emilsoftware-utilities 2.0.0-dev.7 → 2.0.0-dev.71

package/dist/accessi-module/security/refreshTokenRotation.js

@@ -0,0 +1,204 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemoryRefreshTokenRotationStore = createMemoryRefreshTokenRotationStore;
+exports.createRedisRefreshTokenRotationStore = createRedisRefreshTokenRotationStore;
+exports.getRefreshTokenRotationStore = getRefreshTokenRotationStore;
+exports.isRefreshTokenFamilyRevoked = isRefreshTokenFamilyRevoked;
+exports.revokeRefreshTokenFamily = revokeRefreshTokenFamily;
+exports.consumeRefreshToken = consumeRefreshToken;
+exports.clearDefaultRefreshTokenRotations = clearDefaultRefreshTokenRotations;
+const CONSUME_SCRIPT = `
+local ttl = tonumber(ARGV[2])
+if not ttl or ttl <= 0 then return nil end
+local stored = redis.call('GET', KEYS[1])
+if not stored then
+  redis.call('SET', KEYS[1], ARGV[1], 'PX', ttl)
+  return {1, 0}
+end
+return {0, tonumber(stored) or 0}
+`;
+const REVOKE_FAMILY_SCRIPT = "if tonumber(ARGV[1]) > 0 then return redis.call('SET', KEYS[1], '1', 'PX', ARGV[1]) else return redis.call('SET', KEYS[1], '1') end";
+const IS_FAMILY_REVOKED_SCRIPT = "return redis.call('EXISTS', KEYS[1])";
+function parseConsumeResult(result) {
+    if (Array.isArray(result)) {
+        const consumed = Number(result[0]) === 1 || result[0] === true;
+        const consumedAtMs = Number(result[1]);
+        return Object.assign({ consumed }, (Number.isFinite(consumedAtMs) && consumedAtMs > 0 ? { consumedAtMs } : {}));
+    }
+    // Client minimali (o store precedenti) rispondono 'OK' / null.
+    return { consumed: result !== null && result !== undefined && result !== false };
+}
+function createMemoryRefreshTokenRotationStore() {
+    const used = new Map();
+    const revokedFamilies = new Map();
+    const prune = (now) => {
+        for (const [jti, entry] of used) {
+            if (entry.expiresAtMs <= now)
+                used.delete(jti);
+        }
+        for (const [familyId, expiresAt] of revokedFamilies) {
+            if (expiresAt <= now)
+                revokedFamilies.delete(familyId);
+        }
+    };
+    const consumeWithMetadata = (jti, expiresAtMs) => __awaiter(this, void 0, void 0, function* () {
+        const now = Date.now();
+        prune(now);
+        const existing = used.get(jti);
+        if (existing && existing.expiresAtMs > now) {
+            return { consumed: false, consumedAtMs: existing.consumedAtMs };
+        }
+        used.set(jti, { expiresAtMs, consumedAtMs: now });
+        return { consumed: true };
+    });
+    return {
+        consume(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                return (yield consumeWithMetadata(jti, expiresAtMs)).consumed;
+            });
+        },
+        consumeWithMetadata,
+        revokeFamily(familyId, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                revokedFamilies.set(familyId, Math.max(expiresAtMs, Date.now() + 1));
+            });
+        },
+        isFamilyRevoked(familyId) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const expiresAt = revokedFamilies.get(familyId);
+                if (expiresAt === undefined)
+                    return false;
+                if (expiresAt <= Date.now()) {
+                    revokedFamilies.delete(familyId);
+                    return false;
+                }
+                return true;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                return true;
+            });
+        },
+        clear() {
+            used.clear();
+            revokedFamilies.clear();
+        },
+    };
+}
+/**
+ * Store Redis per refresh token monouso.
+ *
+ * Il consumo e atomico: due refresh concorrenti dello stesso token producono
+ * un solo successo. La famiglia viene revocata con una chiave separata che
+ * scade insieme ai token che ne fanno parte.
