emilsoftware-utilities 2.0.0-dev.7 → 2.0.0-dev.71

package/dist/accessi-module/security/AccessiHttpExceptionFilter.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiHttpExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+const Utilities_1 = require("../../Utilities");
+const Logger_1 = require("../../Logger");
+/**
+ * Finalizes every exception raised before an Accessi controller can reply.
+ *
+ * This includes invalid JSON, validation-pipe errors and guard failures. The
+ * filter deliberately never return SQL, stack traces or provider diagnostics.
+ */
+let AccessiHttpExceptionFilter = class AccessiHttpExceptionFilter {
+    catch(exception, host) {
+        var _a, _b;
+        const response = host.switchToHttp().getResponse();
+        if (response.headersSent)
+            return;
+        const status = exception instanceof common_1.HttpException
+            ? exception.getStatus()
+            : Utilities_1.RestUtilities.isDatabaseSchemaError(exception)
+                ? common_1.HttpStatus.SERVICE_UNAVAILABLE
+                : common_1.HttpStatus.INTERNAL_SERVER_ERROR;
+        const payload = this.getPayload(exception);
+        const invalidJson = status === common_1.HttpStatus.BAD_REQUEST && this.isInvalidJson(exception, payload);
+        const explicitMessage = typeof payload.message === 'string' ? payload.message : undefined;
+        const code = (_a = payload.code) !== null && _a !== void 0 ? _a : (Utilities_1.RestUtilities.isDatabaseSchemaError(exception)
+            ? 'ACCESSI_DATABASE_SCHEMA_OUTDATED'
+            : invalidJson
+                ? 'ACCESSI_INVALID_JSON'
+                : status === common_1.HttpStatus.BAD_REQUEST
+                    ? 'ACCESSI_REQUEST_ERROR'
+                    : status === common_1.HttpStatus.UNAUTHORIZED
+                        ? 'ACCESSI_UNAUTHORIZED'
+                        : status === common_1.HttpStatus.FORBIDDEN
+                            ? 'ACCESSI_FORBIDDEN'
+                            : 'ACCESSI_INTERNAL_ERROR');
+        const message = code === 'ACCESSI_VALIDATION_ERROR'
+            ? 'La richiesta contiene dati non validi.'
+            : code === 'ACCESSI_DATABASE_SCHEMA_OUTDATED'
+                ? 'Lo schema del database Accessi non e aggiornato. Eseguire la migrazione database e riprovare.'
+                : invalidJson
+                    ? 'Il corpo della richiesta non contiene JSON valido.'
+                    : explicitMessage !== null && explicitMessage !== void 0 ? explicitMessage : (status === common_1.HttpStatus.UNAUTHORIZED
+                        ? 'Autenticazione non valida o scaduta.'
+                        : status === common_1.HttpStatus.FORBIDDEN
+                            ? 'Operazione non autorizzata.'
+                            : status >= common_1.HttpStatus.INTERNAL_SERVER_ERROR
+                                ? 'Errore interno del modulo Accessi.'
+                                : 'Richiesta non valida.');
+        const stack = exception instanceof Error ? exception.stack : undefined;
+        new Logger_1.Logger('[ACCESSI-EXCEPTION]').error(`HTTP ${status} ${code}: ${exception instanceof Error ? exception.message : String(exception)}`, ...(stack ? [stack] : []));
+        response.status(status).json(Object.assign({ severity: 'error', status, statusCode: Utilities_1.StatusCode.Error, code, error: code, message }, (((_b = payload.details) === null || _b === void 0 ? void 0 : _b.length) ? { details: payload.details } : {})));
+    }
+    getPayload(exception) {
+        if (!(exception instanceof common_1.HttpException))
+            return {};
+        const response = exception.getResponse();
+        return typeof response === 'string' ? { message: response } : response;
+    }
+    isInvalidJson(exception, payload) {
+        const message = exception instanceof Error ? exception.message : payload.message;
+        const text = Array.isArray(message) ? message.join(' ') : String(message !== null && message !== void 0 ? message : '');
+        return /json|unexpected token|expected property name|unterminated string/i.test(text);
+    }
+};
+exports.AccessiHttpExceptionFilter = AccessiHttpExceptionFilter;
+exports.AccessiHttpExceptionFilter = AccessiHttpExceptionFilter = __decorate([
+    (0, common_1.Catch)()
+], AccessiHttpExceptionFilter);
+//# sourceMappingURL=AccessiHttpExceptionFilter.js.map

