor(\r\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\r\n    private userService: UserService,\r\n    private configuratorService: ConfiguratorService\r\n  ) {}\r\n\r\n  @ApiOperation({\r\n    summary: 'Aggiorna lo stato di abilitazione di un menu',\r\n    operationId: 'setMenuEnabled',\r\n  })\r\n  @ApiParam({\r\n    name: 'codiceMenu',\r\n    description: 'Codice identificativo del menu da aggiornare',\r\n    required: true,\r\n    example: 'MNU001',\r\n  })\r\n  @ApiBody({ type: UpdateEnabledStatusRequest })\r\n  @ApiResponse({ status: 200, description: 'Stato del menu aggiornato con successo' })\r\n  @ApiResponse({ status: 400, description: 'Errore di validazione nei dati inviati' })\r\n  @ApiResponse({ status: 403, description: \"Utente non autorizzato ad eseguire l'operazione\" })\r\n  @ApiResponse({ status: 500, description: 'Errore interno del server' })\r\n  @Patch('menus/:codiceMenu/enabled')\r\n  async setMenuEnabled(\r\n    @Param('codiceMenu') codiceMenu: string,\r\n    @Body() body: UpdateEnabledStatusRequest,\r\n    @Req() req: Request,\r\n    @Res() res: Response,\r\n  ) {\r\n    try {\r\n      if (!codiceMenu) throw new Error('Il codice del menu � obbligatorio.');\r\n      if (body?.enabled === undefined) throw new Error('Lo stato di abilitazione � obbligatorio.');\r\n\r\n      const user = (req as any)?.user;\r\n      const codiceUtente = user?.utente?.codiceUtente;\r\n      if (!codiceUtente) {\r\n        return RestUtilities.sendErrorMessage(\r\n          res,\r\n          'Utente non riconosciuto dal token.',\r\n          ConfiguratorController.name,\r\n          401,\r\n        );\r\n      }\r\n\r\n      const canConfigure =\r\n        user?.utente?.flagAdminConfigurator ||\r\n        (await this.userService.isAdminConfigurator(codiceUtente));\r\n      if (!canConfigure) {\r\n        return RestUtilities.sendErrorMessage(\r\n          res,\r\n          'Utente non autorizzato ad aggiornare i menu.',\r\n          ConfiguratorController.name,\r\n          403,\r\n        );\r\n      }\r\n\r\n      await this.configuratorService.setMenuEnabled(codiceMenu, body.enabled);\r\n\r\n      const action = body.enabled ? 'abilitato' : 'disabilitato';\r\n      return RestUtilities.sendOKMessage(\r\n        res,\r\n        `Il menu ${codiceMenu} � stato ${action} con successo.`,\r\n      );\r\n    } catch (error) {\r\n      return RestUtilities.sendErrorMessage(res, error, ConfiguratorController.name);\r\n    }\r\n  }\r\n\r\n  @ApiOperation({\r\n    summary: 'Aggiorna lo stato di abilitazione di un gruppo menu',\r\n    operationId: 'setGroupEnabled',\r\n  })\r\n  @ApiParam({\r\n    name: 'codiceGruppo',\r\n    description: 'Codice identificativo del gruppo da aggiornare',\r\n    required: true,\r\n    example: 'GRP01',\r\n  })\r\n  @ApiBody({ type: UpdateEnabledStatusRequest })\r\n  @ApiResponse({ status: 200, description: 'Stato del gruppo aggiornato con successo' })\r\n  @ApiResponse({ status: 400, description: 'Errore di validazione nei dati inviati' })\r\n  @ApiResponse({ status: 403, description: \"Utente non autorizzato ad eseguire l'operazione\" })\r\n  @ApiResponse({ status: 500, description: 'Errore interno del server' })\r\n  @Patch('groups/:codiceGruppo/enabled')\r\n  async setGroupEnabled(\r\n    @Param('codiceGruppo') codiceGruppo: string,\r\n    @Body() body: UpdateEnabledStatusRequest,\r\n    @Req() req: Request,\r\n    @Res() res: Response,\r\n  ) {\r\n    try {\r\n      if (!codiceGruppo) throw new Error('Il codice del gruppo � obbligatorio.');\r\n      if (body?.enabled === undefined) throw new Error('Lo stato di abilitazione � obbligatorio.');\r\n\r\n      const user = (req as any)?.user;\r\n      const codiceUtente = user?.utente?.codiceUtente;\r\n      if (!codiceUtente) {\r\n        return RestUtilities.sendErrorMessage(\r\n          res,\r\n          'Utente non riconosciuto dal token.',\r\n          ConfiguratorController.name,\r\n          401,\r\n        );\r\n      }\r\n\r\n      const canConfigure =\r\n        user?.utente?.flagAdminConfigurator ||\r\n        (await this.userService.isAdminConfigurator(codiceUtente));\r\n      if (!canConfigure) {\r\n        return RestUtilities.sendErrorMessage(\r\n          res,\r\n          'Utente non autorizzato ad aggiornare i gruppi menu.',\r\n          ConfiguratorController.name,\r\n          403,\r\n        );\r\n      }\r\n\r\n      await this.configuratorService.setGroupEnabled(codiceGruppo, body.enabled);\r\n\r\n      const action = body.enabled ? 'abilitato' : 'disabilitato';\r\n      return RestUtilities.sendOKMessage(\r\n        res,\r\n        `Il gruppo ${codiceGruppo} � stato ${action} con successo.`,\r\n      );\r\n    } catch (error) {\r\n      return RestUtilities.sendErrorMessage(res, error, ConfiguratorController.name);\r\n    }\r\n  }\r\n}\r\n"]}