+ */
+function createRedisRefreshTokenRotationStore(options) {
+    var _a, _b;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis refresh rotation store: client.eval non configurato.');
+    }
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:refresh-used:').replace(/:+$/, ':');
+    const familyKeyPrefix = ((_b = options.familyKeyPrefix) !== null && _b !== void 0 ? _b : 'accessi:refresh-family-revoked:').replace(/:+$/, ':');
+    return {
+        consume(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const ttlMs = Math.max(1, Math.trunc(expiresAtMs - Date.now()));
+                const result = yield options.client.eval(CONSUME_SCRIPT, 1, `${keyPrefix}${jti}`, Date.now(), ttlMs);
+                return parseConsumeResult(result).consumed;
+            });
+        },
+        consumeWithMetadata(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const ttlMs = Math.max(1, Math.trunc(expiresAtMs - Date.now()));
+                const result = yield options.client.eval(CONSUME_SCRIPT, 1, `${keyPrefix}${jti}`, Date.now(), ttlMs);
+                return parseConsumeResult(result);
+            });
+        },
+        revokeFamily(familyId, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const ttlMs = Math.max(0, Math.trunc(expiresAtMs - Date.now()));
+                yield options.client.eval(REVOKE_FAMILY_SCRIPT, 1, `${familyKeyPrefix}${familyId}`, ttlMs);
+            });
+        },
+        isFamilyRevoked(familyId) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const result = yield options.client.eval(IS_FAMILY_REVOKED_SCRIPT, 1, `${familyKeyPrefix}${familyId}`);
+                return Number(result) > 0;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const result = yield options.client.eval("return redis.call('PING')", 0);
+                    return String(result).toUpperCase() === 'PONG';
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+    };
+}
+const defaultMemoryStore = createMemoryRefreshTokenRotationStore();
+function getRefreshTokenRotationStore(options) {
+    var _a, _b, _c;
+    if (((_a = options.refreshTokenRotation) === null || _a === void 0 ? void 0 : _a.enabled) === false)
+        return undefined;
+    if ((_b = options.refreshTokenRotation) === null || _b === void 0 ? void 0 : _b.store)
+        return options.refreshTokenRotation.store;
+    return ((_c = options.refreshTokenRotation) === null || _c === void 0 ? void 0 : _c.enabled) === true ? defaultMemoryStore : undefined;
+}
+/**
+ * True se la famiglia di refresh token e stata revocata. Ritorna false se lo
+ * store non supporta le famiglie (implementazioni legacy).
+ */
+function isRefreshTokenFamilyRevoked(options, familyId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (typeof familyId !== 'string' || familyId.trim() === '')
+            return false;
+        const store = getRefreshTokenRotationStore(options);
+        if (!(store === null || store === void 0 ? void 0 : store.isFamilyRevoked))
+            return false;
+        return store.isFamilyRevoked(familyId);
+    });
+}
+/**
+ * Revoca la famiglia di refresh token fino alla scadenza indicata. Ritorna
+ * false se lo store non supporta le famiglie.
+ */
+function revokeRefreshTokenFamily(options, familyId, expiresAtMs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const store = getRefreshTokenRotationStore(options);
+        if (!(store === null || store === void 0 ? void 0 : store.revokeFamily))
+            return false;
+        yield store.revokeFamily(familyId, expiresAtMs);
+        return true;
+    });
+}
+/** Consumo atomico con metadati, se lo store li supporta. */
+function consumeRefreshToken(options, jti, expiresAtMs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const store = getRefreshTokenRotationStore(options);
+        if (!store)
+            return undefined;
+        if (store.consumeWithMetadata) {
+            return store.consumeWithMetadata(jti, expiresAtMs);
+        }
+        return { consumed: yield store.consume(jti, expiresAtMs) };
+    });
+}
+/** Solo per test: azzera lo store in memoria di default. */
+function clearDefaultRefreshTokenRotations() {
+    defaultMemoryStore.clear();
+}
+//# sourceMappingURL=refreshTokenRotation.js.map