package/dist/accessi-module/security/AccessiHttpExceptionFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessiHttpExceptionFilter.js","sourceRoot":"","sources":["../../../src/accessi-module/security/AccessiHttpExceptionFilter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAkG;AAElG,+CAA4D;AAC5D,yCAAsC;AAStC;;;;;GAKG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,KAAK,CAAC,SAAkB,EAAE,IAAmB;;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;QAC7D,IAAI,QAAQ,CAAC,WAAW;YAAE,OAAO;QAEjC,MAAM,MAAM,GAAG,SAAS,YAAY,sBAAa;YAC/C,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE;YACvB,CAAC,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;gBAC9C,CAAC,CAAC,mBAAU,CAAC,mBAAmB;gBAChC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,KAAK,mBAAU,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChG,MAAM,eAAe,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCACpB,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;YAChD,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,WAAW;oBACjC,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBAClC,CAAC,CAAC,sBAAsB;wBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,mBAAmB;4BACrB,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,KAAK,0BAA0B;YACjD,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,IAAI,KAAK,kCAAkC;gBAC3C,CAAC,CAAC,+FAA+F;gBACjG,CAAC,CAAC,WAAW;oBACX,CAAC,CAAC,oDAAoD;oBACtD,CAAC,CAAC,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBACtD,CAAC,CAAC,sCAAsC;wBACxC,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,6BAA6B;4BAC/B,CAAC,CAAC,MAAM,IAAI,mBAAU,CAAC,qBAAqB;gCAC1C,CAAC,CAAC,oCAAoC;gCACtC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAEvC,MAAM,KAAK,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,eAAM,CAAC,qBAAqB,CAAC,CAAC,KAAK,CACrC,QAAQ,MAAM,IAAI,IAAI,KAAK,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAC/F,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1B,CAAC;QAEF,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,iBAC1B,QAAQ,EAAE,OAAO,EACjB,MAAM,EACN,UAAU,EAAE,sBAAU,CAAC,KAAK,EAC5B,IAAI,EACJ,KAAK,EAAE,IAAI,EACX,OAAO,IACJ,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,MAAM,EAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAChE,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,SAAkB;QACnC,IAAI,CAAC,CAAC,SAAS,YAAY,sBAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAA4B,CAAC;IAC7F,CAAC;IAEO,aAAa,CAAC,SAAkB,EAAE,OAAyB;QACjE,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACjF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;QAChF,OAAO,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;CACF,CAAA;AApEY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,cAAK,GAAE;GACK,0BAA0B,CAoEtC","sourcesContent":["import { ArgumentsHost, Catch, ExceptionFilter, HttpException, HttpStatus } from '@nestjs/common';\nimport { Response } from 'express';\nimport { RestUtilities, StatusCode } from '../../Utilities';\nimport { Logger } from '../../Logger';\n\ntype ExceptionPayload = {\n  code?: string;\n  error?: string;\n  message?: string | string[];\n  details?: string[];\n};\n\n/**\n * Finalizes every exception raised before an Accessi controller can reply.\n *\n * This includes invalid JSON, validation-pipe errors and guard failures. The\n * filter deliberately never return SQL, stack traces or provider diagnostics.\n */\n@Catch()\nexport class AccessiHttpExceptionFilter implements ExceptionFilter {\n  catch(exception: unknown, host: ArgumentsHost): void {\n    const response = host.switchToHttp().getResponse<Response>();\n    if (response.headersSent) return;\n\n    const status = exception instanceof HttpException\n      ? exception.getStatus()\n      : RestUtilities.isDatabaseSchemaError(exception)\n        ? HttpStatus.SERVICE_UNAVAILABLE\n        : HttpStatus.INTERNAL_SERVER_ERROR;\n    const payload = this.getPayload(exception);\n    const invalidJson = status === HttpStatus.BAD_REQUEST && this.isInvalidJson(exception, payload);\n    const explicitMessage = typeof payload.message === 'string' ? payload.message : undefined;\n    const code = payload.code\n      ?? (RestUtilities.isDatabaseSchemaError(exception)\n        ? 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n        : invalidJson\n          ? 'ACCESSI_INVALID_JSON'\n          : status === HttpStatus.BAD_REQUEST\n            ? 'ACCESSI_REQUEST_ERROR'\n            : status === HttpStatus.UNAUTHORIZED\n              ? 'ACCESSI_UNAUTHORIZED'\n              : status === HttpStatus.FORBIDDEN\n                ? 'ACCESSI_FORBIDDEN'\n                : 'ACCESSI_INTERNAL_ERROR');\n\n    const message = code === 'ACCESSI_VALIDATION_ERROR'\n      ? 'La richiesta contiene dati non validi.'\n      : code === 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n        ? 'Lo schema del database Accessi non e aggiornato. Eseguire la migrazione database e riprovare.'\n        : invalidJson\n          ? 'Il corpo della richiesta non contiene JSON valido.'\n          : explicitMessage ?? (status === HttpStatus.UNAUTHORIZED\n            ? 'Autenticazione non valida o scaduta.'\n            : status === HttpStatus.FORBIDDEN\n              ? 'Operazione non autorizzata.'\n              : status >= HttpStatus.INTERNAL_SERVER_ERROR\n                ? 'Errore interno del modulo Accessi.'\n                : 'Richiesta non valida.');\n\n    const stack = exception instanceof Error ? exception.stack : undefined;\n    new Logger('[ACCESSI-EXCEPTION]').error(\n      `HTTP ${status} ${code}: ${exception instanceof Error ? exception.message : String(exception)}`,\n      ...(stack ? [stack] : [])\n    );\n\n    response.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: StatusCode.Error,\n      code,\n      error: code,\n      message,\n      ...(payload.details?.length ? { details: payload.details } : {}),\n    });\n  }\n\n  private getPayload(exception: unknown): ExceptionPayload {\n    if (!(exception instanceof HttpException)) return {};\n    const response = exception.getResponse();\n    return typeof response === 'string' ? { message: response } : response as ExceptionPayload;\n  }\n\n  private isInvalidJson(exception: unknown, payload: ExceptionPayload): boolean {\n    const message = exception instanceof Error ? exception.message : payload.message;\n    const text = Array.isArray(message) ? message.join(' ') : String(message ?? '');\n    return /json|unexpected token|expected property name|unterminated string/i.test(text);\n  }\n}\n"]}

package/dist/accessi-module/security/accessControl.d.ts

@@ -1,17 +1,63 @@
 import { Request } from 'express';
+/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */
 export interface AuthenticatedAccessiUser {
     codiceUtente: number;
     email?: string;
     flagSuper: boolean;
-    flagAdminConfigurator: boolean;
+    flagAdmin: boolean;
 }
+/**
+ * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.
+ * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.
+ */
 export declare function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser;
+/** Impone il flag superutente: gestione utenti e dei loro grant. */
 export declare function ensureSuperUser(user: AuthenticatedAccessiUser, message?: string): void;
+/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */
+export declare function ensureAdmin(user: AuthenticatedAccessiUser, message?: string): void;
+/**
+ * Gestione utenti e assegnazioni: consentita a superutenti e admin.
+ * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.
+ */
+export declare function ensureUserManagement(user: AuthenticatedAccessiUser, message?: string): void;
+/**
+ * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.
+ * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango
+ * pari o inferiore, quindi un superutente non puo' toccare un admin.
+ */
+export declare function accessiUserRank(user: {
+    flagSuper?: boolean;
+    flagAdmin?: boolean;
+}): number;
+/**
+ * Impone che l'attore possa gestire il target: rango attore >= rango target.
+ * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).
+ */
+export declare function ensureCanManageTargetUser(actor: AuthenticatedAccessiUser, target: {
+    flagSuper?: boolean;
+    flagAdmin?: boolean;
+}, message?: string): void;
+/**
+ * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:
+ * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza
+ * `flagAdmin` gestisce solo `flagSuper`.
+ */
+export declare function ensurePrivilegeFlagChanges(user: AuthenticatedAccessiUser, changes: {
+    flagSuper?: unknown;
+    flagAdmin?: unknown;
+}): void;
+/** Accesso alla console: superutenti e admin. */
+export declare function ensureConsoleAccess(user: AuthenticatedAccessiUser, message?: string): void;
+/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */
 export declare function ensureSelfOrSuperUser(user: AuthenticatedAccessiUser, targetUserCode: number, message?: string): void;
+/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */
 export declare function hasPrivilegedUserChanges(user: {
     statoRegistrazione?: unknown;
     flagSuper?: unknown;
-    flagAdminConfigurator?: unknown;
+    flagAdmin?: unknown;
+    passwordLoginEnabled?: unknown;
+    passwordlessLoginEnabled?: unknown;
+    flagDueFattori?: unknown;
     roles?: unknown;
     permissions?: unknown;
 }): boolean;