+{"version":3,"file":"ConfiguratorController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/ConfiguratorController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAOyB;AAEzB,+CAAgD;AAChD,kCAAoF;AACpF,6FAA0F;AAC1F,sDAAqD;AACrD,6DAAqF;AAO9E,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,YACU,mBAAwC;QAAxC,wBAAmB,GAAnB,mBAAmB,CAAqB;IAC/C,CAAC;IAmBE,cAAc,CACG,UAAkB,EAC/B,IAAgC,EACjC,GAAY,EACZ,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU;oBAAE,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;gBACrF,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,MAAK,SAAS;oBAAE,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;gBAE3G,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,GAAG,CAAC,CAAC;gBAC3D,IAAA,2BAAW,EAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;gBAE/E,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAExE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,WAAW,UAAU,YAAY,MAAM,gBAAgB,CACxD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;IAmBK,eAAe,CACI,YAAoB,EACnC,IAAgC,EACjC,GAAY,EACZ,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;gBACzF,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,MAAK,SAAS;oBAAE,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;gBAE3G,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,GAAG,CAAC,CAAC;gBAC3D,IAAA,2BAAW,EAAC,iBAAiB,EAAE,qDAAqD,CAAC,CAAC;gBAEtF,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAE3E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,aAAa,YAAY,YAAY,MAAM,gBAAgB,CAC5D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAxFY,wDAAsB;AAsB3B;IAjBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,gBAAgB;KAC9B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,8CAA8C;QAC3D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,QAAQ;KAClB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAA0B,EAAE,CAAC;IAC7C,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wCAAwC,EAAE,IAAI,EAAE,qBAAc,EAAE,CAAC;IACzG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wCAAwC,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACxG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2CAA2C,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,iDAAiD,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3F,IAAA,cAAK,EAAC,2BAA2B,CAAC;IAEhC,WAAA,IAAA,cAAK,EAAC,YAAY,CAAC,CAAA;IACnB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAFQ,iCAA0B;;4DAqBzC;AAmBK;IAjBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,iBAAiB;KAC/B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,OAAO;KACjB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAA0B,EAAE,CAAC;IAC7C,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,0CAA0C,EAAE,IAAI,EAAE,qBAAc,EAAE,CAAC;IAC3G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wCAAwC,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACxG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2CAA2C,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,iDAAiD,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3F,IAAA,cAAK,EAAC,8BAA8B,CAAC;IAEnC,WAAA,IAAA,cAAK,EAAC,cAAc,CAAC,CAAA;IACrB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAFQ,iCAA0B;;6DAqBzC;iCAvFU,sBAAsB;IALlC,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAO,EAAC,cAAc,CAAC;IACvB,IAAA,mBAAU,EAAC,sBAAsB,CAAC;IAClC,IAAA,kBAAS,EAAC,6BAAc,CAAC;IAC1B,wGAAwG;;qCAGvE,yCAAmB;GAFvC,sBAAsB,CAwFlC","sourcesContent":["import {\n  BadRequestException,\n  Body,\n  Controller,\n  Param,\n  Patch,\n  Req,\n  Res,\n  UseGuards,\n} from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOperation,\n  ApiParam,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport { ActionResponse, ErrorResponse, UpdateEnabledStatusRequest } from '../Dtos';\nimport { ConfiguratorService } from '../Services/ConfiguratorService/ConfiguratorService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureAdmin, getAuthenticatedAccessiUser } from '../security/accessControl';\n\n@ApiBearerAuth()\n@ApiTags('Configurator')\n@Controller('accessi/configurator')\n@UseGuards(JwtSimpleGuard)\n/** Endpoint amministrativi per abilitare o disabilitare cataloghi menu senza cancellarne lo storico. */\nexport class ConfiguratorController {\n  constructor(\n    private configuratorService: ConfiguratorService,\n  ) {}\n\n  @ApiOperation({\n    summary: 'Aggiorna lo stato di abilitazione di un menu',\n    operationId: 'setMenuEnabled',\n  })\n  @ApiParam({\n    name: 'codiceMenu',\n    description: 'Codice identificativo del menu da aggiornare',\n    required: true,\n    example: 'MNU001',\n  })\n  @ApiBody({ type: UpdateEnabledStatusRequest })\n  @ApiResponse({ status: 200, description: 'Stato del menu aggiornato con successo', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Errore di validazione nei dati inviati', type: ErrorResponse })\n  @ApiResponse({ status: 401, description: 'Utente non autenticato o token non