emilsoftware-utilities 2.0.0-dev.74 → 2.0.0-dev.75

package/dist/accessi-module/jwt/jwt.strategy.js

@@ -1,43 +1,10 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
@@ -56,7 +23,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtSimpleGuard = void 0;
 const common_1 = require("@nestjs/common");
-const jwt = __importStar(require("jsonwebtoken"));
 const UserService_1 = require("../Services/UserService/UserService");
 const authenticatedToken_1 = require("../security/authenticatedToken");
 const jwtTokenOptions_1 = require("../security/jwtTokenOptions");
@@ -85,7 +51,7 @@ let JwtSimpleGuard = class JwtSimpleGuard {
                 }
                 let payload;
                 try {
-                    payload = jwt.verify(token, verification.key, verification.verifyOptions);
+                    payload = (0, jwtTokenOptions_1.verifyAccessiJwt)(token, verification);
                 }
                 catch (_b) {
                     throw new common_1.UnauthorizedException('Token non valido o scaduto.');

package/dist/accessi-module/jwt/jwt.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kDAAoC;AAEpC,qEAAkE;AAClE,uEAMwC;AACxC,iEAAsF;AACtF,qEAAsE;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,IAAI,YAAwE,CAAC;gBAC7E,IAAI,CAAC;oBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC9E,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,OAAgC,CAAC;gBACrC,IAAI,CAAC;oBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5E,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;oBACvG,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;gBACxD,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,yCAAyC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAlDY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CAkD1B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  Inject,\n  Injectable,\n  InternalServerErrorException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport * as jwt from 'jsonwebtoken';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { UserService } from '../Services/UserService/UserService';\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from '../security/authenticatedToken';\nimport { getAccessiAccessTokenVerificationConfig } from '../security/jwtTokenOptions';\nimport { isAccessiTokenRevoked } from '../security/sessionRevocation';\n\n@Injectable()\nexport class JwtSimpleGuard implements CanActivate {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly userService: UserService,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const authHeader = request.headers['authorization'];\n    if (!authHeader) throw new UnauthorizedException('Token mancante.');\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) throw new UnauthorizedException('Formato token non valido.');\n\n    try {\n      let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n      try {\n        verification = getAccessiAccessTokenVerificationConfig(this.accessiOptions);\n      } catch {\n        throw new InternalServerErrorException('Chiave JWT non configurata.');\n      }\n      let payload: jwt.JwtPayload | string;\n      try {\n        payload = jwt.verify(token, verification.key, verification.verifyOptions);\n      } catch {\n        throw new UnauthorizedException('Token non valido o scaduto.');\n      }\n      const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\n      if (!codiceUtente) {\n        throw new UnauthorizedException('Token privo di un utente valido.');\n      }\n      if (await isAccessiTokenRevoked(this.accessiOptions, payload as Record<string, unknown>, codiceUtente)) {\n        throw new UnauthorizedException('Sessione revocata.');\n      }\n\n      const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n      if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(payload, currentUser)) {\n        throw new UnauthorizedException('Utente non piu autorizzato.');\n      }\n\n      request.user = buildAuthenticatedTokenPayload(payload, currentUser);\n      return true;\n    } catch (error) {\n      if (error instanceof InternalServerErrorException || error instanceof UnauthorizedException) {\n        throw error;\n      }\n      throw new InternalServerErrorException('Errore durante la verifica dell utente.');\n    }\n  }\n}\n"]}
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AAExB,qEAAkE;AAClE,uEAMwC;AACxC,iEAAwG;AACxG,qEAAsE;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,IAAI,YAAwE,CAAC;gBAC7E,IAAI,CAAC;oBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC9E,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,OAAgB,CAAC;gBACrB,IAAI,CAAC;oBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,KAAK,EAAE,YAAY,CAAC,CAAC;gBAClD,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;oBACvG,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;gBACxD,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,yCAAyC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAlDY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CAkD1B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  Inject,\n  Injectable,\n  InternalServerErrorException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { UserService } from '../Services/UserService/UserService';\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from '../security/authenticatedToken';\nimport { getAccessiAccessTokenVerificationConfig, verifyAccessiJwt } from '../security/jwtTokenOptions';\nimport { isAccessiTokenRevoked } from '../security/sessionRevocation';\n\n@Injectable()\nexport class JwtSimpleGuard implements CanActivate {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly userService: UserService,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const authHeader = request.headers['authorization'];\n    if (!authHeader) throw new UnauthorizedException('Token mancante.');\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) throw new UnauthorizedException('Formato token non valido.');\n\n    try {\n      let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n      try {\n        verification = getAccessiAccessTokenVerificationConfig(this.accessiOptions);\n      } catch {\n        throw new InternalServerErrorException('Chiave JWT non configurata.');\n      }\n      let payload: unknown;\n      try {\n        payload = verifyAccessiJwt(token, verification);\n      } catch {\n        throw new UnauthorizedException('Token non valido o scaduto.');\n      }\n      const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\n      if (!codiceUtente) {\n        throw new UnauthorizedException('Token privo di un utente valido.');\n      }\n      if (await isAccessiTokenRevoked(this.accessiOptions, payload as Record<string, unknown>, codiceUtente)) {\n        throw new UnauthorizedException('Sessione revocata.');\n      }\n\n      const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n      if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(payload, currentUser)) {\n        throw new UnauthorizedException('Utente non piu autorizzato.');\n      }\n\n      request.user = buildAuthenticatedTokenPayload(payload, currentUser);\n      return true;\n    } catch (error) {\n      if (error instanceof InternalServerErrorException || error instanceof UnauthorizedException) {\n        throw error;\n      }\n      throw new InternalServerErrorException('Errore durante la verifica dell utente.');\n    }\n  }\n}\n"]}

package/dist/accessi-module/middleware/authenticateGen.js

@@ -1,43 +1,10 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
@@ -59,7 +26,6 @@ exports.beginAccessiAuthInitialization = beginAccessiAuthInitialization;
 exports.setAccessiAuthService = setAccessiAuthService;
 exports.failAccessiAuthInitialization = failAccessiAuthInitialization;
 exports.authorizeAccessi = authorizeAccessi;
-const jwt = __importStar(require("jsonwebtoken"));
 const common_1 = require("@nestjs/common");
 const PermissionService_1 = require("../Services/PermissionService/PermissionService");
 const UserService_1 = require("../Services/UserService/UserService");
@@ -152,7 +118,7 @@ function authorizeWithDependencies(req, res, next, options, accessiOptions, perm
             }
             let decoded;
             try {
-                decoded = jwt.verify(token, verification.key, verification.verifyOptions);
+                decoded = (0, jwtTokenOptions_1.verifyAccessiJwt)(token, verification);
             }
             catch (_b) {
                 throw authError(401, "AUTH_TOKEN_INVALID", "Invalid JWT token");