package/dist/accessi-module/security/refreshTokenRotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshTokenRotation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/refreshTokenRotation.ts"],"names":[],"mappings":";;;;;;;;;;;AA8EA,sFAoDC;AAqBD,oFAsDC;AAID,oEAMC;AAMD,kEAQC;AAMD,4DASC;AAGD,kDAWC;AAGD,8EAEC;AApND,MAAM,cAAc,GAAG;;;;;;;;;CAStB,CAAC;AACF,MAAM,oBAAoB,GACxB,qIAAqI,CAAC;AACxI,MAAM,wBAAwB,GAAG,sCAAsC,CAAC;AAExE,SAAS,kBAAkB,CAAC,MAAe;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,uBACE,QAAQ,IACL,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC9E;IACJ,CAAC;IACD,+DAA+D;IAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;AACnF,CAAC;AAED,SAAgB,qCAAqC;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyD,CAAC;IAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,eAAe,EAAE,CAAC;YACpD,IAAI,SAAS,IAAI,GAAG;gBAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,CAC1B,GAAW,EACX,WAAmB,EACiB,EAAE;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,CAAC,GAAG,CAAC,CAAC;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAA,CAAC;IAEF,OAAO;QACC,OAAO,CAAC,GAAG,EAAE,WAAW;;gBAC5B,OAAO,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChE,CAAC;SAAA;QACD,mBAAmB;QACb,YAAY,CAAC,QAAQ,EAAE,WAAW;;gBACtC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC;SAAA;QACK,eAAe,CAAC,QAAQ;;gBAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC1C,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC5B,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBACjC,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACD,KAAK;YACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,eAAe,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAcD;;;;;;GAMG;AACH,SAAgB,oCAAoC,CAClD,OAA8C;;IAE9C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,CAAC,MAAA,OAAO,CAAC,eAAe,mCAAI,iCAAiC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE3G,OAAO;QACC,OAAO,CAAC,GAAG,EAAE,WAAW;;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACtC,cAAc,EACd,CAAC,EACD,GAAG,SAAS,GAAG,GAAG,EAAE,EACpB,IAAI,CAAC,GAAG,EAAE,EACV,KAAK,CACN,CAAC;gBACF,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;YAC7C,CAAC;SAAA;QAEK,mBAAmB,CAAC,GAAG,EAAE,WAAW;;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CACtC,cAAc,EACd,CAAC,EACD,GAAG,SAAS,GAAG,GAAG,EAAE,EACpB,IAAI,CAAC,GAAG,EAAE,EACV,KAAK,CACN,CAAC;gBACF,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;SAAA;QAEK,YAAY,CAAC,QAAQ,EAAE,WAAW;;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAChE,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,EAAE,GAAG,eAAe,GAAG,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;YAC7F,CAAC;SAAA;QAEK,eAAe,CAAC,QAAQ;;gBAC5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,EAAE,GAAG,eAAe,GAAG,QAAQ,EAAE,CAAC,CAAC;gBACvG,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;SAAA;QAEK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,qCAAqC,EAAE,CAAC;AAEnE,SAAgB,4BAA4B,CAC1C,OAAuB;;IAEvB,IAAI,CAAA,MAAA,OAAO,CAAC,oBAAoB,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,MAAA,OAAO,CAAC,oBAAoB,0CAAE,KAAK;QAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IACnF,OAAO,CAAA,MAAA,OAAO,CAAC,oBAAoB,0CAAE,OAAO,MAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,SAAsB,2BAA2B,CAC/C,OAAuB,EACvB,QAAiB;;QAEjB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QACzE,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,eAAe,CAAA;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;CAAA;AAED;;;GAGG;AACH,SAAsB,wBAAwB,CAC5C,OAAuB,EACvB,QAAgB,EAChB,WAAmB;;QAEnB,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,YAAY,CAAA;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,6DAA6D;AAC7D,SAAsB,mBAAmB,CACvC,OAAuB,EACvB,GAAW,EACX,WAAmB;;QAEnB,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;IAC7D,CAAC;CAAA;AAED,4DAA4D;AAC5D,SAAgB,iCAAiC;IAC/C,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\n\n/**\n * Store di rotazione refresh token.\n *\n * `consume` e atomico: restituisce true una sola volta per `jti`, poi il token\n * e considerato usato fino alla sua scadenza. In multi-istanza usare Redis.\n */\nexport interface RefreshTokenRotationStore {\n  consume(jti: string, expiresAtMs: number): Promise<boolean>;\n  /**\n   * Come `consume`, ma restituisce anche quando il token era gia stato\n   * consumato: serve a distinguere un retry concorrente da un possibile furto.\n   */\n  consumeWithMetadata?(jti: string, expiresAtMs: number): Promise<RefreshTokenConsumeResult>;\n  /** Revoca l'intera famiglia di refresh token (stesso login). */\n  revokeFamily?(familyId: string, expiresAtMs: number): Promise<void>;\n  /** True se la famiglia e stata revocata per riuso sospetto. */\n  isFamilyRevoked?(familyId: string): Promise<boolean>;\n  /** Health check opzionale per readiness del servizio. */\n  healthCheck?(): Promise<boolean>;\n}\n\n/** Esito del consumo atomico di un refresh token. */\nexport interface RefreshTokenConsumeResult {\n  consumed: boolean;\n  /** Quando il token era gia stato consumato, il timestamp del primo consumo. */\n  consumedAtMs?: number;\n}\n\nexport interface RefreshTokenRotationOptions {\n  /** Default: disabilitata se non viene fornito uno store. */\n  enabled?: boolean;\n  /** Store condiviso (es. Redis) per il monouso tra istanze. */\n  store?: RefreshTokenRotationStore;\n  /**\n   * Finestra entro cui il riuso di un token appena consumato e trattato come\n   * retry concorrente (nessuna revoca famiglia). Default: 10000 ms.\n   */\n  reuseGraceMs?: number;\n  /**\n   * Se true, dopo un riuso rilevato revoca anche tutte le sessioni utente.\n   * Default: false, per non disconnettere dispositivi legittimi.