valido', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: \"Utente non autorizzato ad eseguire l'operazione\", type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @Patch('menus/:codiceMenu/enabled')\n  async setMenuEnabled(\n    @Param('codiceMenu') codiceMenu: string,\n    @Body() body: UpdateEnabledStatusRequest,\n    @Req() req: Request,\n    @Res() res: Response,\n  ) {\n    try {\n      if (!codiceMenu) throw new BadRequestException('Il codice del menu e obbligatorio.');\n      if (body?.enabled === undefined) throw new BadRequestException('Lo stato di abilitazione e obbligatorio.');\n\n      const authenticatedUser = getAuthenticatedAccessiUser(req);\n      ensureAdmin(authenticatedUser, 'Utente non autorizzato ad aggiornare i menu.');\n\n      await this.configuratorService.setMenuEnabled(codiceMenu, body.enabled);\n\n      const action = body.enabled ? 'abilitato' : 'disabilitato';\n      return RestUtilities.sendOKMessage(\n        res,\n        `Il menu ${codiceMenu} e stato ${action} con successo.`,\n      );\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, ConfiguratorController.name);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Aggiorna lo stato di abilitazione di un gruppo menu',\n    operationId: 'setGroupEnabled',\n  })\n  @ApiParam({\n    name: 'codiceGruppo',\n    description: 'Codice identificativo del gruppo da aggiornare',\n    required: true,\n    example: 'GRP01',\n  })\n  @ApiBody({ type: UpdateEnabledStatusRequest })\n  @ApiResponse({ status: 200, description: 'Stato del gruppo aggiornato con successo', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Errore di validazione nei dati inviati', type: ErrorResponse })\n  @ApiResponse({ status: 401, description: 'Utente non autenticato o token non valido', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: \"Utente non autorizzato ad eseguire l'operazione\", type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @Patch('groups/:codiceGruppo/enabled')\n  async setGroupEnabled(\n    @Param('codiceGruppo') codiceGruppo: string,\n    @Body() body: UpdateEnabledStatusRequest,\n    @Req() req: Request,\n    @Res() res: Response,\n  ) {\n    try {\n      if (!codiceGruppo) throw new BadRequestException('Il codice del gruppo e obbligatorio.');\n      if (body?.enabled === undefined) throw new BadRequestException('Lo stato di abilitazione e obbligatorio.');\n\n      const authenticatedUser = getAuthenticatedAccessiUser(req);\n      ensureAdmin(authenticatedUser, 'Utente non autorizzato ad aggiornare i gruppi menu.');\n\n      await this.configuratorService.setGroupEnabled(codiceGruppo, body.enabled);\n\n      const action = body.enabled ? 'abilitato' : 'disabilitato';\n      return RestUtilities.sendOKMessage(\n        res,\n        `Il gruppo ${codiceGruppo} e stato ${action} con successo.`,\n      );\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, ConfiguratorController.name);\n    }\n  }\n}\n"]}

package/dist/accessi-module/Controllers/ConsoleEntryController.d.ts

@@ -0,0 +1,16 @@
+import { Request, Response } from 'express';
+import type { AccessiOptions } from '../AccessiModule';
+import { ConsoleEntryExchangeRequest } from '../Dtos/ConsoleEntryDtos';
+/**
+ * Auto-ingresso alla console amministrativa da un frontend gia autenticato.
+ * Il frontend scambia la propria sessione Accessi con un ticket monouso, poi apre
+ * `/api/accessi/console#entry=<ticket>`: il JWT non passa mai nell'URL.
+ */
+export declare class ConsoleEntryController {
+    private readonly options;
+    constructor(options: AccessiOptions);
+    private get store();
+    private get ttlMs();
+    createEntryTicket(request: Request, res: Response): Promise<Response<any, Record<string, any>>>;
+    exchangeEntryTicket(request: Request, body: ConsoleEntryExchangeRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+}

package/dist/accessi-module/Controllers/ConsoleEntryController.js

@@ -0,0 +1,136 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var ConsoleEntryController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConsoleEntryController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const Utilities_1 = require("../../Utilities");
+const ConsoleEntryDtos_1 = require("../Dtos/ConsoleEntryDtos");
+const BaseResponse_1 = require("../Dtos/BaseResponse");
+const jwt_strategy_1 = require("../jwt/jwt.strategy");
+const accessControl_1 = require("../security/accessControl");
+const authenticatedToken_1 = require("../security/authenticatedToken");
+const consoleEntry_1 = require("../security/consoleEntry");
+const publicAuthRateLimit_1 = require("../security/publicAuthRateLimit");
+/**
+ * Auto-ingresso alla console amministrativa da un frontend gia autenticato.
+ * Il frontend scambia la propria sessione Accessi con un ticket monouso, poi apre
+ * `/api/accessi/console#entry=<ticket>`: il JWT non passa mai nell'URL.
