emilsoftware-utilities 2.0.0-dev.7 → 2.0.0-dev.71

package/dist/accessi-module/security/passwordResetToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"passwordResetToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,kDAOC;AAED,4DAqBC;AAED,4DAeC;AAzDD,kDAAoC;AAGvB,QAAA,iCAAiC,GAAG,IAAI,CAAC;AAOtD,SAAgB,mBAAmB,CAAC,OAAuB;;IACzD,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,KAAa,EACb,MAAc,EACd,YAAoB,yCAAiC;IAErD,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CACb;QACE,KAAK;QACL,GAAG,EAAE,gBAAgB;KACtB,EACD,MAAM,EACN;QACE,OAAO,EAAE,GAAG,YAAY,EAAE;QAC1B,SAAS,EAAE,SAAgB;KAC5B,CACF,CAAC;AACJ,CAAC;AAED,SAAgB,wBAAwB,CACtC,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAA8B,CAAC;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,MAAK,gBAAgB,IAAI,CAAC,YAAY,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import * as jwt from 'jsonwebtoken';\r\nimport { AccessiOptions } from '../AccessiModule';\r\n\r\nexport const DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';\r\n\r\ninterface PasswordResetTokenPayload extends jwt.JwtPayload {\r\n  nonce: string;\r\n  typ: 'password-reset';\r\n}\r\n\r\nexport function getAccessiJwtSecret(options: AccessiOptions): string {\r\n  const secret = options?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\r\n  if (!secret) {\r\n    throw new Error('JWT secret non configurato.');\r\n  }\r\n\r\n  return secret;\r\n}\r\n\r\nexport function createPasswordResetToken(\r\n  codiceUtente: number,\r\n  nonce: string,\r\n  secret: string,\r\n  expiresIn: string = DEFAULT_PASSWORD_RESET_EXPIRES_IN,\r\n): string {\r\n  if (!codiceUtente || !nonce) {\r\n    throw new Error('Dati insufficienti per generare il reset token.');\r\n  }\r\n\r\n  return jwt.sign(\r\n    {\r\n      nonce,\r\n      typ: 'password-reset',\r\n    },\r\n    secret,\r\n    {\r\n      subject: `${codiceUtente}`,\r\n      expiresIn: expiresIn as any,\r\n    },\r\n  );\r\n}\r\n\r\nexport function verifyPasswordResetToken(\r\n  token: string,\r\n  secret: string,\r\n): { codiceUtente: number; nonce: string } {\r\n  const decoded = jwt.verify(token, secret) as PasswordResetTokenPayload;\r\n  const codiceUtente = Number(decoded?.sub);\r\n\r\n  if (decoded?.typ !== 'password-reset' || !codiceUtente || typeof decoded?.nonce !== 'string') {\r\n    throw new Error('Token di reset non valido.');\r\n  }\r\n\r\n  return {\r\n    codiceUtente,\r\n    nonce: decoded.nonce,\r\n  };\r\n}\r\n"]}
+{"version":3,"file":"passwordResetToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,kDAOC;AAGD,4DAqBC;AAGD,4DAeC;AApED,kDAAoC;AACpC,mCAAoC;AAGpC,mHAAmH;AACtG,QAAA,iCAAiC,GAAG,IAAI,CAAC;AAUtD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAuB,EAAE,UAA6B,QAAQ;;IAChG,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,oHAAoH;AACpH,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,KAAa,EACb,MAAc,EACd,YAA0C,yCAAiC;IAE3E,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CACb;QACE,KAAK;QACL,GAAG,EAAE,gBAAgB;KACtB,EACD,MAAM,EACN;QACE,OAAO,EAAE,GAAG,YAAY,EAAE;QAC1B,SAAS;KACV,CACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,wBAAwB,CACtC,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAA8B,CAAC;IAClG,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,MAAK,gBAAgB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1J,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import * as jwt from 'jsonwebtoken';\nimport { createHmac } from 'crypto';\nimport type { AccessiOptions } from '../AccessiModule';\n\n/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */\nexport const DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';\n\ninterface PasswordResetTokenPayload extends jwt.JwtPayload {\n  nonce: string;\n  typ: 'password-reset';\n}\n\n/** Scopo della chiave derivata: separa le chiavi di access token, reset password e 2FA. */\nexport type AccessiJwtPurpose = 'access' | 'refresh' | 'reset' | '2fa';\n\n/**\n * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).\n * Un leak della chiave di reset non compromette gli access token e viceversa.\n */\nexport function getAccessiJwtSecret(options: AccessiOptions, purpose: AccessiJwtPurpose = 'access'): string {\n  const secret = options?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\n  if (!secret) {\n    throw new Error('JWT secret non configurato.');\n  }\n\n  return createHmac('sha256', secret).update(`accessi:jwt:${purpose}:v1`).digest('hex');\n}\n\n/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */\nexport function createPasswordResetToken(\n  codiceUtente: number,\n  nonce: string,\n  secret: string,\n  expiresIn: jwt.SignOptions['expiresIn'] = DEFAULT_PASSWORD_RESET_EXPIRES_IN,\n): string {\n  if (!codiceUtente || !nonce) {\n    throw new Error('Dati insufficienti per generare il reset token.');\n  }\n\n  return jwt.sign(\n    {\n      nonce,\n      typ: 'password-reset',\n    },\n    secret,\n    {\n      subject: `${codiceUtente}`,\n      expiresIn,\n    },\n  );\n}\n\n/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */\nexport function verifyPasswordResetToken(\n  token: string,\n  secret: string,\n): { codiceUtente: number; nonce: string } {\n  const decoded = jwt.verify(token, secret, { algorithms: ['HS256'] }) as PasswordResetTokenPayload;\n  const codiceUtente = Number(decoded?.sub);\n\n  if (decoded?.typ !== 'password-reset' || !Number.isSafeInteger(codiceUtente) || codiceUtente <= 0 || typeof decoded?.nonce !== 'string' || !decoded.nonce) {\n    throw new Error('Token di reset non valido.');\n  }\n\n  return {\n    codiceUtente,\n    nonce: decoded.nonce,\n  };\n}\n"]}