package/dist/accessi-module/security/accessControl.js

@@ -2,42 +2,118 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAuthenticatedAccessiUser = getAuthenticatedAccessiUser;
 exports.ensureSuperUser = ensureSuperUser;
+exports.ensureAdmin = ensureAdmin;
+exports.ensureUserManagement = ensureUserManagement;
+exports.accessiUserRank = accessiUserRank;
+exports.ensureCanManageTargetUser = ensureCanManageTargetUser;
+exports.ensurePrivilegeFlagChanges = ensurePrivilegeFlagChanges;
+exports.ensureConsoleAccess = ensureConsoleAccess;
 exports.ensureSelfOrSuperUser = ensureSelfOrSuperUser;
 exports.hasPrivilegedUserChanges = hasPrivilegedUserChanges;
 const common_1 = require("@nestjs/common");
 function normalizeBooleanFlag(value) {
     return value === true || value === 1 || value === '1';
 }
+/**
+ * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.
+ * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.
+ */
 function getAuthenticatedAccessiUser(req) {
-    var _a, _b, _c;
-    const payload = req === null || req === void 0 ? void 0 : req.user;
-    const utente = (_c = (_a = payload === null || payload === void 0 ? void 0 : payload.utente) !== null && _a !== void 0 ? _a : (_b = payload === null || payload === void 0 ? void 0 : payload.userData) === null || _b === void 0 ? void 0 : _b.utente) !== null && _c !== void 0 ? _c : payload;
+    var _a, _b;
+    const payload = req.user;
+    const payloadRecord = payload && typeof payload === 'object' ? payload : undefined;
+    const userData = (payloadRecord === null || payloadRecord === void 0 ? void 0 : payloadRecord.userData) && typeof payloadRecord.userData === 'object'
+        ? payloadRecord.userData
+        : undefined;
+    const rawUser = (_b = (_a = payloadRecord === null || payloadRecord === void 0 ? void 0 : payloadRecord.utente) !== null && _a !== void 0 ? _a : userData === null || userData === void 0 ? void 0 : userData.utente) !== null && _b !== void 0 ? _b : payloadRecord;
+    const utente = rawUser && typeof rawUser === 'object' ? rawUser : undefined;
     const codiceUtente = Number(utente === null || utente === void 0 ? void 0 : utente.codiceUtente);
-    if (!codiceUtente) {
+    if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {
         throw new common_1.UnauthorizedException('Utente non autenticato.');
     }
     return {
         codiceUtente,
         email: typeof (utente === null || utente === void 0 ? void 0 : utente.email) === 'string' ? utente.email : undefined,
         flagSuper: normalizeBooleanFlag(utente === null || utente === void 0 ? void 0 : utente.flagSuper),
-        flagAdminConfigurator: normalizeBooleanFlag(utente === null || utente === void 0 ? void 0 : utente.flagAdminConfigurator),
+        flagAdmin: normalizeBooleanFlag(utente === null || utente === void 0 ? void 0 : utente.flagAdmin),
     };
 }
-function ensureSuperUser(user, message = 'Operazione riservata agli amministratori.') {
+/** Impone il flag superutente: gestione utenti e dei loro grant. */
+function ensureSuperUser(user, message = 'Operazione riservata ai superutenti.') {
     if (!user.flagSuper) {
         throw new common_1.ForbiddenException(message);
     }
 }
+/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */
+function ensureAdmin(user, message = 'Operazione riservata agli amministratori.') {
+    if (!user.flagAdmin) {
+        throw new common_1.ForbiddenException(message);
+    }
+}
+/**
+ * Gestione utenti e assegnazioni: consentita a superutenti e admin.
+ * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.
+ */
+function ensureUserManagement(user, message = 'Operazione riservata agli amministratori degli utenti.') {
+    if (!user.flagSuper && !user.flagAdmin) {
+        throw new common_1.ForbiddenException(message);
+    }
+}
+/**
+ * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.
+ * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango
+ * pari o inferiore, quindi un superutente non puo' toccare un admin.
+ */
+function accessiUserRank(user) {
+    if (user.flagAdmin)
+        return 2;
+    if (user.flagSuper)
+        return 1;
+    return 0;
+}
+/**
+ * Impone che l'attore possa gestire il target: rango attore >= rango target.
+ * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).
+ */
+function ensureCanManageTargetUser(actor, target, message = 'Non puoi gestire un utente di rango superiore al tuo.') {
+    if (accessiUserRank(actor) < accessiUserRank(target)) {
+        throw new common_1.ForbiddenException(message);
+    }
+}
+/**
+ * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:
+ * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza
+ * `flagAdmin` gestisce solo `flagSuper`.
+ */
+function ensurePrivilegeFlagChanges(user, changes) {
+    if (changes.flagAdmin !== undefined && !user.flagAdmin) {
+        throw new common_1.ForbiddenException('Solo un admin puo modificare il flag admin.');
+    }
+    if (changes.flagSuper !== undefined && !user.flagSuper && !user.flagAdmin) {
+        throw new common_1.ForbiddenException('Solo un superutente o un admin puo modificare il flag superutente.');
+    }
+}
+/** Accesso alla console: superutenti e admin. */
+function ensureConsoleAccess(user, message = 'La console richiede un superutente o un admin Accessi.') {
+    if (!user.flagSuper && !user.flagAdmin) {
+        throw new common_1.ForbiddenException(message);
+    }
+}
+/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */
 function ensureSelfOrSuperUser(user, targetUserCode, message = 'Operazione non autorizzata su questo utente.') {
-    if (user.flagSuper || user.codiceUtente === targetUserCode) {
+    if (user.flagSuper || user.flagAdmin || user.codiceUtente === targetUserCode) {
         return;
     }
     throw new common_1.ForbiddenException(message);
 }
+/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */
 function hasPrivilegedUserChanges(user) {
     return (user.statoRegistrazione !== undefined ||
         user.flagSuper !== undefined ||
-        user.flagAdminConfigurator !== undefined ||
+        user.flagAdmin !== undefined ||
+        user.passwordLoginEnabled !== undefined ||
+        user.passwordlessLoginEnabled !== undefined ||
+        user.flagDueFattori !== undefined ||
         user.roles !== undefined ||
         user.permissions !== undefined);
 }