\n   */\n  revokeUserSessionsOnReuse?: boolean;\n}\n\nexport interface MemoryRefreshTokenRotationStore extends RefreshTokenRotationStore {\n  clear(): void;\n}\n\nconst CONSUME_SCRIPT = `\nlocal ttl = tonumber(ARGV[2])\nif not ttl or ttl <= 0 then return nil end\nlocal stored = redis.call('GET', KEYS[1])\nif not stored then\n  redis.call('SET', KEYS[1], ARGV[1], 'PX', ttl)\n  return {1, 0}\nend\nreturn {0, tonumber(stored) or 0}\n`;\nconst REVOKE_FAMILY_SCRIPT =\n  \"if tonumber(ARGV[1]) > 0 then return redis.call('SET', KEYS[1], '1', 'PX', ARGV[1]) else return redis.call('SET', KEYS[1], '1') end\";\nconst IS_FAMILY_REVOKED_SCRIPT = \"return redis.call('EXISTS', KEYS[1])\";\n\nfunction parseConsumeResult(result: unknown): RefreshTokenConsumeResult {\n  if (Array.isArray(result)) {\n    const consumed = Number(result[0]) === 1 || result[0] === true;\n    const consumedAtMs = Number(result[1]);\n    return {\n      consumed,\n      ...(Number.isFinite(consumedAtMs) && consumedAtMs > 0 ? { consumedAtMs } : {}),\n    };\n  }\n  // Client minimali (o store precedenti) rispondono 'OK' / null.\n  return { consumed: result !== null && result !== undefined && result !== false };\n}\n\nexport function createMemoryRefreshTokenRotationStore(): MemoryRefreshTokenRotationStore {\n  const used = new Map<string, { expiresAtMs: number; consumedAtMs: number }>();\n  const revokedFamilies = new Map<string, number>();\n\n  const prune = (now: number) => {\n    for (const [jti, entry] of used) {\n      if (entry.expiresAtMs <= now) used.delete(jti);\n    }\n    for (const [familyId, expiresAt] of revokedFamilies) {\n      if (expiresAt <= now) revokedFamilies.delete(familyId);\n    }\n  };\n\n  const consumeWithMetadata = async (\n    jti: string,\n    expiresAtMs: number,\n  ): Promise<RefreshTokenConsumeResult> => {\n    const now = Date.now();\n    prune(now);\n    const existing = used.get(jti);\n    if (existing && existing.expiresAtMs > now) {\n      return { consumed: false, consumedAtMs: existing.consumedAtMs };\n    }\n    used.set(jti, { expiresAtMs, consumedAtMs: now });\n    return { consumed: true };\n  };\n\n  return {\n    async consume(jti, expiresAtMs) {\n      return (await consumeWithMetadata(jti, expiresAtMs)).consumed;\n    },\n    consumeWithMetadata,\n    async revokeFamily(familyId, expiresAtMs) {\n      revokedFamilies.set(familyId, Math.max(expiresAtMs, Date.now() + 1));\n    },\n    async isFamilyRevoked(familyId) {\n      const expiresAt = revokedFamilies.get(familyId);\n      if (expiresAt === undefined) return false;\n      if (expiresAt <= Date.now()) {\n        revokedFamilies.delete(familyId);\n        return false;\n      }\n      return true;\n    },\n    async healthCheck() {\n      return true;\n    },\n    clear() {\n      used.clear();\n      revokedFamilies.clear();\n    },\n  };\n}\n\nexport interface RefreshTokenRotationRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisRefreshTokenRotationStoreOptions {\n  client: RefreshTokenRotationRedisClient;\n  /** Default: `accessi:refresh-used:`. */\n  keyPrefix?: string;\n  /** Default: `accessi:refresh-family-revoked:`. */\n  familyKeyPrefix?: string;\n}\n\n/**\n * Store Redis per refresh token monouso.\n *\n * Il consumo e atomico: due refresh concorrenti dello stesso token producono\n * un solo successo. La famiglia viene revocata con una chiave separata che\n * scade insieme ai token che ne fanno parte.\n */\nexport function createRedisRefreshTokenRotationStore(\n  options: RedisRefreshTokenRotationStoreOptions,\n): RefreshTokenRotationStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis refresh rotation store: client.eval non configurato.');\n  }\n\n  const keyPrefix = (options.keyPrefix ?? 'accessi:refresh-used:').replace(/:+$/, ':');\n  const familyKeyPrefix = (options.familyKeyPrefix ?? 'accessi:refresh-family-revoked:').replace(/:+$/, ':');\n\n  return {\n    async consume(jti, expiresAtMs) {\n      const ttlMs = Math.max(1, Math.trunc(expiresAtMs - Date.now()));\n      const result = await options.client.eval(\n        CONSUME_SCRIPT,\n        1,\n        `${keyPrefix}${jti}`,\n        Date.now(),\n        ttlMs,\n      );\n      return parseConsumeResult(result).consumed;\n    },\n\n    async consumeWithMetadata(jti, expiresAtMs) {\n      const ttlMs = Math.max(1, Math.trunc(expiresAtMs - Date.now()));\n      const result = await options.client.eval(\n        CONSUME_SCRIPT,\n        1,\n        `${keyPrefix}${jti}`,\n        Date.now(),\n        ttlMs,\n      );\n      return parseConsumeResult(result);\n    },\n\n    async revokeFamily(familyId, expiresAtMs) {\n      const ttlMs = Math.max(0, Math.trunc(expiresAtMs - Date.now()));\n      await options.client.eval(REVOKE_FAMILY_SCRIPT, 1, `${familyKeyPrefix}${familyId}`, ttlMs);\n    },\n\n    async isFamilyRevoked(familyId) {\n      const result = await options.client.eval(IS_FAMILY_REVOKED_SCRIPT, 1, `${familyKeyPrefix}${familyId}`);\n      return Number(result) > 0;\n    },\n\n    async healthCheck() {\n      try {\n        const result = await options.client.eval(\"return redis.call('PING')\", 0);\n        return String(result).toUpperCase() === 'PONG';\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n\nconst defaultMemoryStore = createMemoryRefreshTokenRotationStore();\n\nexport function getRefreshTokenRotationStore(\n  options: AccessiOptions,\n): RefreshTokenRotationStore | undefined {\n  if (options.refreshTokenRotation?.enabled === false) return undefined;\n  if (options.refreshTokenRotation?.store) return options.refreshTokenRotation.store;\n  return options.refreshTokenRotation?.enabled === true ? defaultMemoryStore : undefined;\n}\n\n/**\n * True se la famiglia di refresh token e stata revocata. Ritorna false se lo\n * store non supporta le famiglie (implementazioni legacy).