package/dist/accessi-module/security/publicAuthRateLimit.d.ts

@@ -1,10 +1,12 @@
 import { Request, Response } from 'express';
-import { AccessiOptions } from '../AccessiModule';
-export type PublicAuthRateLimitScope = 'login' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken';
-type RateLimitDecision = {
-    allowed: boolean;
-    retryAfterSeconds?: number;
-};
-export declare function checkPublicAuthRateLimit(options: AccessiOptions, scope: PublicAuthRateLimitScope, req: Request, identifiers?: string[]): RateLimitDecision;
+import type { AccessiOptions } from '../AccessiModule';
+import type { RateLimitDecision } from './rateLimitStore';
+export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'refresh' | 'getUserByToken' | 'adminBootstrap' | 'consoleEntry';
+/**
+ * Applica il rate limit per IP e, opzionalmente, per soggetto.
+ *
+ * Con `publicAuthRateLimit.store` e possibile usare uno store Redis condiviso;
+ * senza store usa la memoria del processo.
+ */
+export declare function checkPublicAuthRateLimit(options: AccessiOptions, scope: PublicAuthRateLimitScope, req: Request, identifiers?: string[]): Promise<RateLimitDecision>;
 export declare function sendPublicAuthRateLimitExceeded(res: Response, retryAfterSeconds: number): Response;
-export {};

package/dist/accessi-module/security/publicAuthRateLimit.js

@@ -1,19 +1,31 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkPublicAuthRateLimit = checkPublicAuthRateLimit;
 exports.sendPublicAuthRateLimitExceeded = sendPublicAuthRateLimitExceeded;
 const common_1 = require("@nestjs/common");
 const Utilities_1 = require("../../Utilities");
+const rateLimitStore_1 = require("./rateLimitStore");
 const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
+    twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },
+    twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },
     register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
+    refresh: { windowMs: 5 * 60 * 1000, maxAttempts: 60 },
     getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
+    adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
+    consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
 };
-const RATE_LIMIT_BUCKETS = new Map();
-const MAX_TRACKED_BUCKETS = 20000;
-const MAX_WINDOW_MS = Math.max(...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs));
 function getRule(options, scope) {
     var _a;
     const configuredRule = (_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a[scope];
@@ -29,6 +41,19 @@ function getRule(options, scope) {
     }
     return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];
 }
+function consumeRateLimit(store, key, rule) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            return yield store.consume(key, rule.windowMs, rule.maxAttempts);
+        }
+        catch (_a) {
+            throw new common_1.HttpException({
+                code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',
+                message: 'Rate limit non disponibile. Riprova piu tardi.',
+            }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+        }
+    });
+}
 function normalizeIdentifier(identifier) {
     if (typeof identifier !== 'string') {
         return null;
@@ -36,67 +61,43 @@ function normalizeIdentifier(identifier) {
     const normalized = identifier.trim().toLowerCase();
     return normalized === '' ? null : normalized;
 }
-function pruneRateLimitBuckets(now) {
-    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {
-        return;
-    }
-    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {
-        if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {
-            RATE_LIMIT_BUCKETS.delete(key);
+/**
+ * Applica il rate limit per IP e, opzionalmente, per soggetto.
+ *
+ * Con `publicAuthRateLimit.store` e possibile usare uno store Redis condiviso;
+ * senza store usa la memoria del processo.
+ */
+function checkPublicAuthRateLimit(options_1, scope_1, req_1) {
+    return __awaiter(this, arguments, void 0, function* (options, scope, req, identifiers = []) {
+        var _a, _b, _c, _d, _e, _f, _g;
+        if (((_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.enabled) === false) {
+            return { allowed: true, retryAfterSeconds: 0 };
         }
-        if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {
-            return;
+        const rule = getRule(options, scope);
+        const store = (_c = (_b = options.publicAuthRateLimit) === null || _b === void 0 ? void 0 : _b.store) !== null && _c !== void 0 ? _c : (0, rateLimitStore_1.getDefaultRateLimitStore)();
+        const ipAddress = (_g = normalizeIdentifier((_f = (_d = req.ip) !== null && _d !== void 0 ? _d : (_e = req.socket) === null || _e === void 0 ? void 0 : _e.remoteAddress) !== null && _f !== void 0 ? _f : 'unknown')) !== null && _g !== void 0 ? _g : 'unknown';
+        // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,
+        // evitando crescita di memoria con identificatori sempre diversi.