package/dist/accessi-module/security/accessControl.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAcA,kEAeC;AAED,0CAOC;AAED,sDAUC;AAED,4DAcC;AAlED,2CAA2E;AAU3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAW,aAAX,GAAG,uBAAH,GAAG,CAAU,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,MAAM,mCAAI,OAAO,CAAC;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,qBAAqB,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,qBAAqB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,wBAAwB,CAAC,IAMxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,qBAAqB,KAAK,SAAS;QACxC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\r\nimport { Request } from 'express';\r\n\r\nexport interface AuthenticatedAccessiUser {\r\n  codiceUtente: number;\r\n  email?: string;\r\n  flagSuper: boolean;\r\n  flagAdminConfigurator: boolean;\r\n}\r\n\r\nfunction normalizeBooleanFlag(value: unknown): boolean {\r\n  return value === true || value === 1 || value === '1';\r\n}\r\n\r\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\r\n  const payload = (req as any)?.user;\r\n  const utente = payload?.utente ?? payload?.userData?.utente ?? payload;\r\n  const codiceUtente = Number(utente?.codiceUtente);\r\n\r\n  if (!codiceUtente) {\r\n    throw new UnauthorizedException('Utente non autenticato.');\r\n  }\r\n\r\n  return {\r\n    codiceUtente,\r\n    email: typeof utente?.email === 'string' ? utente.email : undefined,\r\n    flagSuper: normalizeBooleanFlag(utente?.flagSuper),\r\n    flagAdminConfigurator: normalizeBooleanFlag(utente?.flagAdminConfigurator),\r\n  };\r\n}\r\n\r\nexport function ensureSuperUser(\r\n  user: AuthenticatedAccessiUser,\r\n  message = 'Operazione riservata agli amministratori.',\r\n): void {\r\n  if (!user.flagSuper) {\r\n    throw new ForbiddenException(message);\r\n  }\r\n}\r\n\r\nexport function ensureSelfOrSuperUser(\r\n  user: AuthenticatedAccessiUser,\r\n  targetUserCode: number,\r\n  message = 'Operazione non autorizzata su questo utente.',\r\n): void {\r\n  if (user.flagSuper || user.codiceUtente === targetUserCode) {\r\n    return;\r\n  }\r\n\r\n  throw new ForbiddenException(message);\r\n}\r\n\r\nexport function hasPrivilegedUserChanges(user: {\r\n  statoRegistrazione?: unknown;\r\n  flagSuper?: unknown;\r\n  flagAdminConfigurator?: unknown;\r\n  roles?: unknown;\r\n  permissions?: unknown;\r\n}): boolean {\r\n  return (\r\n    user.statoRegistrazione !== undefined ||\r\n    user.flagSuper !== undefined ||\r\n    user.flagAdminConfigurator !== undefined ||\r\n    user.roles !== undefined ||\r\n    user.permissions !== undefined\r\n  );\r\n}\r\n"]}
+{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,kCAOC;AAMD,oDAOC;AAOD,0CAIC;AAMD,8DAQC;AAOD,gEAUC;AAGD,kDAOC;AAGD,sDAUC;AAGD,4DAoBC;AAhKD,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,sCAAsC;IAEhD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,WAAW,CACzB,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAkD;IAChF,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,KAA+B,EAC/B,MAAoD,EACpD,OAAO,GAAG,uDAAuD;IAEjE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,IAA8B,EAC9B,OAAqD;IAErD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,2BAAkB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,2BAAkB,CAAC,oEAAoE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,mBAAmB,CACjC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */\nexport interface AuthenticatedAccessiUser {\n  codiceUtente: number;\n  email?: string;\n  flagSuper: boolean;\n  flagAdmin: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\n/**\n * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n */\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n  const payload = (req as Request & { user?: unknown }).user;\n  const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\n  const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\n    ? payloadRecord.userData as Record<string, unknown>\n    : undefined;\n  const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\n  const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\n  const codiceUtente = Number(utente?.codiceUtente);\n\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n    throw new UnauthorizedException('Utente non autenticato.');\n  }\n\n  return {\n    codiceUtente,\n    email: typeof utente?.email === 'string' ? utente.email : undefined,\n    flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n    flagAdmin: normalizeBooleanFlag(utente?.flagAdmin),\n  };\n}\n\n/** Impone il flag superutente: gestione utenti e dei loro grant. */\nexport function ensureSuperUser(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata ai superutenti.',\n): void {\n  if (!user.flagSuper) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */\nexport function ensureAdmin(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori.',\n): void {\n  if (!user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Gestione utenti e assegnazioni: consentita a superutenti e admin.\n * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.\n */\nexport function ensureUserManagement(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori degli utenti.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.\n * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango\n * pari o inferiore, quindi un superutente non puo' toccare un admin.\n */\nexport function accessiUserRank(user: { flagSuper?: boolean; flagAdmin?: boolean }): number {\n  if (user.flagAdmin) return 2;\n  if (user.flagSuper) return 1;\n  return 0;\n}\n\n/**\n * Impone che l'attore possa gestire il target: rango attore >= rango target.\n * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).\n */\nexport function ensureCanManageTargetUser(\n  actor: AuthenticatedAccessiUser,\n  target: { flagSuper?: boolean; flagAdmin?: boolean },\n  message = 'Non puoi gestire un utente di rango superiore al tuo.',\n): void {\n  if (accessiUserRank(actor) < accessiUserRank(target)) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:\n * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza\n * `flagAdmin` gestisce solo `flagSuper`.\n */\nexport function ensurePrivilegeFlagChanges(\n  user: AuthenticatedAccessiUser,\n  changes: { flagSuper?: unknown; flagAdmin?: unknown },\n): void {\n  if (changes.flagAdmin !== undefined && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un admin puo modificare il flag admin.');\n  }\n  if (changes.flagSuper !== undefined && !user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un superutente o un admin puo modificare il flag superutente.');\n  }\n}\n\n/** Accesso alla console: superutenti e admin. */\nexport function ensureConsoleAccess(\n  user: AuthenticatedAccessiUser,\n  message = 'La console richiede un superutente o un admin Accessi.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */\nexport function ensureSelfOrSuperUser(\n  user: AuthenticatedAccessiUser,\n  targetUserCode: number,\n  message = 'Operazione non autorizzata su questo utente.',\n): void {\n  if (user.flagSuper || user.flagAdmin || user.codiceUtente === targetUserCode) {\n    return;\n  }\n\n  throw new ForbiddenException(message);\n}\n\n/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n  statoRegistrazione?: unknown;\n  flagSuper?: unknown;\n  flagAdmin?: unknown;\n  passwordLoginEnabled?: unknown;\n  passwordlessLoginEnabled?: unknown;\n  flagDueFattori?: unknown;\n  roles?: unknown;\n  permissions?: unknown;\n}): boolean {\n  return (\n    user.statoRegistrazione !== undefined ||\n    user.flagSuper !== undefined ||\n    user.flagAdmin !== undefined ||\n    user.passwordLoginEnabled !== undefined ||\n    user.passwordlessLoginEnabled !== undefined ||\n    user.flagDueFattori !== undefined ||\n    user.roles !== undefined ||\n    user.permissions !== undefined\n  );\n}\n"]}