+ */
+let ConsoleEntryController = ConsoleEntryController_1 = class ConsoleEntryController {
+    constructor(options) {
+        this.options = options;
+    }
+    get store() {
+        var _a, _b;
+        return (_b = (_a = this.options.consoleEntry) === null || _a === void 0 ? void 0 : _a.store) !== null && _b !== void 0 ? _b : (0, consoleEntry_1.getDefaultConsoleEntryStore)();
+    }
+    get ttlMs() {
+        var _a, _b;
+        return (_b = (_a = this.options.consoleEntry) === null || _a === void 0 ? void 0 : _a.ttlMs) !== null && _b !== void 0 ? _b : 60000;
+    }
+    createEntryTicket(request, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const user = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                (0, accessControl_1.ensureConsoleAccess)(user);
+                const tokenValue = (0, authenticatedToken_1.extractAccessiBearerToken)(request.headers['authorization']);
+                if (!tokenValue) {
+                    throw new common_1.UnauthorizedException({ code: 'ACCESSI_CONSOLE_ENTRY_TOKEN_MISSING', message: 'Token Accessi mancante.' });
+                }
+                const issued = yield this.store.issue({ token: tokenValue, codiceUtente: user.codiceUtente }, this.ttlMs);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, issued);
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, ConsoleEntryController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.UNAUTHORIZED);
+            }
+        });
+    }
+    exchangeEntryTicket(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const decision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'consoleEntry', request, [(_a = body === null || body === void 0 ? void 0 : body.ticket) !== null && _a !== void 0 ? _a : '']);
+                if (!decision.allowed) {
+                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, decision.retryAfterSeconds);
+                }
+                const entry = yield this.store.consume(body === null || body === void 0 ? void 0 : body.ticket);
+                if (!entry) {
+                    throw new common_1.UnauthorizedException({
+                        code: 'ACCESSI_CONSOLE_ENTRY_INVALID',
+                        message: 'Ticket di ingresso console non valido o scaduto. Riapri la console dal frontend.',
+                    });
+                }
+                return Utilities_1.RestUtilities.sendBaseResponse(res, { token: { value: entry.token, type: 'Bearer' } });
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, ConsoleEntryController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.UNAUTHORIZED);
+            }
+        });
+    }
+};
+exports.ConsoleEntryController = ConsoleEntryController;
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Emetti un ticket di ingresso alla console',
+        operationId: 'createConsoleEntryTicket',
+        description: 'Riservato agli utenti abilitati alla console (FLGSUPER/FLGADMIN). Restituisce un ticket monouso legato all utente, valido pochi secondi.',
+    }),
+    (0, swagger_1.ApiOkResponse)({ type: ConsoleEntryDtos_1.ConsoleEntryTicketResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: BaseResponse_1.ErrorResponse, description: 'Token Accessi mancante o non valido.' }),
+    (0, swagger_1.ApiResponse)({ status: 403, type: BaseResponse_1.ErrorResponse, description: 'Utente non abilitato alla console.' }),
+    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard),
+    (0, common_1.Post)('entry'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], ConsoleEntryController.prototype, "createEntryTicket", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Scambia il ticket con la sessione Accessi',
+        operationId: 'exchangeConsoleEntryTicket',
+        description: 'Endpoint pubblico (il ticket e l unica credenziale) protetto da rate limit; il ticket e monouso e scade in pochi secondi.',
+    }),
+    (0, swagger_1.ApiBody)({ type: ConsoleEntryDtos_1.ConsoleEntryExchangeRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: ConsoleEntryDtos_1.ConsoleEntrySessionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: BaseResponse_1.ErrorResponse, description: 'Ticket non valido o scaduto.' }),
+    (0, swagger_1.ApiResponse)({ status: 429, type: BaseResponse_1.ErrorResponse, description: 'Troppi tentativi.' }),
+    (0, common_1.Post)('entry/exchange'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, ConsoleEntryDtos_1.ConsoleEntryExchangeRequest, Object]),
+    __metadata("design:returntype", Promise)
+], ConsoleEntryController.prototype, "exchangeEntryTicket", null);
+exports.ConsoleEntryController = ConsoleEntryController = ConsoleEntryController_1 = __decorate([
+    (0, swagger_1.ApiTags)('Console'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('accessi/console'),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object])
+], ConsoleEntryController);
+//# sourceMappingURL=ConsoleEntryController.js.map