+        const ipDecision = yield consumeRateLimit(store, `${scope}|ip|${ipAddress}`, rule);
+        if (!ipDecision.allowed) {
+            return ipDecision;
         }
-    }
-}
-function consumeBucket(bucketKey, rule, now) {
-    const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);
-    if (!existingBucket || existingBucket.resetAt <= now) {
-        RATE_LIMIT_BUCKETS.set(bucketKey, {
-            count: 1,
-            resetAt: now + rule.windowMs,
-            lastSeenAt: now,
-        });
-        return null;
-    }
-    existingBucket.lastSeenAt = now;
-    if (existingBucket.count >= rule.maxAttempts) {
-        return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));
-    }
-    existingBucket.count += 1;
-    return null;
-}
-function checkPublicAuthRateLimit(options, scope, req, identifiers = []) {
-    var _a, _b, _c, _d, _e;
-    if (((_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.enabled) === false) {
-        return { allowed: true };
-    }
-    const rule = getRule(options, scope);
-    const now = Date.now();
-    pruneRateLimitBuckets(now);
-    const ipAddress = (_e = normalizeIdentifier((_d = (_b = req.ip) !== null && _b !== void 0 ? _b : (_c = req.socket) === null || _c === void 0 ? void 0 : _c.remoteAddress) !== null && _d !== void 0 ? _d : 'unknown')) !== null && _e !== void 0 ? _e : 'unknown';
-    const bucketKeys = new Set([`${scope}|ip|${ipAddress}`]);
-    for (const identifier of identifiers) {
-        const normalizedIdentifier = normalizeIdentifier(identifier);
-        if (!normalizedIdentifier) {
-            continue;
+        let retryAfterSeconds = 0;
+        for (const identifier of identifiers) {
+            const normalizedIdentifier = normalizeIdentifier(identifier);
+            if (!normalizedIdentifier) {
+                continue;
+            }
+            const subjectDecision = yield consumeRateLimit(store, `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`, rule);
+            if (!subjectDecision.allowed) {
+                retryAfterSeconds = Math.max(retryAfterSeconds, subjectDecision.retryAfterSeconds);
+            }
         }
-        bucketKeys.add(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`);
-    }
-    let retryAfterSeconds = 0;
-    for (const bucketKey of bucketKeys) {
-        const bucketRetryAfterSeconds = consumeBucket(bucketKey, rule, now);
-        if (bucketRetryAfterSeconds) {
-            retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);
+        if (retryAfterSeconds > 0) {
+            return { allowed: false, retryAfterSeconds };
         }
-    }
-    if (retryAfterSeconds > 0) {
-        return {
-            allowed: false,
-            retryAfterSeconds,
-        };
-    }
-    return { allowed: true };
+        return { allowed: true, retryAfterSeconds: 0 };
+    });
 }
 function sendPublicAuthRateLimitExceeded(res, retryAfterSeconds) {
     res.setHeader('Retry-After', String(retryAfterSeconds));

package/dist/accessi-module/security/publicAuthRateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA+GA,4DA2CC;AAED,0EAWC;AAvKD,2CAA4C;AAE5C,+CAAgD;AAqBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC7D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IACrF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC;IAEjE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,uBAAuB,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\r\nimport { Request, Response } from 'express';\r\nimport { RestUtilities } from '../../Utilities';\r\nimport { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\r\n\r\nexport type PublicAuthRateLimitScope =\r\n  | 'login'\r\n  | 'register'\r\n  | 'passwordResetEmail'\r\n  | 'passwordResetConfirm'\r\n  | 'getUserByToken';\r\n\r\ntype RateLimitBucket = {\r\n  count: number;\r\n  resetAt: number;\r\n  lastSeenAt: number;\r\n};\r\n\r\ntype RateLimitDecision = {\r\n  allowed: boolean;\r\n  retryAfterSeconds?: number;\r\n};\r\n\r\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\r\n  PublicAuthRateLimitScope,\r\n  PublicAuthRateLimitRuleOptions\r\n> = {\r\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\r\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\r\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\r\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\r\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\r\n};\r\n\r\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\r\nconst MAX_TRACKED_BUCKETS = 20000;\r\nconst MAX_WINDOW_MS = Math.max(\r\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\r\n);\r\n\r\nfunction getRule(\r\n  options: AccessiOptions,\r\n  scope: PublicAuthRateLimitScope,\r\n): PublicAuthRateLimitRuleOptions {\r\n  const configuredRule = options.publicAuthRateLimit?.