package/dist/accessi-module/middleware/authenticateGen.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyRA,wEAIC;AAGD,sDAOC;AAGD,sEAKC;AA4DD,4CAiCC;AA3YD,kDAAoC;AACpC,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAMwC;AACxC,iEAAsF;AACtF,qEAAsE;AAEtE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,GAAa,EAAE,OAA4B;IAC1E,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;YACrB,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,sCAAsC,CAAC;IAE/C,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,sEAAsE;QACtE,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;QAOxB,MAAM,oBAAoB,GAAG,GAA2B,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,IAAI,YAAwE,CAAC;YAC7E,IAAI,CAAC;gBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,cAAc,CAAC,CAAC;YACzE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,gCAAgC,CAAC,CAAC;YACpF,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5E,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBAClG,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,oBAAoB,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5D,CAAC;YAED,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CAAA;AAIM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEL;;;OAGG;IACG,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA5BY,wDAAsB;iCAAtB,sBAAsB;IAFlC,IAAA,mBAAU,GAAE;IACb,gFAAgF;;IAG3E,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CA4BlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED;;;;;;GAMG;AACH,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,IAAI,GAAG,4BAA4B;gBACvC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,8BAA8B,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,CAAC;gBACb,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,sCAAsC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAED,mIAAmI;AACtH,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\nimport * as jwt from \"jsonwebtoken\";\nimport { Inject, Injectable } from \"@nestjs/common\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\nimport { UserService } from \"../Services/UserService/UserService\";\nimport { Logger } from \"../../Logger\";\nimport {\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  GrantsResult,\n  RequirementEvaluationError,\n  buildRequirementTree,\n  evaluateRequirement,\n} from \"./accessiRequirements\";\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../security/authenticatedToken\";\nimport { getAccessiAccessTokenVerificationConfig } from \"../security/jwtTokenOptions\";\nimport { isAccessiTokenRevoked } from \"../security/sessionRevocation\";\n\nconst logger = new Logger(\"AuthenticateGen\");\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\n\ntype Deferred<T> = {\n  promise: Promise<T>;\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n};\n\nclass AuthMiddlewareError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n    public readonly details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = \"AuthMiddlewareError\";\n  }\n}\n\nfunction authError(\n  status: number,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>\n) {\n  return new AuthMiddlewareError(status, code, message, details);\n}\n\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\n  if (error instanceof AuthMiddlewareError) return error;\n  if (error instanceof RequirementEvaluationError) {\n    return authError(500, error.code, error.message);\n  }\n  if (error instanceof Error) {\n    return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\n      originalError: error.name,\n    });\n  }\n  return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\n}\n\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\n  const payload = {\n    code: authErr.code,\n    status: authErr.status,\n    message: authErr.message,\n    details: authErr.details,\n    method: req.method,\n    path: req.originalUrl ?? req.url,\n    ip: req.ip,\n  };\n\n  const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\n  if (authErr.status >= 500) logger.error(message);\n  else logger.warning(message);\n}\n\n/** Sends the documented Accessi error contract from Express middleware. */\nfunction sendAuthenticationError(res: Response, authErr: AuthMiddlewareError): Response {\n  const message =\n    authErr.status === 403\n      ? 'Operazione non autorizzata.'\n      : authErr.status >= 500\n        ? 'Errore interno del modulo Accessi.'\n        : 'Autenticazione non valida o scaduta.';\n\n  return res.status(authErr.status).json({\n    severity: 'error',\n    status: authErr.status,\n    statusCode: 2,\n    code: authErr.code,\n    // Kept for callers of older versions which already inspected `error`.\n    error: authErr.code,\n    message,\n  });\n}\n\nasync function authorizeWithDependencies(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options: AccessiAuthorizationOptions | undefined,\n  accessiOptions: AccessiOptions,\n  permissionService: PermissionService,\n  userService: UserService\n) {\n  type AuthenticatedRequest = Request & {\n    userGrants?: unknown;\n    user?: unknown;\n    data?: unknown;\n  };\n  const authenticatedRequest = req as AuthenticatedRequest;\n\n  try {\n    const authHeader = req.headers.authorization;\n    if (!authHeader) {\n      throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\n    }\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) {\n      throw authError(\n        401,\n        \"AUTH_TOKEN_MISSING\",\n        \"Token not found in Authorization header\"\n      );\n    }\n\n    let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n    try {\n      verification = getAccessiAccessTokenVerificationConfig(accessiOptions);\n    } catch {\n      throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT signing key not configured\");\n    }\n\n    let decoded: unknown;\n    try {\n      decoded = jwt.verify(token, verification.key, verification.verifyOptions);\n    } catch {\n      throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n    if (!codiceUtente) {\n      throw authError(\n        401,\n        \"AUTH_USER_CODE_MISSING\",\n        \"codiceUtente not found in token payload\"\n      );\n    }\n    if (await isAccessiTokenRevoked(accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n      throw authError(401, \"AUTH_TOKEN_REVOKED\", \"Session revoked\");\n    }\n\n    const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw authError(\n        401,\n        \"AUTH_USER_DISABLED\",\n        \"User is no longer authorized\"\n      );\n    }\n\n    const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\n\n    const requirementTree = buildRequirementTree(options);\n    if (requirementTree) {\n      if (!accessiOptions?.databaseOptions) {\n        throw authError(\n          500,\n          \"AUTH_DATABASE_OPTIONS_MISSING\",\n          \"Database options not configured\"\n        );\n      }\n\n      let grantsResultCache: GrantsResult | null = null;\n      const getGrantsResult = async () => {\n        if (!grantsResultCache) {\n          grantsResultCache = await permissionService.getUserRolesAndGrants(\n            codiceUtente\n          );\n        }\n        return grantsResultCache;\n      };\n\n      const requirementContext: AccessiCustomRequirementContext = {\n        req,\n        decodedToken: authenticatedPayload,\n        userCode: codiceUtente,\n        getGrantsResult,\n      };\n\n      const hasPermissions = await evaluateRequirement(\n        requirementTree,\n        requirementContext,\n        options\n      );\n\n      if (!hasPermissions) {\n        throw authError(\n          403,\n          \"AUTH_INSUFFICIENT_PERMISSIONS\",\n          \"User does not have required permissions\"\n        );\n      }\n\n      authenticatedRequest.userGrants = await getGrantsResult();\n    }\n\n    authenticatedRequest.user = authenticatedPayload;\n    authenticatedRequest.data = authenticatedPayload;\n    return next();\n  } catch (error: unknown) {\n    const authErr = normalizeAuthError(error);\n    logAuthFailure(req, authErr);\n    return sendAuthenticationError(res, authErr);\n  }\n}\n\n@Injectable()\n/** Nest service behind the Express-compatible `authorizeAccessi` middleware. */\nexport class AuthenticateGenService {\n  constructor(\n    @Inject(\"ACCESSI_OPTIONS\")\n    private readonly accessiOptions: AccessiOptions,\n    private readonly permissionService: PermissionService,\n    private readonly userService: UserService\n  ) { }\n\n  /**\n   * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.\n   * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.