package/dist/accessi-module/security/accessTokenRevocation.d.ts

@@ -0,0 +1,47 @@
+import type { AccessiOptions } from '../AccessiModule';
+/**
+ * Revoca dei singoli access token tramite `jti`.
+ *
+ * A differenza della revoca per utente, questa annulla un solo token senza
+ * toccare le altre sessioni. La chiave scade al massimo a `exp` del token, cosi
+ * la memoria usata resta limitata alla durata dei token emessi.
+ */
+export interface AccessTokenRevocationStore {
+    revoke(jti: string, expiresAtMs: number): Promise<void>;
+    isRevoked(jti: string): Promise<boolean>;
+    /** Health check opzionale per readiness del servizio. */
+    healthCheck?(): Promise<boolean>;
+}
+export interface AccessTokenRevocationOptions {
+    /** Default: disabilitata se non viene fornito uno store. */
+    enabled?: boolean;
+    /** Store condiviso (es. Redis) per revocare i token tra istanze. */
+    store?: AccessTokenRevocationStore;
+    /** TTL di default quando `exp` non e noto. Default: 24 ore. */
+    ttlMs?: number;
+}
+export interface MemoryAccessTokenRevocationStore extends AccessTokenRevocationStore {
+    clear(): void;
+}
+export declare function createMemoryAccessTokenRevocationStore(): MemoryAccessTokenRevocationStore;
+export interface AccessTokenRevocationRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+export interface RedisAccessTokenRevocationStoreOptions {
+    client: AccessTokenRevocationRedisClient;
+    /** Default: `accessi:revoked-token:`. */
+    keyPrefix?: string;
+    /** Default: 24 ore. */
+    ttlMs?: number;
+}
+/** Store Redis per la revoca dei singoli access token. */
+export declare function createRedisAccessTokenRevocationStore(options: RedisAccessTokenRevocationStoreOptions): AccessTokenRevocationStore;
+export declare function getAccessTokenRevocationStore(options: AccessiOptions): AccessTokenRevocationStore | undefined;
+/** True se il `jti` del token risulta revocato. */
+export declare function isAccessiAccessTokenRevoked(options: AccessiOptions, payload: Record<string, unknown>): Promise<boolean>;
+/** Revoca un singolo access token. Richiede uno store configurato. */
+export declare function revokeAccessiAccessToken(options: AccessiOptions, jti: string, expiresAtMs?: number): Promise<void>;
+/** Variante per i flussi applicativi: no-op se la revoca non e configurata. */
+export declare function revokeAccessiAccessTokenIfConfigured(options: AccessiOptions, jti: string, expiresAtMs?: number): Promise<boolean>;
+/** Solo per test: azzera lo store in memoria di default. */
+export declare function clearDefaultAccessTokenRevocations(): void;