[scope];\r\n\r\n  if (\r\n    configuredRule &&\r\n    Number.isFinite(configuredRule.windowMs) &&\r\n    configuredRule.windowMs > 0 &&\r\n    Number.isFinite(configuredRule.maxAttempts) &&\r\n    configuredRule.maxAttempts > 0\r\n  ) {\r\n    return {\r\n      windowMs: Math.trunc(configuredRule.windowMs),\r\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\r\n    };\r\n  }\r\n\r\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\r\n}\r\n\r\nfunction normalizeIdentifier(identifier: string): string | null {\r\n  if (typeof identifier !== 'string') {\r\n    return null;\r\n  }\r\n\r\n  const normalized = identifier.trim().toLowerCase();\r\n  return normalized === '' ? null : normalized;\r\n}\r\n\r\nfunction pruneRateLimitBuckets(now: number): void {\r\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\r\n    return;\r\n  }\r\n\r\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\r\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\r\n      RATE_LIMIT_BUCKETS.delete(key);\r\n    }\r\n\r\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\r\n      return;\r\n    }\r\n  }\r\n}\r\n\r\nfunction consumeBucket(\r\n  bucketKey: string,\r\n  rule: PublicAuthRateLimitRuleOptions,\r\n  now: number,\r\n): number | null {\r\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\r\n  if (!existingBucket || existingBucket.resetAt <= now) {\r\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\r\n      count: 1,\r\n      resetAt: now + rule.windowMs,\r\n      lastSeenAt: now,\r\n    });\r\n    return null;\r\n  }\r\n\r\n  existingBucket.lastSeenAt = now;\r\n  if (existingBucket.count >= rule.maxAttempts) {\r\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\r\n  }\r\n\r\n  existingBucket.count += 1;\r\n  return null;\r\n}\r\n\r\nexport function checkPublicAuthRateLimit(\r\n  options: AccessiOptions,\r\n  scope: PublicAuthRateLimitScope,\r\n  req: Request,\r\n  identifiers: string[] = [],\r\n): RateLimitDecision {\r\n  if (options.publicAuthRateLimit?.enabled === false) {\r\n    return { allowed: true };\r\n  }\r\n\r\n  const rule = getRule(options, scope);\r\n  const now = Date.now();\r\n  pruneRateLimitBuckets(now);\r\n\r\n  const ipAddress =\r\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\r\n  const bucketKeys = new Set<string>([`${scope}|ip|${ipAddress}`]);\r\n\r\n  for (const identifier of identifiers) {\r\n    const normalizedIdentifier = normalizeIdentifier(identifier);\r\n    if (!normalizedIdentifier) {\r\n      continue;\r\n    }\r\n\r\n    bucketKeys.add(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`);\r\n  }\r\n\r\n  let retryAfterSeconds = 0;\r\n  for (const bucketKey of bucketKeys) {\r\n    const bucketRetryAfterSeconds = consumeBucket(bucketKey, rule, now);\r\n    if (bucketRetryAfterSeconds) {\r\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\r\n    }\r\n  }\r\n\r\n  if (retryAfterSeconds > 0) {\r\n    return {\r\n      allowed: false,\r\n      retryAfterSeconds,\r\n    };\r\n  }\r\n\r\n  return { allowed: true };\r\n}\r\n\r\nexport function sendPublicAuthRateLimitExceeded(\r\n  res: Response,\r\n  retryAfterSeconds: number,\r\n): Response {\r\n  res.setHeader('Retry-After', String(retryAfterSeconds));\r\n  return RestUtilities.sendErrorMessage(\r\n    res,\r\n    'Troppi tentativi. Riprova piu tardi.',\r\n    'PublicAuthRateLimit',\r\n    HttpStatus.TOO_MANY_REQUESTS,\r\n  );\r\n}\r\n"]}
+{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;;;;;;;;;;AA0FA,4DA4CC;AAED,0EAWC;AAnJD,2CAA2D;AAE3D,+CAAgD;AAEhD,qDAA4D;AAe5D,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACrD,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC7D,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC3D,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAe,gBAAgB,CAC7B,KAAqB,EACrB,GAAW,EACX,IAAoC;;QAEpC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,sBAAa,CACrB;gBACE,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,gDAAgD;aAC1D,EACD,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;CAAA;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAsB,wBAAwB;yDAC5C,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;QAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,KAAK,mCAAI,IAAA,yCAAwB,GAAE,CAAC;QAC/E,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;QAErF,gFAAgF;QAChF,kEAAkE;QAClE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAC5C,KAAK,EACL,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,CACL,CAAC;YACF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC7B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAC/C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;CAAA;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpException, HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\nimport { getDefaultRateLimitStore } from './rateLimitStore';\nimport type { RateLimitDecision, RateLimitStore } from './rateLimitStore';\n\nexport type PublicAuthRateLimitScope =\n  | 'login'\n  | 'twoFactorVerify'\n  | 'twoFactorResend'\n  | 'register'\n  | 'passwordResetEmail'\n  | 'passwordResetConfirm'\n  | 'refresh'\n  | 'getUserByToken'\n  | 'adminBootstrap'\n  | 'consoleEntry';\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n  PublicAuthRateLimitScope,\n  PublicAuthRateLimitRuleOptions\n> = {\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n  twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  refresh: { windowMs: 5 * 60 * 1000, maxAttempts: 60 },\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n  adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n};\n\nfunction getRule(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n  const configuredRule = options.publicAuthRateLimit?.