\n   */\n  async authorize(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    options?: AccessiAuthorizationOptions\n  ) {\n    return authorizeWithDependencies(\n      req,\n      res,\n      next,\n      options,\n      this.accessiOptions,\n      this.permissionService,\n      this.userService\n    );\n  }\n}\n\nlet authenticateGenServiceRef: AuthenticateGenService | null = null;\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> | null = null;\n\nfunction createDeferred<T>(): Deferred<T> {\n  let resolve!: (value: T) => void;\n  let reject!: (reason?: unknown) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej;\n  });\n  return { promise, resolve, reject };\n}\n\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\n  return Boolean(\n    value &&\n    typeof (value as { authorize?: unknown }).authorize === \"function\"\n  );\n}\n\n/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */\nexport function beginAccessiAuthInitialization() {\n  if (!authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\n  }\n}\n\n/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */\nexport function setAccessiAuthService(service: AuthenticateGenService) {\n  authenticateGenServiceRef = service;\n  (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.resolve(service);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\n/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */\nexport function failAccessiAuthInitialization(error: unknown) {\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.reject(error);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService | null {\n  const appLocalsService = (req.app?.locals as Record<string, unknown> | undefined)?.[\n    ACCESSI_AUTH_SERVICE_LOCALS_KEY\n  ];\n\n  if (isAuthenticateGenService(appLocalsService)) {\n    return appLocalsService as AuthenticateGenService;\n  }\n\n  const globalService = (globalThis as Record<symbol, unknown>)[\n    ACCESSI_AUTH_SERVICE_GLOBAL_KEY\n  ];\n  if (isAuthenticateGenService(globalService)) {\n    return globalService as AuthenticateGenService;\n  }\n\n  return authenticateGenServiceRef;\n}\n\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService | null> {\n  if (!authServiceBootstrapDeferred) {\n    return null;\n  }\n\n  const bootstrapPromise = authServiceBootstrapDeferred.promise;\n  const timeoutPromise = new Promise<null>((resolve) => {\n    setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\n  });\n\n  try {\n    const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\n    return isAuthenticateGenService(resolved) ? resolved : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService | null> {\n  const immediateService = getAccessiAuthServiceFromRequest(req);\n  if (immediateService) {\n    return immediateService;\n  }\n\n  const bootstrappedService = await waitForBootstrappedService();\n  if (bootstrappedService) {\n    return bootstrappedService;\n  }\n\n  return getAccessiAuthServiceFromRequest(req);\n}\n\n/**\n * Middleware Express pubblico di Accessi.\n *\n * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente\n * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente\n * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.\n */\nexport async function authorizeAccessi(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options?: AccessiAuthorizationOptions\n) {\n  const authService = await resolveAccessiAuthService(req);\n\n  if (!authService) {\n    const status = authServiceBootstrapDeferred ? 503 : 500;\n    const code = authServiceBootstrapDeferred\n      ? 'ACCESSI_AUTH_INITIALIZING'\n      : 'ACCESSI_AUTH_NOT_INITIALIZED';\n    logger.error(\n      `Authentication service not initialized ${JSON.stringify({\n        method: req.method,\n        path: req.originalUrl ?? req.url,\n        status,\n      })}`\n    );\n    return res.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: 2,\n      code,\n      error: code,\n      message: status === 503\n        ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'\n        : 'Il modulo Accessi non e disponibile.',\n    });\n  }\n\n  return authService.authorize(req, res, next, options);\n}\n\n/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */\nexport const authenticateGen = authorizeAccessi;\n"]}
+{"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwRA,wEAIC;AAGD,sDAOC;AAGD,sEAKC;AA4DD,4CAiCC;AA1YD,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAMwC;AACxC,iEAAwG;AACxG,qEAAsE;AAEtE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,GAAa,EAAE,OAA4B;IAC1E,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;YACrB,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,sCAAsC,CAAC;IAE/C,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,sEAAsE;QACtE,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;QAOxB,MAAM,oBAAoB,GAAG,GAA2B,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,IAAI,YAAwE,CAAC;YAC7E,IAAI,CAAC;gBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,cAAc,CAAC,CAAC;YACzE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,gCAAgC,CAAC,CAAC;YACpF,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAClD,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBAClG,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,oBAAoB,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5D,CAAC;YAED,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CAAA;AAIM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEL;;;OAGG;IACG,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA5BY,wDAAsB;iCAAtB,sBAAsB;IAFlC,IAAA,mBAAU,GAAE;IACb,gFAAgF;;IAG3E,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CA4BlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED;;;;;;GAMG;AACH,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,IAAI,GAAG,4BAA4B;gBACvC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,8BAA8B,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,CAAC;gBACb,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,sCAAsC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAED,mIAAmI;AACtH,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\nimport { Inject, Injectable } from \"@nestjs/common\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\nimport { UserService } from \"../Services/UserService/UserService\";\nimport { Logger } from \"../../Logger\";\nimport {\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  GrantsResult,\n  RequirementEvaluationError,\n  buildRequirementTree,\n  evaluateRequirement,\n} from \"./accessiRequirements\";\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../security/authenticatedToken\";\nimport { getAccessiAccessTokenVerificationConfig, verifyAccessiJwt } from \"../security/jwtTokenOptions\";\nimport { isAccessiTokenRevoked } from \"../security/sessionRevocation\";\n\nconst logger = new Logger(\"AuthenticateGen\");\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\n\ntype Deferred<T> = {\n  promise: Promise<T>;\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n};\n\nclass AuthMiddlewareError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n    public readonly details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = \"AuthMiddlewareError\";\n  }\n}\n\nfunction authError(\n  status: number,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>\n) {\n  return new AuthMiddlewareError(status, code, message, details);\n}\n\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\n  if (error instanceof AuthMiddlewareError) return error;\n  if (error instanceof RequirementEvaluationError) {\n    return authError(500, error.code, error.message);\n  }\n  if (error instanceof Error) {\n    return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\n      originalError: error.name,\n    });\n  }\n  return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\n}\n\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\n  const payload = {\n    code: authErr.code,\n    status: authErr.status,\n    message: authErr.message,\n    details: authErr.details,\n    method: req.method,\n    path: req.originalUrl ?? req.url,\n    ip: req.ip,\n  };\n\n  const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\n  if (authErr.status >= 500) logger.error(message);\n  else logger.warning(message);\n}\n\n/** Sends the documented Accessi error contract from Express middleware. */\nfunction sendAuthenticationError(res: Response, authErr: AuthMiddlewareError): Response {\n  const message =\n    authErr.status === 403\n      ? 'Operazione non autorizzata.'\n      : authErr.status >= 500\n        ? 'Errore interno del modulo Accessi.'\n        : 'Autenticazione non valida o scaduta.';\n\n  return res.status(authErr.status).json({\n    severity: 'error',\n    status: authErr.status,\n    statusCode: 2,\n    code: authErr.code,\n    // Kept for callers of older versions which already inspected `error`.