package/dist/accessi-module/Controllers/ConsoleEntryController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConsoleEntryController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/ConsoleEntryController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAOyB;AAEzB,+CAAgD;AAEhD,+DAAgI;AAChI,uDAAqD;AACrD,sDAAqD;AACrD,6DAA6F;AAC7F,uEAA2E;AAC3E,2DAAuE;AAEvE,yEAGyC;AAEzC;;;;GAIG;AAII,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,YAAwD,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAEnF,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,IAAA,0CAA2B,GAAE,CAAC;IAC3E,CAAC;IAED,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,KAAM,CAAC;IACpD,CAAC;IAYK,iBAAiB,CAAQ,OAAgB,EAAS,GAAa;;YACnE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAA,mCAAmB,EAAC,IAAI,CAAC,CAAC;gBAE1B,MAAM,UAAU,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBACvH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EACtD,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAYK,mBAAmB,CAChB,OAAgB,EACf,IAAiC,EAClC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,EAAE,CAAC,CAAC,CAAC;gBAC7G,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,CAAC,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,8BAAqB,CAAC;wBAC9B,IAAI,EAAE,+BAA+B;wBACrC,OAAO,EAAE,kFAAkF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AArFY,wDAAsB;AAqB3B;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,0IAA0I;KACxJ,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6CAA0B,EAAE,CAAC;IACnD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IACpG,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,OAAO,CAAC;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;+DAuBtD;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,2HAA2H;KACzI,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IAC9C,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IACpD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC9F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnF,IAAA,aAAI,EAAC,gBAAgB,CAAC;IAEpB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,8CAA2B;;iEA0B1C;iCApFU,sBAAsB;IAHlC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAEf,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,sBAAsB,CAqFlC","sourcesContent":["import {\n  Body,\n  Controller,\n  HttpException,\n  HttpStatus,\n  Inject,\n  Post,\n  Req,\n  Res,\n  UnauthorizedException,\n  UseGuards,\n} from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ConsoleEntryExchangeRequest, ConsoleEntrySessionResponse, ConsoleEntryTicketResponse } from '../Dtos/ConsoleEntryDtos';\nimport { ErrorResponse } from '../Dtos/BaseResponse';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureConsoleAccess, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { extractAccessiBearerToken } from '../security/authenticatedToken';\nimport { getDefaultConsoleEntryStore } from '../security/consoleEntry';\nimport type { ConsoleEntryStore } from '../security/consoleEntry';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n/**\n * Auto-ingresso alla console amministrativa da un frontend gia autenticato.\n * Il frontend scambia la propria sessione Accessi con un ticket monouso, poi apre\n * `/api/accessi/console#entry=<ticket>`: il JWT non passa mai nell'URL.\n */\n@ApiTags('Console')\n@ApiBearerAuth()\n@Controller('accessi/console')\nexport class ConsoleEntryController {\n  constructor(@Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions) {}\n\n  private get store(): ConsoleEntryStore {\n    return this.options.consoleEntry?.store ?? getDefaultConsoleEntryStore();\n  }\n\n  private get ttlMs(): number {\n    return this.options.consoleEntry?.ttlMs ?? 60_000;\n  }\n\n  @ApiOperation({\n    summary: 'Emetti un ticket di ingresso alla console',\n    operationId: 'createConsoleEntryTicket',\n    description: 'Riservato agli utenti abilitati alla console (FLGSUPER/FLGADMIN). Restituisce un ticket monouso legato all utente, valido pochi secondi.',\n  })\n  @ApiOkResponse({ type: ConsoleEntryTicketResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n  @ApiResponse({ status: 403, type: ErrorResponse, description: 'Utente non abilitato alla console.' })\n  @UseGuards(JwtSimpleGuard)\n  @Post('entry')\n  async createEntryTicket(@Req() request: Request, @Res() res: Response) {\n    try {\n      const user = getAuthenticatedAccessiUser(request);\n      ensureConsoleAccess(user);\n\n      const tokenValue = extractAccessiBearerToken(request.headers['authorization']);\n      if (!tokenValue) {\n        throw new UnauthorizedException({ code: 'ACCESSI_CONSOLE_ENTRY_TOKEN_MISSING', message: 'Token Accessi mancante.' });\n      }\n\n      const issued = await this.store.issue(\n        { token: tokenValue, codiceUtente: user.codiceUtente },\n        this.ttlMs,\n      );\n      return RestUtilities.sendBaseResponse(res, issued);\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        ConsoleEntryController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n      );\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Scambia il ticket con la sessione Accessi',\n    operationId: 'exchangeConsoleEntryTicket',\n    description: 'Endpoint pubblico (il ticket e l unica credenziale) protetto da rate limit; il ticket e monouso e scade in pochi secondi.',\n  })\n  @ApiBody({ type: ConsoleEntryExchangeRequest })\n  @ApiOkResponse({ type: ConsoleEntrySessionResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Ticket non valido o scaduto.' })\n  @ApiResponse({ status: 429, type: ErrorResponse, description: 'Troppi tentativi.' })\n  @Post('entry/exchange')\n  async exchangeEntryTicket(\n    @Req() request: Request,\n    @Body() body: ConsoleEntryExchangeRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const decision = await checkPublicAuthRateLimit(this.options, 'consoleEntry', request, [body?.ticket ?? '']);\n      if (!decision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, decision.retryAfterSeconds);\n      }\n\n      const entry = await this.store.consume(body?.ticket);\n      if (!entry) {\n        throw new UnauthorizedException({\n          code: 'ACCESSI_CONSOLE_ENTRY_INVALID',\n          message: 'Ticket di ingresso console non valido o scaduto. Riapri la console dal frontend.',\n        });\n      }\n\n      return RestUtilities.sendBaseResponse(res, { token: { value: entry.token, type: 'Bearer' } });\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        ConsoleEntryController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n      );\n    }\n  }\n}\n"]}