package/dist/accessi-module/security/accessTokenRevocation.js

@@ -0,0 +1,146 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemoryAccessTokenRevocationStore = createMemoryAccessTokenRevocationStore;
+exports.createRedisAccessTokenRevocationStore = createRedisAccessTokenRevocationStore;
+exports.getAccessTokenRevocationStore = getAccessTokenRevocationStore;
+exports.isAccessiAccessTokenRevoked = isAccessiAccessTokenRevoked;
+exports.revokeAccessiAccessToken = revokeAccessiAccessToken;
+exports.revokeAccessiAccessTokenIfConfigured = revokeAccessiAccessTokenIfConfigured;
+exports.clearDefaultAccessTokenRevocations = clearDefaultAccessTokenRevocations;
+const REVOKE_SCRIPT = "if tonumber(ARGV[1]) > 0 then return redis.call('SET', KEYS[1], '1', 'PX', ARGV[1]) else return redis.call('SET', KEYS[1], '1') end";
+const IS_REVOKED_SCRIPT = "return redis.call('EXISTS', KEYS[1])";
+function createMemoryAccessTokenRevocationStore() {
+    const revoked = new Map();
+    const prune = (now) => {
+        for (const [jti, expiresAt] of revoked) {
+            if (expiresAt <= now)
+                revoked.delete(jti);
+        }
+    };
+    return {
+        revoke(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const now = Date.now();
+                prune(now);
+                revoked.set(jti, Math.max(expiresAtMs, now + 1));
+            });
+        },
+        isRevoked(jti) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const expiresAt = revoked.get(jti);
+                if (expiresAt === undefined)
+                    return false;
+                if (expiresAt <= Date.now()) {
+                    revoked.delete(jti);
+                    return false;
+                }
+                return true;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                return true;
+            });
+        },
+        clear() {
+            revoked.clear();
+        },
+    };
+}
+/** Store Redis per la revoca dei singoli access token. */
+function createRedisAccessTokenRevocationStore(options) {
+    var _a, _b;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis access token revocation store: client.eval non configurato.');
+    }
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:revoked-token:').replace(/:+$/, ':');
+    const ttlMs = Math.max(0, Math.trunc((_b = options.ttlMs) !== null && _b !== void 0 ? _b : 24 * 60 * 60 * 1000));
+    return {
+        revoke(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                // Se il token e gia scaduto non serve conservare la revoca a lungo: una
+                // chiave senza TTL resterebbe per sempre. Il minimo di 1 ms la fa sparire
+                // subito, come nello store in memoria.
+                const ttl = Number.isFinite(expiresAtMs)
+                    ? Math.max(1, Math.trunc(expiresAtMs - Date.now()))
+                    : ttlMs;
+                yield options.client.eval(REVOKE_SCRIPT, 1, `${keyPrefix}${jti}`, ttl);
+            });
+        },
+        isRevoked(jti) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const result = yield options.client.eval(IS_REVOKED_SCRIPT, 1, `${keyPrefix}${jti}`);
+                return Number(result) > 0;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const result = yield options.client.eval("return redis.call('PING')", 0);
+                    return String(result).toUpperCase() === 'PONG';
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+    };
+}
+const defaultMemoryStore = createMemoryAccessTokenRevocationStore();
+function getAccessTokenRevocationStore(options) {
+    var _a, _b, _c;
+    if (((_a = options.accessTokenRevocation) === null || _a === void 0 ? void 0 : _a.enabled) === false)
+        return undefined;
+    if ((_b = options.accessTokenRevocation) === null || _b === void 0 ? void 0 : _b.store)
+        return options.accessTokenRevocation.store;
+    return ((_c = options.accessTokenRevocation) === null || _c === void 0 ? void 0 : _c.enabled) === true ? defaultMemoryStore : undefined;
+}
+/** True se il `jti` del token risulta revocato. */
+function isAccessiAccessTokenRevoked(options, payload) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const store = getAccessTokenRevocationStore(options);
+        if (!store)
+            return false;
+        const jti = typeof payload.jti === 'string' ? payload.jti : undefined;
+        if (!jti)
+            return false;
+        return store.isRevoked(jti);
+    });
+}
+/** Revoca un singolo access token. Richiede uno store configurato. */
+function revokeAccessiAccessToken(options, jti, expiresAtMs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const store = getAccessTokenRevocationStore(options);
+        if (!store)
+            throw new Error('Access token revocation store non configurato.');
+        if (typeof jti !== 'string' || jti.trim() === '') {
+            throw new Error('jti non valido.');
+        }
+        const ttlMs = Math.max(0, Math.trunc((_b = (_a = options.accessTokenRevocation) === null || _a === void 0 ? void 0 : _a.ttlMs) !== null && _b !== void 0 ? _b : 24 * 60 * 60 * 1000));
+        yield store.revoke(jti, expiresAtMs !== null && expiresAtMs !== void 0 ? expiresAtMs : Date.now() + ttlMs);
+    });
+}
+/** Variante per i flussi applicativi: no-op se la revoca non e configurata. */
+function revokeAccessiAccessTokenIfConfigured(options, jti, expiresAtMs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!getAccessTokenRevocationStore(options))
+            return false;
+        yield revokeAccessiAccessToken(options, jti, expiresAtMs);
+        return true;
+    });
+}
+/** Solo per test: azzera lo store in memoria di default. */
+function clearDefaultAccessTokenRevocations() {
+    defaultMemoryStore.clear();
+}
+//# sourceMappingURL=accessTokenRevocation.js.map