\n    error: authErr.code,\n    message,\n  });\n}\n\nasync function authorizeWithDependencies(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options: AccessiAuthorizationOptions | undefined,\n  accessiOptions: AccessiOptions,\n  permissionService: PermissionService,\n  userService: UserService\n) {\n  type AuthenticatedRequest = Request & {\n    userGrants?: unknown;\n    user?: unknown;\n    data?: unknown;\n  };\n  const authenticatedRequest = req as AuthenticatedRequest;\n\n  try {\n    const authHeader = req.headers.authorization;\n    if (!authHeader) {\n      throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\n    }\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) {\n      throw authError(\n        401,\n        \"AUTH_TOKEN_MISSING\",\n        \"Token not found in Authorization header\"\n      );\n    }\n\n    let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n    try {\n      verification = getAccessiAccessTokenVerificationConfig(accessiOptions);\n    } catch {\n      throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT signing key not configured\");\n    }\n\n    let decoded: unknown;\n    try {\n      decoded = verifyAccessiJwt(token, verification);\n    } catch {\n      throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n    if (!codiceUtente) {\n      throw authError(\n        401,\n        \"AUTH_USER_CODE_MISSING\",\n        \"codiceUtente not found in token payload\"\n      );\n    }\n    if (await isAccessiTokenRevoked(accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n      throw authError(401, \"AUTH_TOKEN_REVOKED\", \"Session revoked\");\n    }\n\n    const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw authError(\n        401,\n        \"AUTH_USER_DISABLED\",\n        \"User is no longer authorized\"\n      );\n    }\n\n    const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\n\n    const requirementTree = buildRequirementTree(options);\n    if (requirementTree) {\n      if (!accessiOptions?.databaseOptions) {\n        throw authError(\n          500,\n          \"AUTH_DATABASE_OPTIONS_MISSING\",\n          \"Database options not configured\"\n        );\n      }\n\n      let grantsResultCache: GrantsResult | null = null;\n      const getGrantsResult = async () => {\n        if (!grantsResultCache) {\n          grantsResultCache = await permissionService.getUserRolesAndGrants(\n            codiceUtente\n          );\n        }\n        return grantsResultCache;\n      };\n\n      const requirementContext: AccessiCustomRequirementContext = {\n        req,\n        decodedToken: authenticatedPayload,\n        userCode: codiceUtente,\n        getGrantsResult,\n      };\n\n      const hasPermissions = await evaluateRequirement(\n        requirementTree,\n        requirementContext,\n        options\n      );\n\n      if (!hasPermissions) {\n        throw authError(\n          403,\n          \"AUTH_INSUFFICIENT_PERMISSIONS\",\n          \"User does not have required permissions\"\n        );\n      }\n\n      authenticatedRequest.userGrants = await getGrantsResult();\n    }\n\n    authenticatedRequest.user = authenticatedPayload;\n    authenticatedRequest.data = authenticatedPayload;\n    return next();\n  } catch (error: unknown) {\n    const authErr = normalizeAuthError(error);\n    logAuthFailure(req, authErr);\n    return sendAuthenticationError(res, authErr);\n  }\n}\n\n@Injectable()\n/** Nest service behind the Express-compatible `authorizeAccessi` middleware. */\nexport class AuthenticateGenService {\n  constructor(\n    @Inject(\"ACCESSI_OPTIONS\")\n    private readonly accessiOptions: AccessiOptions,\n    private readonly permissionService: PermissionService,\n    private readonly userService: UserService\n  ) { }\n\n  /**\n   * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.\n   * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.\n   */\n  async authorize(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    options?: AccessiAuthorizationOptions\n  ) {\n    return authorizeWithDependencies(\n      req,\n      res,\n      next,\n      options,\n      this.accessiOptions,\n      this.permissionService,\n      this.userService\n    );\n  }\n}\n\nlet authenticateGenServiceRef: AuthenticateGenService | null = null;\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> | null = null;\n\nfunction createDeferred<T>(): Deferred<T> {\n  let resolve!: (value: T) => void;\n  let reject!: (reason?: unknown) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej;\n  });\n  return { promise, resolve, reject };\n}\n\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\n  return Boolean(\n    value &&\n    typeof (value as { authorize?: unknown }).authorize === \"function\"\n  );\n}\n\n/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */\nexport function beginAccessiAuthInitialization() {\n  if (!authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\n  }\n}\n\n/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */\nexport function setAccessiAuthService(service: AuthenticateGenService) {\n  authenticateGenServiceRef = service;\n  (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.resolve(service);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\n/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */\nexport function failAccessiAuthInitialization(error: unknown) {\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.reject(error);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService | null {\n  const appLocalsService = (req.app?.locals as Record<string, unknown> | undefined)?.[\n    ACCESSI_AUTH_SERVICE_LOCALS_KEY\n  ];\n\n  if (isAuthenticateGenService(appLocalsService)) {\n    return appLocalsService as AuthenticateGenService;\n  }\n\n  const globalService = (globalThis as Record<symbol, unknown>)[\n    ACCESSI_AUTH_SERVICE_GLOBAL_KEY\n  ];\n  if (isAuthenticateGenService(globalService)) {\n    return globalService as AuthenticateGenService;\n  }\n\n  return authenticateGenServiceRef;\n}\n\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService | null> {\n  if (!authServiceBootstrapDeferred) {\n    return null;\n  }\n\n  const bootstrapPromise = authServiceBootstrapDeferred.promise;\n  const timeoutPromise = new Promise<null>((resolve) => {\n    setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\n  });\n\n  try {\n    const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\n    return isAuthenticateGenService(resolved) ? resolved : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService | null> {\n  const immediateService = getAccessiAuthServiceFromRequest(req);\n  if (immediateService) {\n    return immediateService;\n  }\n\n  const bootstrappedService = await waitForBootstrappedService();\n  if (bootstrappedService) {\n    return bootstrappedService;\n  }\n\n  return getAccessiAuthServiceFromRequest(req);\n}\n\n/**\n * Middleware Express pubblico di Accessi.\n *\n * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente\n * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente\n * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.\n */\nexport async function authorizeAccessi(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options?: AccessiAuthorizationOptions\n) {\n  const authService = await resolveAccessiAuthService(req);\n\n  if (!authService) {\n    const status = authServiceBootstrapDeferred ? 503 : 500;\n    const code = authServiceBootstrapDeferred\n      ? 'ACCESSI_AUTH_INITIALIZING'\n      : 'ACCESSI_AUTH_NOT_INITIALIZED';\n    logger.error(\n      `Authentication service not initialized ${JSON.stringify({\n        method: req.method,\n        path: req.originalUrl ?? req.url,\n        status,\n      })}`\n    );\n    return res.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: 2,\n      code,\n      error: code,\n      message: status === 503\n        ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'\n        : 'Il modulo Accessi non e disponibile.',\n    });\n  }\n\n  return authService.authorize(req, res, next, options);\n}\n\n/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */\nexport const authenticateGen = authorizeAccessi;\n"]}

package/dist/accessi-module/security/jwtTokenOptions.d.ts

@@ -1,22 +1,57 @@
-import type * as jwt from "jsonwebtoken";
+import * as jwt from "jsonwebtoken";
 import type { AccessiOptions } from "../AccessiModule";
+import type { AccessiJwtPurpose } from "./passwordResetToken";
 /** Algoritmi supportati per gli access token Accessi. */
 export type AccessiAccessTokenAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512";
+/**
+ * Evento emesso quando un token presenta un `kid` che non appartiene né alla
+ * chiave corrente né alle chiavi precedenti configurate.