[scope];\n\n  if (\n    configuredRule &&\n    Number.isFinite(configuredRule.windowMs) &&\n    configuredRule.windowMs > 0 &&\n    Number.isFinite(configuredRule.maxAttempts) &&\n    configuredRule.maxAttempts > 0\n  ) {\n    return {\n      windowMs: Math.trunc(configuredRule.windowMs),\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\n    };\n  }\n\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nasync function consumeRateLimit(\n  store: RateLimitStore,\n  key: string,\n  rule: PublicAuthRateLimitRuleOptions,\n): Promise<RateLimitDecision> {\n  try {\n    return await store.consume(key, rule.windowMs, rule.maxAttempts);\n  } catch {\n    throw new HttpException(\n      {\n        code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',\n        message: 'Rate limit non disponibile. Riprova piu tardi.',\n      },\n      HttpStatus.SERVICE_UNAVAILABLE,\n    );\n  }\n}\n\nfunction normalizeIdentifier(identifier: string): string | null {\n  if (typeof identifier !== 'string') {\n    return null;\n  }\n\n  const normalized = identifier.trim().toLowerCase();\n  return normalized === '' ? null : normalized;\n}\n\n/**\n * Applica il rate limit per IP e, opzionalmente, per soggetto.\n *\n * Con `publicAuthRateLimit.store` e possibile usare uno store Redis condiviso;\n * senza store usa la memoria del processo.\n */\nexport async function checkPublicAuthRateLimit(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n  req: Request,\n  identifiers: string[] = [],\n): Promise<RateLimitDecision> {\n  if (options.publicAuthRateLimit?.enabled === false) {\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  const rule = getRule(options, scope);\n  const store = options.publicAuthRateLimit?.store ?? getDefaultRateLimitStore();\n  const ipAddress =\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n  // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n  // evitando crescita di memoria con identificatori sempre diversi.\n  const ipDecision = await consumeRateLimit(store, `${scope}|ip|${ipAddress}`, rule);\n  if (!ipDecision.allowed) {\n    return ipDecision;\n  }\n\n  let retryAfterSeconds = 0;\n  for (const identifier of identifiers) {\n    const normalizedIdentifier = normalizeIdentifier(identifier);\n    if (!normalizedIdentifier) {\n      continue;\n    }\n\n    const subjectDecision = await consumeRateLimit(\n      store,\n      `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`,\n      rule,\n    );\n    if (!subjectDecision.allowed) {\n      retryAfterSeconds = Math.max(retryAfterSeconds, subjectDecision.retryAfterSeconds);\n    }\n  }\n\n  if (retryAfterSeconds > 0) {\n    return { allowed: false, retryAfterSeconds };\n  }\n\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n  res: Response,\n  retryAfterSeconds: number,\n): Response {\n  res.setHeader('Retry-After', String(retryAfterSeconds));\n  return RestUtilities.sendErrorMessage(\n    res,\n    'Troppi tentativi. Riprova piu tardi.',\n    'PublicAuthRateLimit',\n    HttpStatus.TOO_MANY_REQUESTS,\n  );\n}\n"]}

package/dist/accessi-module/security/rateLimitStore.d.ts

@@ -0,0 +1,34 @@
+/** Esito di un controllo di rate limit. */
+export interface RateLimitDecision {
+    allowed: boolean;
+    retryAfterSeconds: number;
+}
+/** Store pluggable per rate limit: memoria per singola istanza, Redis per cluster. */
+export interface RateLimitStore {
+    consume(key: string, windowMs: number, maxAttempts: number): Promise<RateLimitDecision>;
+    /** Health check opzionale per readiness del servizio. */
+    healthCheck?(): Promise<boolean>;
+}
+export interface MemoryRateLimitStore extends RateLimitStore {
+    reset(): void;
+}
+/** Store in memoria con finestra fissa e limite di bucket. */
+export declare function createMemoryRateLimitStore(maxBuckets?: number): MemoryRateLimitStore;
+/** Store di default in memoria, usato quando non viene configurato uno store condiviso. */
+export declare function getDefaultRateLimitStore(): MemoryRateLimitStore;
+/** Client Redis minimale: compatibile con ioredis (`redis.eval(script, numKeys, ...args)`). */
+export interface RateLimitRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+export interface RedisRateLimitStoreOptions {
+    client: RateLimitRedisClient;
+    /** Default: `accessi:rate:`. */
+    keyPrefix?: string;
+}
+/**
+ * Store Redis per rate limit distribuito.
+ *
+ * Usa `INCR` + `PEXPIRE` atomici. Adatto a login, reset password, 2FA,
+ * console entry e service token in deployment multi-istanza.