\n */\nexport async function isRefreshTokenFamilyRevoked(\n  options: AccessiOptions,\n  familyId: unknown,\n): Promise<boolean> {\n  if (typeof familyId !== 'string' || familyId.trim() === '') return false;\n  const store = getRefreshTokenRotationStore(options);\n  if (!store?.isFamilyRevoked) return false;\n  return store.isFamilyRevoked(familyId);\n}\n\n/**\n * Revoca la famiglia di refresh token fino alla scadenza indicata. Ritorna\n * false se lo store non supporta le famiglie.\n */\nexport async function revokeRefreshTokenFamily(\n  options: AccessiOptions,\n  familyId: string,\n  expiresAtMs: number,\n): Promise<boolean> {\n  const store = getRefreshTokenRotationStore(options);\n  if (!store?.revokeFamily) return false;\n  await store.revokeFamily(familyId, expiresAtMs);\n  return true;\n}\n\n/** Consumo atomico con metadati, se lo store li supporta. */\nexport async function consumeRefreshToken(\n  options: AccessiOptions,\n  jti: string,\n  expiresAtMs: number,\n): Promise<RefreshTokenConsumeResult | undefined> {\n  const store = getRefreshTokenRotationStore(options);\n  if (!store) return undefined;\n  if (store.consumeWithMetadata) {\n    return store.consumeWithMetadata(jti, expiresAtMs);\n  }\n  return { consumed: await store.consume(jti, expiresAtMs) };\n}\n\n/** Solo per test: azzera lo store in memoria di default. */\nexport function clearDefaultRefreshTokenRotations(): void {\n  defaultMemoryStore.clear();\n}\n"]}

package/dist/accessi-module/security/serviceTokenGuard.d.ts

@@ -0,0 +1,27 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { Request } from 'express';
+import type { AccessiOptions } from '../AccessiModule';
+import { ServiceTokenService, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';
+/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */
+export declare const SERVICE_TOKEN_SCOPES_METADATA = "accessi:service-token-scopes";
+/** Richiede che il token di servizio presenti tutti gli scope indicati. */
+export declare const RequireServiceTokenScopes: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<string>;
+export type AccessiServiceTokenRequest = Request & {
+    accessiServiceToken?: VerifiedServiceToken;
+};
+/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */
+export declare function getAccessiServiceToken(req: Request): VerifiedServiceToken;
+/**
+ * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.
+ *
+ * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano
+ * con `@RequireServiceTokenScopes('ia')`.
+ */
+export declare class ServiceTokenGuard implements CanActivate {
+    private readonly serviceTokenService;
+    private readonly reflector;
+    private readonly accessiOptions;
+    constructor(serviceTokenService: ServiceTokenService, reflector: Reflector, accessiOptions: AccessiOptions);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/accessi-module/security/serviceTokenGuard.js

@@ -0,0 +1,90 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceTokenGuard = exports.RequireServiceTokenScopes = exports.SERVICE_TOKEN_SCOPES_METADATA = void 0;
+exports.getAccessiServiceToken = getAccessiServiceToken;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const ServiceTokenService_1 = require("../Services/ServiceTokenService/ServiceTokenService");
+const authenticatedToken_1 = require("./authenticatedToken");
+const serviceTokenRateLimit_1 = require("./serviceTokenRateLimit");
+/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */
+exports.SERVICE_TOKEN_SCOPES_METADATA = 'accessi:service-token-scopes';
+/** Richiede che il token di servizio presenti tutti gli scope indicati. */
+const RequireServiceTokenScopes = (...scopes) => (0, common_1.SetMetadata)(exports.SERVICE_TOKEN_SCOPES_METADATA, scopes);
+exports.RequireServiceTokenScopes = RequireServiceTokenScopes;
+/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */
+function getAccessiServiceToken(req) {
+    const verified = req.accessiServiceToken;
+    if (!verified) {
+        throw new common_1.UnauthorizedException('Token di servizio non verificato.');
+    }
+    return verified;
+}
+/**
+ * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.
+ *
+ * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano
+ * con `@RequireServiceTokenScopes('ia')`.