+ *
+ * Serve per collegare un alert operativo (log, metrica, webhook) senza
+ * accoppiare il modulo a uno specifico sistema di monitoraggio.
+ */
+export interface AccessiUnknownKeyIdEvent {
+    keyId: string;
+    algorithm?: string;
+    /** `access` o `refresh`, per distinguere i token coinvolti. */
+    purpose: AccessiJwtPurpose;
+}
+/** Configurazione di verifica con chiave corrente, chiavi precedenti e alert. */
+export interface AccessiJwtVerificationConfig {
+    /** Chiave corrente. Resta il campo principale per i consumer esistenti. */
+    key: jwt.Secret;
+    verifyOptions: jwt.VerifyOptions;
+    /** Chiavi indicizzate per `kid`: la corrente vince sulle precedenti. */
+    keysByKeyId: ReadonlyMap<string, jwt.Secret>;
+    /** Chiavi provate per i token legacy privi di `kid`, corrente per prima. */
+    fallbackKeys: readonly jwt.Secret[];
+    purpose: AccessiJwtPurpose;
+    onUnknownKeyId?: (event: AccessiUnknownKeyIdEvent) => void;
+}
+/**
+ * Chiavi da provare per un token.
+ *
+ * Un `kid` noto seleziona una sola chiave: non si ricade sulle altre, così un
+ * token con intestazione manomessa non viene verificato per tentativi.
+ */
+export declare function resolveAccessiVerificationKeys(config: AccessiJwtVerificationConfig, token: string): readonly jwt.Secret[];
+/**
+ * Verifica un JWT Accessi con la chiave corretta (corrente o precedente).
+ *
+ * Lancia l'errore di `jsonwebtoken` quando nessuna chiave candidata verifica il
+ * token; per un `kid` sconosciuto lancia un errore dedicato dopo aver emesso
+ * l'evento di alert.
+ */
+export declare function verifyAccessiJwt(token: string, config: AccessiJwtVerificationConfig): unknown;
 export declare function getAccessiAccessTokenSigningConfig(options: AccessiOptions): {
     key: jwt.Secret;
     algorithm: AccessiAccessTokenAlgorithm;
     signOptions: Pick<jwt.SignOptions, "issuer" | "audience" | "keyid">;
 };
-export declare function getAccessiAccessTokenVerificationConfig(options: AccessiOptions): {
-    key: jwt.Secret;
-    verifyOptions: jwt.VerifyOptions;
-};
+export declare function getAccessiAccessTokenVerificationConfig(options: AccessiOptions): AccessiJwtVerificationConfig;
 export declare function getAccessiRefreshTokenSigningConfig(options: AccessiOptions): {
     key: jwt.Secret;
     algorithm: AccessiAccessTokenAlgorithm;
     signOptions: Pick<jwt.SignOptions, "issuer" | "audience" | "keyid">;
 };
-export declare function getAccessiRefreshTokenVerificationConfig(options: AccessiOptions): {
-    key: jwt.Secret;
-    verifyOptions: jwt.VerifyOptions;
-};
+export declare function getAccessiRefreshTokenVerificationConfig(options: AccessiOptions): AccessiJwtVerificationConfig;

package/dist/accessi-module/security/jwtTokenOptions.js

@@ -1,9 +1,45 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAccessiVerificationKeys = resolveAccessiVerificationKeys;
+exports.verifyAccessiJwt = verifyAccessiJwt;
 exports.getAccessiAccessTokenSigningConfig = getAccessiAccessTokenSigningConfig;
 exports.getAccessiAccessTokenVerificationConfig = getAccessiAccessTokenVerificationConfig;
 exports.getAccessiRefreshTokenSigningConfig = getAccessiRefreshTokenSigningConfig;
 exports.getAccessiRefreshTokenVerificationConfig = getAccessiRefreshTokenVerificationConfig;
+const jwt = __importStar(require("jsonwebtoken"));
 const passwordResetToken_1 = require("./passwordResetToken");
 function resolveAlgorithm(options) {
     var _a;
@@ -26,9 +62,16 @@ function getTokenSigningConfig(options, purpose) {
             : {})), (options.jwtOptions.keyId ? { keyid: options.jwtOptions.keyId } : {})),
     };
 }
-/** Configurazione di verifica: chiave pubblica per RS/ES, segreto derivato per HS. */
+/**
+ * Configurazione di verifica.
+ *
+ * Con algoritmi asimmetrici accetta anche le chiavi precedenti: un token
+ * firmato prima di una rotazione resta valido finché la sua chiave pubblica
+ * compare in `previousPublicKeys`. I token legacy senza `kid` vengono provati
+ * su tutte le chiavi candidate, la corrente per prima.
+ */
 function getTokenVerificationConfig(options, purpose) {
-    var _a;
+    var _a, _b, _c;
     const algorithm = resolveAlgorithm(options);
     const key = algorithm.startsWith("HS")
         ? (0, passwordResetToken_1.getAccessiJwtSecret)(options, purpose)
@@ -36,12 +79,80 @@ function getTokenVerificationConfig(options, purpose) {
     if (!key) {
         throw new Error(`jwtOptions.publicKey e obbligatoria per verificare token ${algorithm}.`);
     }
-    return {
-        key,
-        verifyOptions: Object.assign(Object.assign({ algorithms: [algorithm] }, (options.jwtOptions.issuer ? { issuer: options.jwtOptions.issuer } : {})), (options.jwtOptions.audience
+    const algorithms = new Set([algorithm]);
+    const keysByKeyId = new Map();
+    const fallbackKeys = [key];
+    if (options.jwtOptions.keyId) {
+        keysByKeyId.set(options.jwtOptions.keyId, key);
+    }
+    if (!algorithm.startsWith("HS")) {
+        for (const previous of (_b = options.jwtOptions.previousPublicKeys) !== null && _b !== void 0 ? _b : []) {
+            const previousAlgorithm = (_c = previous.algorithm) !== null && _c !== void 0 ? _c : algorithm;
+            algorithms.add(previousAlgorithm);
+            fallbackKeys.push(previous.publicKey);
+            if (previous.keyId && !keysByKeyId.has(previous.keyId)) {
+                keysByKeyId.set(previous.keyId, previous.publicKey);
+            }
+        }
+    }
+    return Object.assign({ key, verifyOptions: Object.assign(Object.assign({ algorithms: [...algorithms] }, (options.jwtOptions.issuer ? { issuer: options.jwtOptions.issuer } : {})), (options.jwtOptions.audience
             ? { audience: options.jwtOptions.audience }
-            : {})),
-    };
+            : {})), keysByKeyId,
+        fallbackKeys,
+        purpose }, (options.jwtOptions.onUnknownKeyId
+        ? { onUnknownKeyId: options.jwtOptions.onUnknownKeyId }
+        : {}));
+}
+function readTokenHeader(token) {
+    const decoded = jwt.decode(token, { complete: true });
+    if (!decoded || typeof decoded === "string" || !decoded.header)
+        return {};
+    const header = decoded.header;
+    return Object.assign(Object.assign({}, (typeof header.kid === "string" && header.kid !== "" ? { keyId: header.kid } : {})), (typeof header.alg === "string" ? { algorithm: header.alg } : {}));
+}
+/**
+ * Chiavi da provare per un token.