package/dist/accessi-module/Controllers/EmailController.d.ts

@@ -1,13 +1,11 @@
 import { Request, Response } from 'express';
-import { AccessiOptions } from '../AccessiModule';
+import type { AccessiOptions } from '../AccessiModule';
+import { SendResetPasswordEmailRequest } from '../Dtos';
 import { EmailService } from '../Services/EmailService/EmailService';
 export declare class EmailController {
     private readonly accessiOptions;
     private readonly emailService;
     constructor(accessiOptions: AccessiOptions, emailService: EmailService);
-    serveResetPasswordPage(res: Response, token: string, returnUrl?: string): Promise<void>;
-    sendPasswordResetEmail(request: Request, sendResetPasswordData: {
-        email: string;
-        htmlMail?: string;
-    }, res: Response): Promise<Response<any, Record<string, any>>>;
+    serveResetPasswordPage(res: Response, _token: string, _returnUrl?: string): Promise<void>;
+    sendPasswordResetEmail(request: Request, sendResetPasswordData: SendResetPasswordEmailRequest, res: Response): Promise<Response<any, Record<string, any>>>;
 }

package/dist/accessi-module/Controllers/EmailController.js

@@ -27,6 +27,7 @@ const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const path_1 = require("path");
 const Utilities_1 = require("../../Utilities");
+const Dtos_1 = require("../Dtos");
 const EmailService_1 = require("../Services/EmailService/EmailService");
 const publicAuthRateLimit_1 = require("../security/publicAuthRateLimit");
 let EmailController = EmailController_1 = class EmailController {
@@ -34,7 +35,7 @@ let EmailController = EmailController_1 = class EmailController {
         this.accessiOptions = accessiOptions;
         this.emailService = emailService;
     }
-    serveResetPasswordPage(res, token, returnUrl) {
+    serveResetPasswordPage(res, _token, _returnUrl) {
         return __awaiter(this, void 0, void 0, function* () {
             return res.sendFile((0, path_1.join)(__dirname, '..', 'Views', 'reset-password.html'));
         });
@@ -42,7 +43,7 @@ let EmailController = EmailController_1 = class EmailController {
     sendPasswordResetEmail(request, sendResetPasswordData, res) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const rateLimitDecision = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.accessiOptions, 'passwordResetEmail', request, [sendResetPasswordData === null || sendResetPasswordData === void 0 ? void 0 : sendResetPasswordData.email]);
+                const rateLimitDecision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.accessiOptions, 'passwordResetEmail', request, [sendResetPasswordData === null || sendResetPasswordData === void 0 ? void 0 : sendResetPasswordData.email]);
                 if (!rateLimitDecision.allowed) {
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
                 }
@@ -81,33 +82,30 @@ __decorate([
         summary: 'Invia una e-mail per il reset della password',
         operationId: 'sendPasswordResetEmail',
     }),
-    (0, swagger_1.ApiBody)({
-        schema: {
-            properties: {
-                email: {
-                    type: 'string',
-                    description: "L'email dell'utente che richiede il reset",
-                },
-            },
-            required: ['email'],
-        },
+    (0, swagger_1.ApiBody)({ type: Dtos_1.SendResetPasswordEmailRequest }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: "L'email di reset e stata gestita con successo",
+        type: Dtos_1.ActionResponse,
     }),
-    (0, swagger_1.ApiResponse)({ status: 200, description: "L'email di reset e stata gestita con successo" }),
     (0, swagger_1.ApiResponse)({
         status: 500,
         description: "Errore interno durante l'invio dell'email",
+        type: Dtos_1.ErrorResponse,
     }),
     (0, common_1.Post)('send-reset-password-email'),
     __param(0, (0, common_1.Req)()),
     __param(1, (0, common_1.Body)()),
     __param(2, (0, common_1.Res)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Object, Object]),
+    __metadata("design:paramtypes", [Object, Dtos_1.SendResetPasswordEmailRequest, Object]),
     __metadata("design:returntype", Promise)
 ], EmailController.prototype, "sendPasswordResetEmail", null);
 exports.EmailController = EmailController = EmailController_1 = __decorate([
     (0, swagger_1.ApiTags)('Email'),
-    (0, common_1.Controller)('accessi/email'),
+    (0, common_1.Controller)('accessi/email')
+    /** Endpoint pubblici del ciclo reset password; le risposte non rivelano se l'email esiste. */
+    ,
     __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
     __metadata("design:paramtypes", [Object, EmailService_1.EmailService])
 ], EmailController);