+ */
+let ServiceTokenGuard = class ServiceTokenGuard {
+    constructor(serviceTokenService, reflector, accessiOptions) {
+        this.serviceTokenService = serviceTokenService;
+        this.reflector = reflector;
+        this.accessiOptions = accessiOptions;
+    }
+    canActivate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e;
+            const request = context.switchToHttp().getRequest();
+            const ip = (_c = (_a = request.ip) !== null && _a !== void 0 ? _a : (_b = request.socket) === null || _b === void 0 ? void 0 : _b.remoteAddress) !== null && _c !== void 0 ? _c : 'unknown';
+            yield (0, serviceTokenRateLimit_1.assertServiceTokenRateLimit)(ip, (_d = this.accessiOptions.serviceTokens) === null || _d === void 0 ? void 0 : _d.rateLimitStore);
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(request.headers['authorization']);
+            if (!token) {
+                throw new common_1.UnauthorizedException('Token di servizio mancante.');
+            }
+            const verified = yield this.serviceTokenService.verify(token, { ip });
+            if (!verified) {
+                throw new common_1.UnauthorizedException('Token di servizio non valido, scaduto o revocato.');
+            }
+            request.accessiServiceToken = verified;
+            const requiredScopes = (_e = this.reflector.getAllAndOverride(exports.SERVICE_TOKEN_SCOPES_METADATA, [
+                context.getHandler(),
+                context.getClass(),
+            ])) !== null && _e !== void 0 ? _e : [];
+            const missingScope = requiredScopes.find((scope) => !(0, ServiceTokenService_1.serviceTokenHasScope)(verified.scopes, scope));
+            if (missingScope) {
+                throw new common_1.ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);
+            }
+            return true;
+        });
+    }
+};
+exports.ServiceTokenGuard = ServiceTokenGuard;
+exports.ServiceTokenGuard = ServiceTokenGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [ServiceTokenService_1.ServiceTokenService,
+        core_1.Reflector, Object])
+], ServiceTokenGuard);
+//# sourceMappingURL=serviceTokenGuard.js.map

package/dist/accessi-module/security/serviceTokenGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTokenGuard.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenGuard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyBA,wDAMC;AA/BD,2CAQwB;AACxB,uCAAyC;AAGzC,6FAAsI;AACtI,6DAAiE;AACjE,mEAAsE;AAEtE,iEAAiE;AACpD,QAAA,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,2EAA2E;AACpE,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAgB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,qCAA6B,EAAE,MAAM,CAAC,CAAC;AAAxG,QAAA,yBAAyB,6BAA+E;AAIrH,iGAAiG;AACjG,SAAgB,sBAAsB,CAAC,GAAY;IACjD,MAAM,QAAQ,GAAI,GAAkC,CAAC,mBAAmB,CAAC;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,8BAAqB,CAAC,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,mBAAwC,EACxC,SAAoB,EACO,cAA8B;QAFzD,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,cAAS,GAAT,SAAS,CAAW;QACO,mBAAc,GAAd,cAAc,CAAgB;IACzE,CAAC;IAEE,WAAW,CAAC,OAAyB;;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;YAC7D,MAAM,EAAE,GAAG,MAAA,MAAA,OAAO,CAAC,EAAE,mCAAI,MAAA,OAAO,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC;YACpE,MAAM,IAAA,mDAA2B,EAAC,EAAE,EAAE,MAAA,IAAI,CAAC,cAAc,CAAC,aAAa,0CAAE,cAAc,CAAC,CAAC;YAEzF,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,8BAAqB,CAAC,mDAAmD,CAAC,CAAC;YACvF,CAAC;YAEA,OAAsC,CAAC,mBAAmB,GAAG,QAAQ,CAAC;YAEvE,MAAM,cAAc,GAAG,MAAA,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,qCAA6B,EAAE;gBAC/F,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,mCAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAA,0CAAoB,EAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,2BAAkB,CAAC,UAAU,YAAY,qCAAqC,CAAC,CAAC;YAC5F,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;CACF,CAAA;AAnCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFY,yCAAmB;QAC7B,gBAAS;GAH5B,iBAAiB,CAmC7B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport type { Request } from 'express';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ServiceTokenService, serviceTokenHasScope, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';\nimport { extractAccessiBearerToken } from './authenticatedToken';\nimport { assertServiceTokenRateLimit } from './serviceTokenRateLimit';\n\n/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */\nexport const SERVICE_TOKEN_SCOPES_METADATA = 'accessi:service-token-scopes';\n\n/** Richiede che il token di servizio presenti tutti gli scope indicati. */\nexport const RequireServiceTokenScopes = (...scopes: string[]) => SetMetadata(SERVICE_TOKEN_SCOPES_METADATA, scopes);\n\nexport type AccessiServiceTokenRequest = Request & { accessiServiceToken?: VerifiedServiceToken };\n\n/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */\nexport function getAccessiServiceToken(req: Request): VerifiedServiceToken {\n  const verified = (req as AccessiServiceTokenRequest).accessiServiceToken;\n  if (!verified) {\n    throw new UnauthorizedException('Token di servizio non verificato.');\n  }\n  return verified;\n}\n\n/**\n * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.