+ *
+ * Un `kid` noto seleziona una sola chiave: non si ricade sulle altre, così un
+ * token con intestazione manomessa non viene verificato per tentativi.
+ */
+function resolveAccessiVerificationKeys(config, token) {
+    var _a, _b;
+    const header = readTokenHeader(token);
+    // Con HMAC il kid non partecipa alla crittografia: un kid cambiato non deve
+    // invalidare token firmati con lo stesso segreto.
+    const hmacOnly = ((_a = config.verifyOptions.algorithms) !== null && _a !== void 0 ? _a : []).every((algorithm) => String(algorithm).startsWith("HS"));
+    if (!header.keyId || hmacOnly)
+        return config.fallbackKeys;
+    const key = config.keysByKeyId.get(header.keyId);
+    if (key)
+        return [key];
+    (_b = config.onUnknownKeyId) === null || _b === void 0 ? void 0 : _b.call(config, Object.assign(Object.assign({ keyId: header.keyId }, (header.algorithm ? { algorithm: header.algorithm } : {})), { purpose: config.purpose }));
+    return [];
+}
+/**
+ * Verifica un JWT Accessi con la chiave corretta (corrente o precedente).
+ *
+ * Lancia l'errore di `jsonwebtoken` quando nessuna chiave candidata verifica il
+ * token; per un `kid` sconosciuto lancia un errore dedicato dopo aver emesso
+ * l'evento di alert.
+ */
+function verifyAccessiJwt(token, config) {
+    const keys = resolveAccessiVerificationKeys(config, token);
+    if (keys.length === 0) {
+        const { keyId } = readTokenHeader(token);
+        throw new Error(`Chiave JWT sconosciuta per kid "${keyId !== null && keyId !== void 0 ? keyId : "assente"}".`);
+    }
+    let lastError;
+    for (const key of keys) {
+        try {
+            return jwt.verify(token, key, config.verifyOptions);
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError instanceof Error ? lastError : new Error("Token JWT non valido.");
 }
 function getAccessiAccessTokenSigningConfig(options) {
     return getTokenSigningConfig(options, "access");

package/dist/accessi-module/security/jwtTokenOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwtTokenOptions.js","sourceRoot":"","sources":["../../../src/accessi-module/security/jwtTokenOptions.ts"],"names":[],"mappings":";;AAmFA,gFAEC;AAED,0FAEC;AAED,kFAEC;AAED,4FAEC;AA/FD,6DAA2D;AAe3D,SAAS,gBAAgB,CAAC,OAAuB;;IAC/C,OAAO,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC;AACjD,CAAC;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAC5B,OAAuB,EACvB,OAA0B;IAM1B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,CAAC,CAAC,IAAA,wCAAmB,EAAC,OAAO,EAAE,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;IAElC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,wDAAwD,SAAS,GAAG,CAAC,CAAC;IACxF,CAAC;IAED,OAAO;QACL,GAAG;QACH,SAAS;QACT,WAAW,gDACN,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAuC,EAAE;YAC1E,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzE;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,0BAA0B,CACjC,OAAuB,EACvB,OAA0B;;IAK1B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,CAAC,CAAC,IAAA,wCAAmB,EAAC,OAAO,EAAE,OAAO,CAAC;QACvC,CAAC,CAAC,CAAC,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG;QACH,aAAa,gCACX,UAAU,EAAE,CAAC,SAAS,CAAC,IACpB,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAyC,EAAE;YAC5E,CAAC,CAAC,EAAE,CAAC,CACR;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,kCAAkC,CAAC,OAAuB;IACxE,OAAO,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,uCAAuC,CAAC,OAAuB;IAC7E,OAAO,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,mCAAmC,CAAC,OAAuB;IACzE,OAAO,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,SAAgB,wCAAwC,CAAC,OAAuB;IAC9E,OAAO,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC","sourcesContent":["import type * as jwt from \"jsonwebtoken\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { getAccessiJwtSecret } from \"./passwordResetToken\";\nimport type { AccessiJwtPurpose } from \"./passwordResetToken\";\n\n/** Algoritmi supportati per gli access token Accessi. */\nexport type AccessiAccessTokenAlgorithm =\n  | \"HS256\"\n  | \"HS384\"\n  | \"HS512\"\n  | \"RS256\"\n  | \"RS384\"\n  | \"RS512\"\n  | \"ES256\"\n  | \"ES384\"\n  | \"ES512\";\n\nfunction resolveAlgorithm(options: AccessiOptions): AccessiAccessTokenAlgorithm {\n  return options.jwtOptions.algorithm ?? \"HS256\";\n}\n\n/** Configurazione di firma: chiave, algoritmo e claim standard. */\nfunction getTokenSigningConfig(\n  options: AccessiOptions,\n  purpose: AccessiJwtPurpose,\n): {\n  key: jwt.Secret;\n  algorithm: AccessiAccessTokenAlgorithm;\n  signOptions: Pick<jwt.SignOptions, \"issuer\" | \"audience\" | \"keyid\">;\n} {\n  const algorithm = resolveAlgorithm(options);\n  const key = algorithm.startsWith(\"HS\")\n    ? getAccessiJwtSecret(options, purpose)\n    : options.jwtOptions.privateKey;\n\n  if (!key) {\n    throw new Error(`jwtOptions.privateKey e obbligatoria per l'algoritmo ${algorithm}.`);\n  }\n\n  return {\n    key,\n    algorithm,\n    signOptions: {\n      ...(options.jwtOptions.issuer ? { issuer: options.jwtOptions.issuer } : {}),\n      ...(options.jwtOptions.audience\n        ? { audience: options.jwtOptions.audience as jwt.SignOptions[\"audience\"] }\n        : {}),\n      ...(options.jwtOptions.keyId ? { keyid: options.jwtOptions.keyId } : {}),\n    },\n  };\n}\n\n/** Configurazione di verifica: chiave pubblica per RS/ES, segreto derivato per HS. */\nfunction getTokenVerificationConfig(\n  options: AccessiOptions,\n  purpose: AccessiJwtPurpose,\n): {\n  key: jwt.Secret;\n  verifyOptions: jwt.VerifyOptions;\n} {\n  const algorithm = resolveAlgorithm(options);\n  const key = algorithm.startsWith(\"HS\")\n    ? getAccessiJwtSecret(options, purpose)\n    : (options.jwtOptions.publicKey ?? options.jwtOptions.privateKey);\n\n  if (!key) {\n    throw new Error(\n      `jwtOptions.publicKey e obbligatoria per verificare token ${algorithm}.`,\n    );\n  }\n\n  return {\n    key,\n    verifyOptions: {\n      algorithms: [algorithm],\n      ...(options.jwtOptions.issuer ? { issuer: options.jwtOptions.issuer } : {}),\n      ...(options.jwtOptions.audience\n        ? { audience: options.jwtOptions.audience as jwt.VerifyOptions[\"audience\"] }\n        : {}),\n    },\n  };\n}\n\nexport function getAccessiAccessTokenSigningConfig(options: AccessiOptions) {\n  return getTokenSigningConfig(options, \"access\");\n}\n\nexport function getAccessiAccessTokenVerificationConfig(options: AccessiOptions) {\n  return getTokenVerificationConfig(options, \"access\");\n}\n\nexport function getAccessiRefreshTokenSigningConfig(options: AccessiOptions) {\n  return getTokenSigningConfig(options, \"refresh\");\n}\n\nexport function getAccessiRefreshTokenVerificationConfig(options: AccessiOptions) {\n  return getTokenVerificationConfig(options, \"refresh\");\n}\n"]}