+ */
+export declare function createRedisRateLimitStore(options: RedisRateLimitStoreOptions): RateLimitStore;

package/dist/accessi-module/security/rateLimitStore.js

@@ -0,0 +1,145 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemoryRateLimitStore = createMemoryRateLimitStore;
+exports.getDefaultRateLimitStore = getDefaultRateLimitStore;
+exports.createRedisRateLimitStore = createRedisRateLimitStore;
+const DEFAULT_MAX_BUCKETS = 20000;
+function normalizeLimits(windowMs, maxAttempts) {
+    return {
+        windowMs: Math.max(1, Math.trunc(windowMs)),
+        maxAttempts: Math.max(1, Math.trunc(maxAttempts)),
+    };
+}
+/** Store in memoria con finestra fissa e limite di bucket. */
+function createMemoryRateLimitStore(maxBuckets = DEFAULT_MAX_BUCKETS) {
+    const buckets = new Map();
+    const safeMaxBuckets = Math.max(1, Math.trunc(maxBuckets));
+    const prune = (now) => {
+        if (buckets.size < safeMaxBuckets)
+            return;
+        for (const [key, bucket] of buckets) {
+            if (bucket.resetAt <= now)
+                buckets.delete(key);
+        }
+    };
+    const enforceCap = () => {
+        while (buckets.size >= safeMaxBuckets) {
+            let oldestKey;
+            let oldestSeen = Number.POSITIVE_INFINITY;
+            for (const [key, bucket] of buckets) {
+                if (bucket.lastSeenAt < oldestSeen) {
+                    oldestSeen = bucket.lastSeenAt;
+                    oldestKey = key;
+                }
+            }
+            if (oldestKey === undefined)
+                return;
+            buckets.delete(oldestKey);
+        }
+    };
+    return {
+        consume(key, windowMs, maxAttempts) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const limits = normalizeLimits(windowMs, maxAttempts);
+                const now = Date.now();
+                prune(now);
+                const existing = buckets.get(key);
+                if (!existing || existing.resetAt <= now) {
+                    enforceCap();
+                    buckets.set(key, {
+                        count: 1,
+                        resetAt: now + limits.windowMs,
+                        lastSeenAt: now,
+                    });
+                    return { allowed: true, retryAfterSeconds: 0 };
+                }
+                existing.lastSeenAt = now;
+                if (existing.count >= limits.maxAttempts) {
+                    return {
+                        allowed: false,
+                        retryAfterSeconds: Math.max(1, Math.ceil((existing.resetAt - now) / 1000)),
+                    };
+                }
+                existing.count += 1;
+                return { allowed: true, retryAfterSeconds: 0 };
+            });
+        },
+        reset() {
+            buckets.clear();
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                return true;
+            });
+        },
+    };
+}
+const defaultStore = createMemoryRateLimitStore();
+/** Store di default in memoria, usato quando non viene configurato uno store condiviso. */
+function getDefaultRateLimitStore() {
+    return defaultStore;
+}
+const REDIS_SCRIPT = `
+local current = redis.call('INCR', KEYS[1])
+if current == 1 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+local ttl = redis.call('PTTL', KEYS[1])
+if current > tonumber(ARGV[2]) then
+  return {0, ttl}
+end
+return {1, ttl}
+`;
+/**
+ * Store Redis per rate limit distribuito.
+ *
+ * Usa `INCR` + `PEXPIRE` atomici. Adatto a login, reset password, 2FA,
+ * console entry e service token in deployment multi-istanza.
+ */
+function createRedisRateLimitStore(options) {
+    var _a;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis rate limit store: client.eval non configurato.');
+    }
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:rate:').replace(/:+$/, ':');
+    return {
+        consume(key, windowMs, maxAttempts) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const limits = normalizeLimits(windowMs, maxAttempts);
+                const raw = yield options.client.eval(REDIS_SCRIPT, 1, `${keyPrefix}${key}`, limits.windowMs, limits.maxAttempts);
+                if (!Array.isArray(raw) || raw.length < 2) {
+                    throw new Error('Redis rate limit store: risposta non valida.');
+                }
+                const allowed = Number(raw[0]) === 1;
+                const ttlMs = Number(raw[1]);
+                return {
+                    allowed,
+                    retryAfterSeconds: allowed
+                        ? 0
+                        : Math.max(1, Number.isFinite(ttlMs) && ttlMs > 0 ? Math.ceil(ttlMs / 1000) : 1),
+                };
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const result = yield options.client.eval("return redis.call('PING')", 0);
+                    return String(result).toUpperCase() === 'PONG';
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+    };
+}
+//# sourceMappingURL=rateLimitStore.js.map

package/dist/accessi-module/security/rateLimitStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimitStore.js","sourceRoot":"","sources":["../../../src/accessi-module/security/rateLimitStore.ts"],"names":[],"mappings":";;;;;;;;;;;AAiCA,gEA+DC;AAKD,4DAEC;AA+BD,8DA0CC;AAzJD,MAAM,mBAAmB,GAAG,KAAM,CAAC;AAEnC,SAAS,eAAe,CAAC,QAAgB,EAAE,WAAmB;IAC5D,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3C,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,0BAA0B,CACxC,aAAqB,mBAAmB;IAExC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,IAAI,OAAO,CAAC,IAAI,GAAG,cAAc;YAAE,OAAO;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,OAAO,OAAO,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,SAA6B,CAAC;YAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACpC,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;oBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;oBAC/B,SAAS,GAAG,GAAG,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO;YACpC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACC,OAAO,CAAC,GAAW,EAAE,QAAgB,EAAE,WAAmB;;gBAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,CAAC;gBAEX,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;oBACzC,UAAU,EAAE,CAAC;oBACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;wBACf,KAAK,EAAE,CAAC;wBACR,OAAO,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ;wBAC9B,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;oBACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