\n *\n * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano\n * con `@RequireServiceTokenScopes('ia')`.\n */\n@Injectable()\nexport class ServiceTokenGuard implements CanActivate {\n  constructor(\n    private readonly serviceTokenService: ServiceTokenService,\n    private readonly reflector: Reflector,\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest<Request>();\n    const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';\n    await assertServiceTokenRateLimit(ip, this.accessiOptions.serviceTokens?.rateLimitStore);\n\n    const token = extractAccessiBearerToken(request.headers['authorization']);\n    if (!token) {\n      throw new UnauthorizedException('Token di servizio mancante.');\n    }\n\n    const verified = await this.serviceTokenService.verify(token, { ip });\n    if (!verified) {\n      throw new UnauthorizedException('Token di servizio non valido, scaduto o revocato.');\n    }\n\n    (request as AccessiServiceTokenRequest).accessiServiceToken = verified;\n\n    const requiredScopes = this.reflector.getAllAndOverride<string[]>(SERVICE_TOKEN_SCOPES_METADATA, [\n      context.getHandler(),\n      context.getClass(),\n    ]) ?? [];\n    const missingScope = requiredScopes.find((scope) => !serviceTokenHasScope(verified.scopes, scope));\n    if (missingScope) {\n      throw new ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);\n    }\n\n    return true;\n  }\n}\n"]}

package/dist/accessi-module/security/serviceTokenRateLimit.d.ts

@@ -0,0 +1,9 @@
+import type { RateLimitStore } from './rateLimitStore';
+export declare function checkServiceTokenRateLimit(identifier: string, store?: RateLimitStore): Promise<{
+    allowed: boolean;
+    retryAfterSeconds: number;
+}>;
+/** Svuota i bucket dello store di default (usato nei test). */
+export declare function resetServiceTokenRateLimit(): void;
+/** Lancia 429 con `Retry-After` quando il limite e superato. */
+export declare function assertServiceTokenRateLimit(identifier: string, store?: RateLimitStore): Promise<void>;

package/dist/accessi-module/security/serviceTokenRateLimit.js

@@ -0,0 +1,53 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkServiceTokenRateLimit = checkServiceTokenRateLimit;
+exports.resetServiceTokenRateLimit = resetServiceTokenRateLimit;
+exports.assertServiceTokenRateLimit = assertServiceTokenRateLimit;
+const common_1 = require("@nestjs/common");
+const rateLimitStore_1 = require("./rateLimitStore");
+/**
+ * Limite anti-abuso per la verifica dei token di servizio.
+ *
+ * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita
+ * che un client difettoso o malevolo martelli l'endpoint. Con `serviceTokens.rateLimitStore`
+ * e possibile usare uno store condiviso in cluster.
+ */
+const WINDOW_MS = 60000;
+const MAX_ATTEMPTS = 120;
+function checkServiceTokenRateLimit(identifier_1) {
+    return __awaiter(this, arguments, void 0, function* (identifier, store = (0, rateLimitStore_1.getDefaultRateLimitStore)()) {
+        const key = identifier && identifier.trim() !== '' ? identifier.trim() : 'unknown';
+        try {
+            return yield store.consume(`service-token|${key}`, WINDOW_MS, MAX_ATTEMPTS);
+        }
+        catch (_a) {
+            throw new common_1.HttpException({
+                code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',
+                message: 'Rate limit non disponibile. Riprova piu tardi.',
+            }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+        }
+    });
+}
+/** Svuota i bucket dello store di default (usato nei test). */
+function resetServiceTokenRateLimit() {
+    (0, rateLimitStore_1.getDefaultRateLimitStore)().reset();
+}
+/** Lancia 429 con `Retry-After` quando il limite e superato. */
+function assertServiceTokenRateLimit(identifier, store) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const decision = yield checkServiceTokenRateLimit(identifier, store);
+        if (!decision.allowed) {
+            throw new common_1.HttpException({ code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' }, common_1.HttpStatus.TOO_MANY_REQUESTS);
+        }
+    });
+}
+//# sourceMappingURL=serviceTokenRateLimit.js.map

package/dist/accessi-module/security/serviceTokenRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTokenRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenRateLimit.ts"],"names":[],"mappings":";;;;;;;;;;;AAcA,gEAgBC;AAGD,gEAEC;AAGD,kEAWC;AAjDD,2CAA2D;AAC3D,qDAA4D;AAG5D;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,KAAM,CAAC;AACzB,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,SAAsB,0BAA0B;yDAC9C,UAAkB,EAClB,QAAwB,IAAA,yCAAwB,GAAE;QAElD,MAAM,GAAG,GAAG,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9E,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,sBAAa,CACrB;gBACE,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,gDAAgD;aAC1D,EACD,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;CAAA;AAED,+DAA+D;AAC/D,SAAgB,0BAA0B;IACxC,IAAA,yCAAwB,GAAE,CAAC,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,gEAAgE;AAChE,SAAsB,2BAA2B,CAC/C,UAAkB,EAClB,KAAsB;;QAEtB,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,sBAAa,CACrB,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAC/F,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { HttpException, HttpStatus } from '@nestjs/common';\nimport { getDefaultRateLimitStore } from './rateLimitStore';\nimport type { RateLimitStore } from './rateLimitStore';\n\n/**\n * Limite anti-abuso per la verifica dei token di servizio.