+{"version":3,"file":"jwtTokenOptions.js","sourceRoot":"","sources":["../../../src/accessi-module/security/jwtTokenOptions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2JA,wEAqBC;AASD,4CAiBC;AAED,gFAEC;AAED,0FAEC;AAED,kFAEC;AAED,4FAEC;AA1ND,kDAAoC;AAEpC,6DAA2D;AA0C3D,SAAS,gBAAgB,CAAC,OAAuB;;IAC/C,OAAO,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC;AACjD,CAAC;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAC5B,OAAuB,EACvB,OAA0B;IAM1B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,CAAC,CAAC,IAAA,wCAAmB,EAAC,OAAO,EAAE,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;IAElC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,wDAAwD,SAAS,GAAG,CAAC,CAAC;IACxF,CAAC;IAED,OAAO;QACL,GAAG;QACH,SAAS;QACT,WAAW,gDACN,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAuC,EAAE;YAC1E,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,0BAA0B,CACjC,OAAuB,EACvB,OAA0B;;IAE1B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,CAAC,CAAC,IAAA,wCAAmB,EAAC,OAAO,EAAE,OAAO,CAAC;QACvC,CAAC,CAAC,CAAC,MAAA,OAAO,CAAC,UAAU,CAAC,SAAS,mCAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IAClD,MAAM,YAAY,GAAiB,CAAC,GAAG,CAAC,CAAC;IAEzC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7B,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,QAAQ,IAAI,MAAA,OAAO,CAAC,UAAU,CAAC,kBAAkB,mCAAI,EAAE,EAAE,CAAC;YACnE,MAAM,iBAAiB,GAAG,MAAA,QAAQ,CAAC,SAAS,mCAAI,SAAS,CAAC;YAC1D,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAClC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvD,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBACE,GAAG,EACH,aAAa,gCACX,UAAU,EAAE,CAAC,GAAG,UAAU,CAAoB,IAC3C,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAyC,EAAE;YAC5E,CAAC,CAAC,EAAE,CAAC,GAET,WAAW;QACX,YAAY;QACZ,OAAO,IACJ,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc;QACnC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE;QACvD,CAAC,CAAC,EAAE,CAAC,EACP;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,MAA0C,CAAC;IAClE,uCACK,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClF,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACpE;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,8BAA8B,CAC5C,MAAoC,EACpC,KAAa;;IAEb,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,4EAA4E;IAC5E,kDAAkD;IAClD,MAAM,QAAQ,GAAG,CAAC,MAAA,MAAM,CAAC,aAAa,CAAC,UAAU,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3E,MAAM,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,QAAQ;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IAE1D,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAEtB,MAAA,MAAM,CAAC,cAAc,qFACnB,KAAK,EAAE,MAAM,CAAC,KAAK,IAChB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC5D,OAAO,EAAE,MAAM,CAAC,OAAO,IACvB,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,KAAa,EAAE,MAAoC;IAClF,MAAM,IAAI,GAAG,8BAA8B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,SAAS,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,SAAkB,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;AACpF,CAAC;AAED,SAAgB,kCAAkC,CAAC,OAAuB;IACxE,OAAO,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,uCAAuC,CAAC,OAAuB;IAC7E,OAAO,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,mCAAmC,CAAC,OAAuB;IACzE,OAAO,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,SAAgB,wCAAwC,CAAC,OAAuB;IAC9E,OAAO,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC","sourcesContent":["import * as jwt from \"jsonwebtoken\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { getAccessiJwtSecret } from \"./passwordResetToken\";\nimport type { AccessiJwtPurpose } from \"./passwordResetToken\";\n\n/** Algoritmi supportati per gli access token Accessi. */\nexport type AccessiAccessTokenAlgorithm =\n  | \"HS256\"\n  | \"HS384\"\n  | \"HS512\"\n  | \"RS256\"\n  | \"RS384\"\n  | \"RS512\"\n  | \"ES256\"\n  | \"ES384\"\n  | \"ES512\";\n\n/**\n * Evento emesso quando un token presenta un `kid` che non appartiene né alla\n * chiave corrente né alle chiavi precedenti configurate.\n *\n * Serve per collegare un alert operativo (log, metrica, webhook) senza\n * accoppiare il modulo a uno specifico sistema di monitoraggio.\n */\nexport interface AccessiUnknownKeyIdEvent {\n  keyId: string;\n  algorithm?: string;\n  /** `access` o `refresh`, per distinguere i token coinvolti. */\n  purpose: AccessiJwtPurpose;\n}\n\n/** Configurazione di verifica con chiave corrente, chiavi precedenti e alert. */\nexport interface AccessiJwtVerificationConfig {\n  /** Chiave corrente. Resta il campo principale per i consumer esistenti. */\n  key: jwt.Secret;\n  verifyOptions: jwt.VerifyOptions;\n  /** Chiavi indicizzate per `kid`: la corrente vince sulle precedenti. */\n  keysByKeyId: ReadonlyMap<string, jwt.Secret>;\n  /** Chiavi provate per i token legacy privi di `kid`, corrente per prima. */\n  fallbackKeys: readonly jwt.Secret[];\n  purpose: AccessiJwtPurpose;\n  onUnknownKeyId?: (event: AccessiUnknownKeyIdEvent) => void;\n}\n\nfunction resolveAlgorithm(options: AccessiOptions): AccessiAccessTokenAlgorithm {\n  return options.jwtOptions.algorithm ?? \"HS256\";\n}\n\n/** Configurazione di firma: chiave, algoritmo e claim standard. */\nfunction getTokenSigningConfig(\n  options: AccessiOptions,\n  purpose: AccessiJwtPurpose,\n): {\n  key: jwt.Secret;\n  algorithm: AccessiAccessTokenAlgorithm;\n  signOptions: Pick<jwt.SignOptions, \"issuer\" | \"audience\" | \"keyid\">;\n} {\n  const algorithm = resolveAlgorithm(options);\n  const key = algorithm.startsWith(\"HS\")\n    ? getAccessiJwtSecret(options, purpose)\n    : options.jwtOptions.privateKey;\n\n  if (!key) {\n    throw new Error(`jwtOptions.privateKey e obbligatoria per l'algoritmo ${algorithm}.