;gBACjD,CAAC;gBAED,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACzC,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;qBAC3E,CAAC;gBACJ,CAAC;gBAED,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACjD,CAAC;SAAA;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;AAElD,2FAA2F;AAC3F,SAAgB,wBAAwB;IACtC,OAAO,YAAY,CAAC;AACtB,CAAC;AAaD,MAAM,YAAY,GAAG;;;;;;;;;;CAUpB,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,yBAAyB,CACvC,OAAmC;;IAEnC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,eAAe,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE7E,OAAO;QACC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW;;gBACtC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACnC,YAAY,EACZ,CAAC,EACD,GAAG,SAAS,GAAG,GAAG,EAAE,EACpB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,WAAW,CACnB,CAAC;gBAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,OAAO;oBACL,OAAO;oBACP,iBAAiB,EAAE,OAAO;wBACxB,CAAC,CAAC,CAAC;wBACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;iBACnF,CAAC;YACJ,CAAC;SAAA;QACK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC","sourcesContent":["/** Esito di un controllo di rate limit. */\nexport interface RateLimitDecision {\n  allowed: boolean;\n  retryAfterSeconds: number;\n}\n\n/** Store pluggable per rate limit: memoria per singola istanza, Redis per cluster. */\nexport interface RateLimitStore {\n  consume(key: string, windowMs: number, maxAttempts: number): Promise<RateLimitDecision>;\n  /** Health check opzionale per readiness del servizio. */\n  healthCheck?(): Promise<boolean>;\n}\n\nexport interface MemoryRateLimitStore extends RateLimitStore {\n  reset(): void;\n}\n\ninterface RateLimitBucket {\n  count: number;\n  resetAt: number;\n  lastSeenAt: number;\n}\n\nconst DEFAULT_MAX_BUCKETS = 20_000;\n\nfunction normalizeLimits(windowMs: number, maxAttempts: number): { windowMs: number; maxAttempts: number } {\n  return {\n    windowMs: Math.max(1, Math.trunc(windowMs)),\n    maxAttempts: Math.max(1, Math.trunc(maxAttempts)),\n  };\n}\n\n/** Store in memoria con finestra fissa e limite di bucket. */\nexport function createMemoryRateLimitStore(\n  maxBuckets: number = DEFAULT_MAX_BUCKETS,\n): MemoryRateLimitStore {\n  const buckets = new Map<string, RateLimitBucket>();\n  const safeMaxBuckets = Math.max(1, Math.trunc(maxBuckets));\n\n  const prune = (now: number): void => {\n    if (buckets.size < safeMaxBuckets) return;\n    for (const [key, bucket] of buckets) {\n      if (bucket.resetAt <= now) buckets.delete(key);\n    }\n  };\n\n  const enforceCap = (): void => {\n    while (buckets.size >= safeMaxBuckets) {\n      let oldestKey: string | undefined;\n      let oldestSeen = Number.POSITIVE_INFINITY;\n      for (const [key, bucket] of buckets) {\n        if (bucket.lastSeenAt < oldestSeen) {\n          oldestSeen = bucket.lastSeenAt;\n          oldestKey = key;\n        }\n      }\n      if (oldestKey === undefined) return;\n      buckets.delete(oldestKey);\n    }\n  };\n\n  return {\n    async consume(key: string, windowMs: number, maxAttempts: number): Promise<RateLimitDecision> {\n      const limits = normalizeLimits(windowMs, maxAttempts);\n      const now = Date.now();\n      prune(now);\n\n      const existing = buckets.get(key);\n      if (!existing || existing.resetAt <= now) {\n        enforceCap();\n        buckets.set(key, {\n          count: 1,\n          resetAt: now + limits.windowMs,\n          lastSeenAt: now,\n        });\n        return { allowed: true, retryAfterSeconds: 0 };\n      }\n\n      existing.lastSeenAt = now;\n      if (existing.count >= limits.maxAttempts) {\n        return {\n          allowed: false,\n          retryAfterSeconds: Math.max(1, Math.ceil((existing.resetAt - now) / 1000)),\n        };\n      }\n\n      existing.count += 1;\n      return { allowed: true, retryAfterSeconds: 0 };\n    },\n    reset() {\n      buckets.clear();\n    },\n    async healthCheck() {\n      return true;\n    },\n  };\n}\n\nconst defaultStore = createMemoryRateLimitStore();\n\n/** Store di default in memoria, usato quando non viene configurato uno store condiviso. */\nexport function getDefaultRateLimitStore(): MemoryRateLimitStore {\n  return defaultStore;\n}\n\n/** Client Redis minimale: compatibile con ioredis (`redis.eval(script, numKeys, ...args)`). */\nexport interface RateLimitRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisRateLimitStoreOptions {\n  client: RateLimitRedisClient;\n  /** Default: `accessi:rate:`. */\n  keyPrefix?: string;\n}\n\nconst REDIS_SCRIPT = `\nlocal current = redis.call('INCR', KEYS[1])\nif current == 1 then\n  redis.call('PEXPIRE', KEYS[1], ARGV[1])\nend\nlocal ttl = redis.call('PTTL', KEYS[1])\nif current > tonumber(ARGV[2]) then\n  return {0, ttl}\nend\nreturn {1, ttl}\n`;\n\n/**\n * Store Redis per rate limit distribuito.\n *\n * Usa `INCR` + `PEXPIRE` atomici. Adatto a login, reset password, 2FA,\n * console entry e service token in deployment multi-istanza.\n */\nexport function createRedisRateLimitStore(\n  options: RedisRateLimitStoreOptions,\n): RateLimitStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis rate limit store: client.eval non configurato.');\n  }\n\n  const keyPrefix = (options.keyPrefix ?? 'accessi:rate:').replace(/:+$/, ':');\n\n  return {\n    async consume(key, windowMs, maxAttempts) {\n      const limits = normalizeLimits(windowMs, maxAttempts);\n      const raw = await options.client.eval(\n        REDIS_SCRIPT,\n        1,\n        `${keyPrefix}${key}`,\n        limits.windowMs,\n        limits.maxAttempts,\n      );\n\n      if (!Array.isArray(raw) || raw.length < 2) {\n        throw new Error('Redis rate limit store: risposta non valida.');\n      }\n\n      const allowed = Number(raw[0]) === 1;\n      const ttlMs = Number(raw[1]);\n      return {\n        allowed,\n        retryAfterSeconds: allowed\n          ? 0\n          : Math.max(1, Number.isFinite(ttlMs) && ttlMs > 0 ? Math.ceil(ttlMs / 1000) : 1),\n      };\n    },\n    async healthCheck() {\n      try {\n        const result = await options.client.eval(\"return redis.call('PING')\", 0);\n        return String(result).toUpperCase() === 'PONG';\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n"]}

package/dist/accessi-module/security/refreshTokenRotation.d.ts

@@ -0,0 +1,80 @@
+import type { AccessiOptions } from '../AccessiModule';
+/**
+ * Store di rotazione refresh token.