package/dist/accessi-module/Controllers/EmailController.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmailController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/EmailController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6F;AAC7F,6CAAkG;AAElG,+BAA4B;AAC5B,+CAAgD;AAEhD,wEAAqE;AACrE,yEAGyC;AAIlC,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,YAC8C,cAA8B,EACzD,YAA0B;QADC,mBAAc,GAAd,cAAc,CAAgB;QACzD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAcE,sBAAsB,CACnB,GAAa,EACJ,KAAa,EACT,SAAkB;;YAEtC,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAuBK,sBAAsB,CACnB,OAAgB,EAEvB,qBAGC,EACM,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,OAAO,EACP,CAAC,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,KAAK,CAAC,CAC/B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAC5E,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,iBAAe,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA5EY,0CAAe;AAkBpB;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,wBAAwB;KACtC,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,6BAA6B;QAC1C,QAAQ,EAAE,KAAK;KAChB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IAC1F,IAAA,YAAG,EAAC,4BAA4B,CAAC;IAE/B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;;;;6DAGpB;AAuBK;IArBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,wBAAwB;KACtC,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,MAAM,EAAE;YACN,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2CAA2C;iBACzD;aACF;YACD,QAAQ,EAAE,CAAC,OAAO,CAAC;SACpB;KACF,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IAC1F,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;KACzD,CAAC;IACD,IAAA,aAAI,EAAC,2BAA2B,CAAC;IAE/B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IAKN,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAqBP;0BA3EU,eAAe;IAF3B,IAAA,iBAAO,EAAC,OAAO,CAAC;IAChB,IAAA,mBAAU,EAAC,eAAe,CAAC;IAGvB,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,eAAe,CA4E3B","sourcesContent":["import { Body, Controller, Get, Inject, Param, Post, Query, Req, Res } from '@nestjs/common';\r\nimport { ApiBody, ApiOperation, ApiParam, ApiQuery, ApiResponse, ApiTags } from '@nestjs/swagger';\r\nimport { Request, Response } from 'express';\r\nimport { join } from 'path';\r\nimport { RestUtilities } from '../../Utilities';\r\nimport { AccessiOptions } from '../AccessiModule';\r\nimport { EmailService } from '../Services/EmailService/EmailService';\r\nimport {\r\n  checkPublicAuthRateLimit,\r\n  sendPublicAuthRateLimitExceeded,\r\n} from '../security/publicAuthRateLimit';\r\n\r\n@ApiTags('Email')\r\n@Controller('accessi/email')\r\nexport class EmailController {\r\n  constructor(\r\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\r\n    private readonly emailService: EmailService,\r\n  ) {}\r\n\r\n  @ApiOperation({\r\n    summary: 'Serve una pagina per il reset della password',\r\n    operationId: 'serveResetPasswordPage',\r\n  })\r\n  @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\r\n  @ApiQuery({\r\n    name: 'returnUrl',\r\n    description: 'Url di ritorno della pagina',\r\n    required: false,\r\n  })\r\n  @ApiResponse({ status: 200, description: 'Pagina di reset password servita con successo' })\r\n  @Get('reset-password-page/:token')\r\n  async serveResetPasswordPage(\r\n    @Res() res: Response,\r\n    @Param('token') token: string,\r\n    @Query('returnUrl') returnUrl?: string,\r\n  ) {\r\n    return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\r\n  }\r\n\r\n  @ApiOperation({\r\n    summary: 'Invia una e-mail per il reset della password',\r\n    operationId: 'sendPasswordResetEmail',\r\n  })\r\n  @ApiBody({\r\n    schema: {\r\n      properties: {\r\n        email: {\r\n          type: 'string',\r\n          description: \"L'email dell'utente che richiede il reset\",\r\n        },\r\n      },\r\n      required: ['email'],\r\n    },\r\n  })\r\n  @ApiResponse({ status: 200, description: \"L'email di reset e stata gestita con successo\" })\r\n  @ApiResponse({\r\n    status: 500,\r\n    description: \"Errore interno durante l'invio dell'email\",\r\n  })\r\n  @Post('send-reset-password-email')\r\n  async sendPasswordResetEmail(\r\n    @Req() request: Request,\r\n    @Body()\r\n    sendResetPasswordData: {\r\n      email: string;\r\n      htmlMail?: string;\r\n    },\r\n    @Res() res: Response,\r\n  ) {\r\n    try {\r\n      const rateLimitDecision = checkPublicAuthRateLimit(\r\n        this.accessiOptions,\r\n        'passwordResetEmail',\r\n        request,\r\n        [sendResetPasswordData?.email],\r\n      );\r\n      if (!rateLimitDecision.allowed) {\r\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\r\n      }\r\n\r\n      await this.emailService.sendPasswordResetEmail(sendResetPasswordData.email);\r\n      return RestUtilities.sendOKMessage(\r\n        res,\r\n        \"Se l'account esiste, l'email di reset e stata inoltrata al destinatario.\",\r\n      );\r\n    } catch (error) {\r\n      return RestUtilities.sendErrorMessage(res, error, EmailController.name);\r\n    }\r\n  }\r\n}\r\n"]}