package/dist/accessi-module/security/accessTokenRevocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessTokenRevocation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessTokenRevocation.ts"],"names":[],"mappings":";;;;;;;;;;;AAiCA,wFA6BC;AAeD,sFAmCC;AAID,sEAMC;AAGD,kEASC;AAGD,4DAYC;AAGD,oFAQC;AAGD,gFAEC;AAxID,MAAM,aAAa,GACjB,qIAAqI,CAAC;AACxI,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE,SAAgB,sCAAsC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,SAAS,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACC,MAAM,CAAC,GAAG,EAAE,WAAW;;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;SAAA;QACK,SAAS,CAAC,GAAG;;gBACjB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC1C,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACpB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAcD,0DAA0D;AAC1D,SAAgB,qCAAqC,CACnD,OAA+C;;IAE/C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAE5E,OAAO;QACC,MAAM,CAAC,GAAG,EAAE,WAAW;;gBAC3B,wEAAwE;gBACxE,0EAA0E;gBAC1E,uCAAuC;gBACvC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBACnD,CAAC,CAAC,KAAK,CAAC;gBACV,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,SAAS,GAAG,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YACzE,CAAC;SAAA;QAEK,SAAS,CAAC,GAAG;;gBACjB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,GAAG,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC;gBACrF,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;SAAA;QAEK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,sCAAsC,EAAE,CAAC;AAEpE,SAAgB,6BAA6B,CAC3C,OAAuB;;IAEvB,IAAI,CAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,MAAA,OAAO,CAAC,qBAAqB,0CAAE,KAAK;QAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;IACrF,OAAO,CAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,OAAO,MAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED,mDAAmD;AACnD,SAAsB,2BAA2B,CAC/C,OAAuB,EACvB,OAAgC;;QAEhC,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CAAA;AAED,sEAAsE;AACtE,SAAsB,wBAAwB,CAC5C,OAAuB,EACvB,GAAW,EACX,WAAoB;;;QAEpB,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,KAAK,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACnG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IAC7D,CAAC;CAAA;AAED,+EAA+E;AAC/E,SAAsB,oCAAoC,CACxD,OAAuB,EACvB,GAAW,EACX,WAAoB;;QAEpB,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,4DAA4D;AAC5D,SAAgB,kCAAkC;IAChD,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\n\n/**\n * Revoca dei singoli access token tramite `jti`.\n *\n * A differenza della revoca per utente, questa annulla un solo token senza\n * toccare le altre sessioni. La chiave scade al massimo a `exp` del token, cosi\n * la memoria usata resta limitata alla durata dei token emessi.\n */\nexport interface AccessTokenRevocationStore {\n  revoke(jti: string, expiresAtMs: number): Promise<void>;\n  isRevoked(jti: string): Promise<boolean>;\n  /** Health check opzionale per readiness del servizio. */\n  healthCheck?(): Promise<boolean>;\n}\n\nexport interface AccessTokenRevocationOptions {\n  /** Default: disabilitata se non viene fornito uno store. */\n  enabled?: boolean;\n  /** Store condiviso (es. Redis) per revocare i token tra istanze. */\n  store?: AccessTokenRevocationStore;\n  /** TTL di default quando `exp` non e noto. Default: 24 ore. */\n  ttlMs?: number;\n}\n\nexport interface MemoryAccessTokenRevocationStore extends AccessTokenRevocationStore {\n  clear(): void;\n}\n\nconst REVOKE_SCRIPT =\n  \"if tonumber(ARGV[1]) > 0 then return redis.call('SET', KEYS[1], '1', 'PX', ARGV[1]) else return redis.call('SET', KEYS[1], '1') end\";\nconst IS_REVOKED_SCRIPT = \"return redis.call('EXISTS', KEYS[1])\";\n\nexport function createMemoryAccessTokenRevocationStore(): MemoryAccessTokenRevocationStore {\n  const revoked = new Map<string, number>();\n  const prune = (now: number) => {\n    for (const [jti, expiresAt] of revoked) {\n      if (expiresAt <= now) revoked.delete(jti);\n    }\n  };\n  return {\n    async revoke(jti, expiresAtMs) {\n      const now = Date.now();\n      prune(now);\n      revoked.set(jti, Math.max(expiresAtMs, now + 1));\n    },\n    async isRevoked(jti) {\n      const expiresAt = revoked.get(jti);\n      if (expiresAt === undefined) return false;\n      if (expiresAt <= Date.now()) {\n        revoked.delete(jti);\n        return false;\n      }\n      return true;\n    },\n    async healthCheck() {\n      return true;\n    },\n    clear() {\n      revoked.clear();\n    },\n  };\n}\n\nexport interface AccessTokenRevocationRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisAccessTokenRevocationStoreOptions {\n  client: AccessTokenRevocationRedisClient;\n  /** Default: `accessi:revoked-token:`. */\n  keyPrefix?: string;\n  /** Default: 24 ore. */\n  ttlMs?: number;\n}\n\n/** Store Redis per la revoca dei singoli access token. */\nexport function createRedisAccessTokenRevocationStore(\n  options: RedisAccessTokenRevocationStoreOptions,\n): AccessTokenRevocationStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis access token revocation store: client.eval non configurato.');\n  }\n\n  const keyPrefix = (options.keyPrefix ?? 'accessi:revoked-token:').replace(/:+$/, ':');\n  const ttlMs = Math.max(0, Math.trunc(options.ttlMs ?? 24 * 60 * 60 * 1000));\n\n  return {\n    async revoke(jti, expiresAtMs) {\n      // Se il token e gia scaduto non serve conservare la revoca a lungo: una\n      // chiave senza TTL resterebbe per sempre. Il minimo di 1 ms la fa sparire\n      // subito, come nello store in memoria.\n      const ttl = Number.isFinite(expiresAtMs)\n        ? Math.max(1, Math.trunc(expiresAtMs - Date.now()))\n        : ttlMs;\n      await options.client.eval(REVOKE_SCRIPT, 1, `${keyPrefix}${jti}`, ttl);\n    },\n\n    async isRevoked(jti) {\n      const result = await options.client.eval(IS_REVOKED_SCRIPT, 1, `${keyPrefix}${jti}`);\n      return Number(result) > 0;\n    },\n\n    async healthCheck() {\n      try {\n        const result = await options.client.eval(\"return redis.call('PING')\", 0);\n        return String(result).toUpperCase() === 'PONG';\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n\nconst defaultMemoryStore = createMemoryAccessTokenRevocationStore();\n\nexport function getAccessTokenRevocationStore(\n  options: AccessiOptions,\n): AccessTokenRevocationStore | undefined {\n  if (options.accessTokenRevocation?.enabled === false) return undefined;\n  if (options.accessTokenRevocation?.store) return options.accessTokenRevocation.store;\n  return options.accessTokenRevocation?.enabled === true ? defaultMemoryStore : undefined;\n}\n\n/** True se il `jti` del token risulta revocato. */\nexport async function isAccessiAccessTokenRevoked(\n  options: AccessiOptions,\n  payload: Record<string, unknown>,\n): Promise<boolean> {\n  const store = getAccessTokenRevocationStore(options);\n  if (!store) return false;\n  const jti = typeof payload.jti === 'string' ? payload.jti : undefined;\n  if (!jti) return false;\n  return store.isRevoked(jti);\n}\n\n/** Revoca un singolo access token. Richiede uno store configurato. */\nexport async function revokeAccessiAccessToken(\n  options: AccessiOptions,\n  jti: string,\n  expiresAtMs?: number,\n): Promise<void> {\n  const store = getAccessTokenRevocationStore(options);\n  if (!store) throw new Error('Access token revocation store non configurato.');\n  if (typeof jti !== 'string' || jti.trim() === '') {\n    throw new Error('jti non valido.');\n  }\n  const ttlMs = Math.max(0, Math.trunc(options.accessTokenRevocation?.ttlMs ?? 24 * 60 * 60 * 1000));\n  await store.revoke(jti, expiresAtMs ?? Date.now() + ttlMs);\n}\n\n/** Variante per i flussi applicativi: no-op se la revoca non e configurata. */\nexport async function revokeAccessiAccessTokenIfConfigured(\n  options: AccessiOptions,\n  jti: string,\n  expiresAtMs?: number,\n): Promise<boolean> {\n  if (!getAccessTokenRevocationStore(options)) return false;\n  await revokeAccessiAccessToken(options, jti, expiresAtMs);\n  return true;\n}\n\n/** Solo per test: azzera lo store in memoria di default. */\nexport function clearDefaultAccessTokenRevocations(): void {\n  defaultMemoryStore.clear();\n}\n"]}