\n *\n * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita\n * che un client difettoso o malevolo martelli l'endpoint. Con `serviceTokens.rateLimitStore`\n * e possibile usare uno store condiviso in cluster.\n */\nconst WINDOW_MS = 60_000;\nconst MAX_ATTEMPTS = 120;\n\nexport async function checkServiceTokenRateLimit(\n  identifier: string,\n  store: RateLimitStore = getDefaultRateLimitStore(),\n): Promise<{ allowed: boolean; retryAfterSeconds: number }> {\n  const key = identifier && identifier.trim() !== '' ? identifier.trim() : 'unknown';\n  try {\n    return await store.consume(`service-token|${key}`, WINDOW_MS, MAX_ATTEMPTS);\n  } catch {\n    throw new HttpException(\n      {\n        code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',\n        message: 'Rate limit non disponibile. Riprova piu tardi.',\n      },\n      HttpStatus.SERVICE_UNAVAILABLE,\n    );\n  }\n}\n\n/** Svuota i bucket dello store di default (usato nei test). */\nexport function resetServiceTokenRateLimit(): void {\n  getDefaultRateLimitStore().reset();\n}\n\n/** Lancia 429 con `Retry-After` quando il limite e superato. */\nexport async function assertServiceTokenRateLimit(\n  identifier: string,\n  store?: RateLimitStore,\n): Promise<void> {\n  const decision = await checkServiceTokenRateLimit(identifier, store);\n  if (!decision.allowed) {\n    throw new HttpException(\n      { code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' },\n      HttpStatus.TOO_MANY_REQUESTS,\n    );\n  }\n}\n"]}

package/dist/accessi-module/security/sessionRevocation.d.ts

@@ -0,0 +1,67 @@
+import type { AccessiOptions } from '../AccessiModule';
+/**
+ * Revoca delle sessioni per utente.
+ *
+ * La revoca e un timestamp: un token emesso prima del cutoff viene rifiutato.
+ * I token emessi dopo il cutoff restano validi. I token includono `iatMs`
+ * (millisecondi) per rendere la revoca deterministica anche quando il cambio
+ * password e il login avvengono nello stesso secondo; per i token legacy senza
+ * `iatMs` si usa `iat` in secondi.
+ */
+export interface SessionRevocationStore {
+    revokeUser(codiceUtente: number, revokedAtMs: number): Promise<void>;
+    getUserRevocation(codiceUtente: number): Promise<number | null>;
+    /** Health check opzionale per readiness del servizio. */
+    healthCheck?(): Promise<boolean>;
+}
+export interface SessionRevocationOptions {
+    /** Default: disabilitata se non viene fornito uno store. */
+    enabled?: boolean;
+    /** Store condiviso (es. Redis) per invalidare le sessioni tra istanze. */
+    store?: SessionRevocationStore;
+    /** TTL delle chiavi Redis. Default: 365 giorni. */
+    ttlMs?: number;
+}
+export interface MemorySessionRevocationStore extends SessionRevocationStore {
+    clear(): void;
+}
+export declare function createMemorySessionRevocationStore(): MemorySessionRevocationStore;
+export interface SessionRevocationRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+export interface RedisSessionRevocationStoreOptions {
+    client: SessionRevocationRedisClient;
+    /** Default: `accessi:revoked-user:`. */
+    keyPrefix?: string;
+    /** Default: 365 giorni. */
+    ttlMs?: number;
+}
+/**
+ * Store Redis per la revoca sessioni.
+ *
+ * `revokeUser` scrive un timestamp con TTL; `getUserRevocation` lo legge.
+ * Il TTL deve essere maggiore della durata massima dei token.
+ */
+export declare function createRedisSessionRevocationStore(options: RedisSessionRevocationStoreOptions): SessionRevocationStore;
+/** Store di default in memoria, usato quando `sessionRevocation.store` non e configurato ma la revoca e abilitata. */
+export declare function getSessionRevocationStore(options: AccessiOptions): SessionRevocationStore | undefined;
+/**
+ * Issued-at in millisecondi. I token emessi da questa versione includono `iatMs`;
+ * per quelli legacy si ricade su `iat` (secondi) per restare compatibili.
+ */
+export declare function resolveAccessiTokenIssuedAtMs(payload: Record<string, unknown>): number | null;
+/**
+ * True se il token e stato revocato: famiglia refresh revocata, `jti` revocato
+ * oppure sessione utente revocata prima dell'emissione del token.
+ */
+export declare function isAccessiTokenRevoked(options: AccessiOptions, payload: Record<string, unknown>, codiceUtente: number): Promise<boolean>;
+/** Revoca tutte le sessioni dell'utente. Richiede uno store configurato. */
+export declare function revokeAccessiUserSessions(options: AccessiOptions, codiceUtente: number, revokedAtMs?: number, reason?: string): Promise<void>;
+/**
+ * Variante per i flussi applicativi (cambio password, blocco, cancellazione):
+ * se la revoca non e configurata non fallisce, perche quei flussi devono
+ * continuare a funzionare anche senza store condiviso.
+ */
+export declare function revokeAccessiUserSessionsIfConfigured(options: AccessiOptions, codiceUtente: number, reason?: string, revokedAtMs?: number): Promise<boolean>;
+/** Solo per test: azzera lo store in memoria di default. */
+export declare function clearDefaultSessionRevocations(): void;