+{"version":3,"file":"EmailController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/EmailController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6F;AAC7F,6CAAkG;AAElG,+BAA4B;AAC5B,+CAAgD;AAEhD,kCAAuF;AACvF,wEAAqE;AACrE,yEAGyC;AAKlC,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,YAC8C,cAA8B,EACzD,YAA0B;QADC,mBAAc,GAAd,cAAc,CAAgB;QACzD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAcE,sBAAsB,CACnB,GAAa,EACJ,MAAc,EACV,UAAmB;;YAEvC,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAkBK,sBAAsB,CACnB,OAAgB,EACf,qBAAoD,EACrD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,OAAO,EACP,CAAC,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,KAAK,CAAC,CAC/B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAC5E,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,iBAAe,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAnEY,0CAAe;AAkBpB;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,wBAAwB;KACtC,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,6BAA6B;QAC1C,QAAQ,EAAE,KAAK;KAChB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IAC1F,IAAA,YAAG,EAAC,4BAA4B,CAAC;IAE/B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;;;;6DAGpB;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,wBAAwB;KACtC,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,oCAA6B,EAAE,CAAC;IAChD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,qBAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,2BAA2B,CAAC;IAE/B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADyB,oCAA6B;;6DAsB7D;0BAlEU,eAAe;IAH3B,IAAA,iBAAO,EAAC,OAAO,CAAC;IAChB,IAAA,mBAAU,EAAC,eAAe,CAAC;IAC5B,8FAA8F;;IAGzF,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,eAAe,CAmE3B","sourcesContent":["import { Body, Controller, Get, Inject, Param, Post, Query, Req, Res } from '@nestjs/common';\nimport { ApiBody, ApiOperation, ApiParam, ApiQuery, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { join } from 'path';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse, SendResetPasswordEmailRequest } from '../Dtos';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n@ApiTags('Email')\n@Controller('accessi/email')\n/** Endpoint pubblici del ciclo reset password; le risposte non rivelano se l'email esiste. */\nexport class EmailController {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly emailService: EmailService,\n  ) {}\n\n  @ApiOperation({\n    summary: 'Serve una pagina per il reset della password',\n    operationId: 'serveResetPasswordPage',\n  })\n  @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\n  @ApiQuery({\n    name: 'returnUrl',\n    description: 'Url di ritorno della pagina',\n    required: false,\n  })\n  @ApiResponse({ status: 200, description: 'Pagina di reset password servita con successo' })\n  @Get('reset-password-page/:token')\n  async serveResetPasswordPage(\n    @Res() res: Response,\n    @Param('token') _token: string,\n    @Query('returnUrl') _returnUrl?: string,\n  ) {\n    return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n  }\n\n  @ApiOperation({\n    summary: 'Invia una e-mail per il reset della password',\n    operationId: 'sendPasswordResetEmail',\n  })\n  @ApiBody({ type: SendResetPasswordEmailRequest })\n  @ApiResponse({\n    status: 200,\n    description: \"L'email di reset e stata gestita con successo\",\n    type: ActionResponse,\n  })\n  @ApiResponse({\n    status: 500,\n    description: \"Errore interno durante l'invio dell'email\",\n    type: ErrorResponse,\n  })\n  @Post('send-reset-password-email')\n  async sendPasswordResetEmail(\n    @Req() request: Request,\n    @Body() sendResetPasswordData: SendResetPasswordEmailRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const rateLimitDecision = await checkPublicAuthRateLimit(\n        this.accessiOptions,\n        'passwordResetEmail',\n        request,\n        [sendResetPasswordData?.email],\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      await this.emailService.sendPasswordResetEmail(sendResetPasswordData.email);\n      return RestUtilities.sendOKMessage(\n        res,\n        \"Se l'account esiste, l'email di reset e stata inoltrata al destinatario.\",\n      );\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, EmailController.name);\n    }\n  }\n}\n"]}

package/dist/accessi-module/Controllers/FiltriController.d.ts

@@ -1,12 +1,20 @@
 import { Request, Response } from 'express';
-import { AccessiOptions } from '../AccessiModule';
-import { FiltriUtente, GetFiltriUtenteRequest } from '../Dtos';
+import { CreateFilterTypeRequest, FiltriUtente, GetFiltriUtenteRequest, UpdateFilterTypeRequest } from '../Dtos';
 import { FiltriService } from '../Services/FiltriService/FiltriService';
+import { UserService } from '../Services/UserService/UserService';
 export declare class FiltriController {
     private readonly filtriService;
-    private readonly options;
-    constructor(filtriService: FiltriService, options: AccessiOptions);
+    private readonly userService;
+    constructor(filtriService: FiltriService, userService: UserService);
+    /**
+     * Verifica che l'attore possa gestire il target (ADMIN > SUPER > utente):
+     * un superutente non puo' modificare i filtri di un admin. Self sempre consentito.
+     */
+    private ensureManageableTarget;
     getTipoFiltri(res: Response): Promise<Response<any, Record<string, any>>>;
+    createTipoFiltro(request: Request, res: Response, body: CreateFilterTypeRequest): Promise<Response<any, Record<string, any>>>;
+    updateTipoFiltro(request: Request, res: Response, tipFil: number, body: UpdateFilterTypeRequest): Promise<Response<any, Record<string, any>>>;
+    deleteTipoFiltro(request: Request, res: Response, tipFil: number): Promise<Response<any, Record<string, any>>>;
     getFiltriUtente(request: Request, res: Response, req: GetFiltriUtenteRequest): Promise<Response<any, Record<string, any>>>;
     saveFiltriUtente(request: Request, res: Response, req: FiltriUtente): Promise<Response<any, Record<string, any>>>;
 }