+ *
+ * `consume` e atomico: restituisce true una sola volta per `jti`, poi il token
+ * e considerato usato fino alla sua scadenza. In multi-istanza usare Redis.
+ */
+export interface RefreshTokenRotationStore {
+    consume(jti: string, expiresAtMs: number): Promise<boolean>;
+    /**
+     * Come `consume`, ma restituisce anche quando il token era gia stato
+     * consumato: serve a distinguere un retry concorrente da un possibile furto.
+     */
+    consumeWithMetadata?(jti: string, expiresAtMs: number): Promise<RefreshTokenConsumeResult>;
+    /** Revoca l'intera famiglia di refresh token (stesso login). */
+    revokeFamily?(familyId: string, expiresAtMs: number): Promise<void>;
+    /** True se la famiglia e stata revocata per riuso sospetto. */
+    isFamilyRevoked?(familyId: string): Promise<boolean>;
+    /** Health check opzionale per readiness del servizio. */
+    healthCheck?(): Promise<boolean>;
+}
+/** Esito del consumo atomico di un refresh token. */
+export interface RefreshTokenConsumeResult {
+    consumed: boolean;
+    /** Quando il token era gia stato consumato, il timestamp del primo consumo. */
+    consumedAtMs?: number;
+}
+export interface RefreshTokenRotationOptions {
+    /** Default: disabilitata se non viene fornito uno store. */
+    enabled?: boolean;
+    /** Store condiviso (es. Redis) per il monouso tra istanze. */
+    store?: RefreshTokenRotationStore;
+    /**
+     * Finestra entro cui il riuso di un token appena consumato e trattato come
+     * retry concorrente (nessuna revoca famiglia). Default: 10000 ms.
+     */
+    reuseGraceMs?: number;
+    /**
+     * Se true, dopo un riuso rilevato revoca anche tutte le sessioni utente.
+     * Default: false, per non disconnettere dispositivi legittimi.
+     */
+    revokeUserSessionsOnReuse?: boolean;
+}
+export interface MemoryRefreshTokenRotationStore extends RefreshTokenRotationStore {
+    clear(): void;
+}
+export declare function createMemoryRefreshTokenRotationStore(): MemoryRefreshTokenRotationStore;
+export interface RefreshTokenRotationRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+export interface RedisRefreshTokenRotationStoreOptions {
+    client: RefreshTokenRotationRedisClient;
+    /** Default: `accessi:refresh-used:`. */
+    keyPrefix?: string;
+    /** Default: `accessi:refresh-family-revoked:`. */
+    familyKeyPrefix?: string;
+}
+/**
+ * Store Redis per refresh token monouso.
+ *
+ * Il consumo e atomico: due refresh concorrenti dello stesso token producono
+ * un solo successo. La famiglia viene revocata con una chiave separata che
+ * scade insieme ai token che ne fanno parte.
+ */
+export declare function createRedisRefreshTokenRotationStore(options: RedisRefreshTokenRotationStoreOptions): RefreshTokenRotationStore;
+export declare function getRefreshTokenRotationStore(options: AccessiOptions): RefreshTokenRotationStore | undefined;
+/**
+ * True se la famiglia di refresh token e stata revocata. Ritorna false se lo
+ * store non supporta le famiglie (implementazioni legacy).
+ */
+export declare function isRefreshTokenFamilyRevoked(options: AccessiOptions, familyId: unknown): Promise<boolean>;
+/**
+ * Revoca la famiglia di refresh token fino alla scadenza indicata. Ritorna
+ * false se lo store non supporta le famiglie.
+ */
+export declare function revokeRefreshTokenFamily(options: AccessiOptions, familyId: string, expiresAtMs: number): Promise<boolean>;
+/** Consumo atomico con metadati, se lo store li supporta. */
+export declare function consumeRefreshToken(options: AccessiOptions, jti: string, expiresAtMs: number): Promise<RefreshTokenConsumeResult | undefined>;
+/** Solo per test: azzera lo store in memoria di default. */
+export declare function clearDefaultRefreshTokenRotations(): void;