package/dist/accessi-module/security/accessiValidation.d.ts

@@ -0,0 +1,9 @@
+import { ValidationPipe } from '@nestjs/common';
+/**
+ * Creates the validation pipe used by every Accessi bootstrap path.
+ *
+ * It deliberately returns one stable, documented error contract instead of
+ * Nest's default array. Consumers can branch on `code`; `details` is safe to
+ * display or log because it contains only DTO field names and validation text.
+ */
+export declare function createAccessiValidationPipe(): ValidationPipe;

package/dist/accessi-module/security/accessiValidation.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiValidationPipe = createAccessiValidationPipe;
+const common_1 = require("@nestjs/common");
+const Utilities_1 = require("../../Utilities");
+/**
+ * Creates the validation pipe used by every Accessi bootstrap path.
+ *
+ * It deliberately returns one stable, documented error contract instead of
+ * Nest's default array. Consumers can branch on `code`; `details` is safe to
+ * display or log because it contains only DTO field names and validation text.
+ */
+function createAccessiValidationPipe() {
+    return new common_1.ValidationPipe({
+        whitelist: true,
+        forbidNonWhitelisted: true,
+        transform: true,
+        transformOptions: {
+            enableImplicitConversion: true,
+        },
+        exceptionFactory: (errors) => new common_1.BadRequestException({
+            severity: 'error',
+            status: 400,
+            statusCode: Utilities_1.StatusCode.Error,
+            code: 'ACCESSI_VALIDATION_ERROR',
+            error: 'ACCESSI_VALIDATION_ERROR',
+            message: 'La richiesta contiene dati non validi.',
+            details: flattenValidationErrors(errors),
+        }),
+    });
+}
+/** Converts nested class-validator failures into deterministic client details. */
+function flattenValidationErrors(errors, parentPath = '') {
+    return errors.flatMap((error) => {
+        var _a, _b;
+        const path = parentPath ? `${parentPath}.${error.property}` : error.property;
+        const ownMessages = Object.values((_a = error.constraints) !== null && _a !== void 0 ? _a : {}).map((message) => `${path}: ${message}`);
+        return [...ownMessages, ...flattenValidationErrors((_b = error.children) !== null && _b !== void 0 ? _b : [], path)];
+    });
+}
+//# sourceMappingURL=accessiValidation.js.map

package/dist/accessi-module/security/accessiValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessiValidation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessiValidation.ts"],"names":[],"mappings":";;AAUA,kEAmBC;AA7BD,2CAAsF;AACtF,+CAA6C;AAE7C;;;;;;GAMG;AACH,SAAgB,2BAA2B;IACzC,OAAO,IAAI,uBAAc,CAAC;QACxB,SAAS,EAAE,IAAI;QACf,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE;YAChB,wBAAwB,EAAE,IAAI;SAC/B;QACD,gBAAgB,EAAE,CAAC,MAAyB,EAAE,EAAE,CAC9C,IAAI,4BAAmB,CAAC;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,sBAAU,CAAC,KAAK;YAC5B,IAAI,EAAE,0BAA0B;YAChC,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,wCAAwC;YACjD,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC;SACzC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,uBAAuB,CAAC,MAAyB,EAAE,UAAU,GAAG,EAAE;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,uBAAuB,CAAC,MAAA,KAAK,CAAC,QAAQ,mCAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { BadRequestException, ValidationError, ValidationPipe } from '@nestjs/common';\nimport { StatusCode } from '../../Utilities';\n\n/**\n * Creates the validation pipe used by every Accessi bootstrap path.\n *\n * It deliberately returns one stable, documented error contract instead of\n * Nest's default array. Consumers can branch on `code`; `details` is safe to\n * display or log because it contains only DTO field names and validation text.\n */\nexport function createAccessiValidationPipe(): ValidationPipe {\n  return new ValidationPipe({\n    whitelist: true,\n    forbidNonWhitelisted: true,\n    transform: true,\n    transformOptions: {\n      enableImplicitConversion: true,\n    },\n    exceptionFactory: (errors: ValidationError[]) =>\n      new BadRequestException({\n        severity: 'error',\n        status: 400,\n        statusCode: StatusCode.Error,\n        code: 'ACCESSI_VALIDATION_ERROR',\n        error: 'ACCESSI_VALIDATION_ERROR',\n        message: 'La richiesta contiene dati non validi.',\n        details: flattenValidationErrors(errors),\n      }),\n  });\n}\n\n/** Converts nested class-validator failures into deterministic client details. */\nfunction flattenValidationErrors(errors: ValidationError[], parentPath = ''): string[] {\n  return errors.flatMap((error) => {\n    const path = parentPath ? `${parentPath}.${error.property}` : error.property;\n    const ownMessages = Object.values(error.constraints ?? {}).map((message) => `${path}: ${message}`);\n    return [...ownMessages, ...flattenValidationErrors(error.children ?? [], path)];\n  });\n}\n"]}

package/dist/accessi-module/security/adminBootstrap.d.ts

@@ -0,0 +1,8 @@
+/** Genera (una sola volta per processo) il token di bootstrap admin. */
+export declare function getOrCreateAdminBootstrapToken(): string;
+/** Token corrente, oppure null se non ancora generato. */
+export declare function getAdminBootstrapToken(): string | null;
+/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */
+export declare function clearAdminBootstrapToken(): void;
+/** Confronto a tempo costante del token candidato con quello generato. */
+export declare function isValidAdminBootstrapToken(candidate: unknown): boolean;