`);\n  }\n\n  return {\n    key,\n    algorithm,\n    signOptions: {\n      ...(options.jwtOptions.issuer ? { issuer: options.jwtOptions.issuer } : {}),\n      ...(options.jwtOptions.audience\n        ? { audience: options.jwtOptions.audience as jwt.SignOptions[\"audience\"] }\n        : {}),\n      ...(options.jwtOptions.keyId ? { keyid: options.jwtOptions.keyId } : {}),\n    },\n  };\n}\n\n/**\n * Configurazione di verifica.\n *\n * Con algoritmi asimmetrici accetta anche le chiavi precedenti: un token\n * firmato prima di una rotazione resta valido finché la sua chiave pubblica\n * compare in `previousPublicKeys`. I token legacy senza `kid` vengono provati\n * su tutte le chiavi candidate, la corrente per prima.\n */\nfunction getTokenVerificationConfig(\n  options: AccessiOptions,\n  purpose: AccessiJwtPurpose,\n): AccessiJwtVerificationConfig {\n  const algorithm = resolveAlgorithm(options);\n  const key = algorithm.startsWith(\"HS\")\n    ? getAccessiJwtSecret(options, purpose)\n    : (options.jwtOptions.publicKey ?? options.jwtOptions.privateKey);\n\n  if (!key) {\n    throw new Error(\n      `jwtOptions.publicKey e obbligatoria per verificare token ${algorithm}.`,\n    );\n  }\n\n  const algorithms = new Set<string>([algorithm]);\n  const keysByKeyId = new Map<string, jwt.Secret>();\n  const fallbackKeys: jwt.Secret[] = [key];\n\n  if (options.jwtOptions.keyId) {\n    keysByKeyId.set(options.jwtOptions.keyId, key);\n  }\n\n  if (!algorithm.startsWith(\"HS\")) {\n    for (const previous of options.jwtOptions.previousPublicKeys ?? []) {\n      const previousAlgorithm = previous.algorithm ?? algorithm;\n      algorithms.add(previousAlgorithm);\n      fallbackKeys.push(previous.publicKey);\n      if (previous.keyId && !keysByKeyId.has(previous.keyId)) {\n        keysByKeyId.set(previous.keyId, previous.publicKey);\n      }\n    }\n  }\n\n  return {\n    key,\n    verifyOptions: {\n      algorithms: [...algorithms] as jwt.Algorithm[],\n      ...(options.jwtOptions.issuer ? { issuer: options.jwtOptions.issuer } : {}),\n      ...(options.jwtOptions.audience\n        ? { audience: options.jwtOptions.audience as jwt.VerifyOptions[\"audience\"] }\n        : {}),\n    },\n    keysByKeyId,\n    fallbackKeys,\n    purpose,\n    ...(options.jwtOptions.onUnknownKeyId\n      ? { onUnknownKeyId: options.jwtOptions.onUnknownKeyId }\n      : {}),\n  };\n}\n\nfunction readTokenHeader(token: string): { keyId?: string; algorithm?: string } {\n  const decoded = jwt.decode(token, { complete: true });\n  if (!decoded || typeof decoded === \"string\" || !decoded.header) return {};\n  const header = decoded.header as { kid?: unknown; alg?: unknown };\n  return {\n    ...(typeof header.kid === \"string\" && header.kid !== \"\" ? { keyId: header.kid } : {}),\n    ...(typeof header.alg === \"string\" ? { algorithm: header.alg } : {}),\n  };\n}\n\n/**\n * Chiavi da provare per un token.\n *\n * Un `kid` noto seleziona una sola chiave: non si ricade sulle altre, così un\n * token con intestazione manomessa non viene verificato per tentativi.\n */\nexport function resolveAccessiVerificationKeys(\n  config: AccessiJwtVerificationConfig,\n  token: string,\n): readonly jwt.Secret[] {\n  const header = readTokenHeader(token);\n  // Con HMAC il kid non partecipa alla crittografia: un kid cambiato non deve\n  // invalidare token firmati con lo stesso segreto.\n  const hmacOnly = (config.verifyOptions.algorithms ?? []).every((algorithm) =>\n    String(algorithm).startsWith(\"HS\"),\n  );\n  if (!header.keyId || hmacOnly) return config.fallbackKeys;\n\n  const key = config.keysByKeyId.get(header.keyId);\n  if (key) return [key];\n\n  config.onUnknownKeyId?.({\n    keyId: header.keyId,\n    ...(header.algorithm ? { algorithm: header.algorithm } : {}),\n    purpose: config.purpose,\n  });\n  return [];\n}\n\n/**\n * Verifica un JWT Accessi con la chiave corretta (corrente o precedente).\n *\n * Lancia l'errore di `jsonwebtoken` quando nessuna chiave candidata verifica il\n * token; per un `kid` sconosciuto lancia un errore dedicato dopo aver emesso\n * l'evento di alert.\n */\nexport function verifyAccessiJwt(token: string, config: AccessiJwtVerificationConfig): unknown {\n  const keys = resolveAccessiVerificationKeys(config, token);\n  if (keys.length === 0) {\n    const { keyId } = readTokenHeader(token);\n    throw new Error(`Chiave JWT sconosciuta per kid \"${keyId ?? \"assente\"}\".`);\n  }\n\n  let lastError: unknown;\n  for (const key of keys) {\n    try {\n      return jwt.verify(token, key, config.verifyOptions);\n    } catch (error) {\n      lastError = error;\n    }\n  }\n\n  throw lastError instanceof Error ? lastError : new Error(\"Token JWT non valido.\");\n}\n\nexport function getAccessiAccessTokenSigningConfig(options: AccessiOptions) {\n  return getTokenSigningConfig(options, \"access\");\n}\n\nexport function getAccessiAccessTokenVerificationConfig(options: AccessiOptions) {\n  return getTokenVerificationConfig(options, \"access\");\n}\n\nexport function getAccessiRefreshTokenSigningConfig(options: AccessiOptions) {\n  return getTokenSigningConfig(options, \"refresh\");\n}\n\nexport function getAccessiRefreshTokenVerificationConfig(options: AccessiOptions) {\n  return getTokenVerificationConfig(options, \"refresh\");\n}\n"]}

package/dist/accessi-module/security/validateOptions.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateAccessiOptions = validateAccessiOptions;
 exports.assertValidAccessiOptions = assertValidAccessiOptions;
+const crypto_1 = require("crypto");
 function isHttpUrl(value) {
     if (!value)
         return false;
@@ -24,7 +25,7 @@ function positive(value) {
  * comportamento storico.
  */
 function validateAccessiOptions(options) {
-    var _a, _b, _c, _d;
+    var _a, _b, _c, _d, _e;
     const errors = [];
     const warnings = [];
     const addError = (code, message) => errors.push({ code, message });
@@ -63,6 +64,32 @@ function validateAccessiOptions(options) {
             addWarning('ACCESSI_JWKS_PATH_DEFAULT', 'jwksPath non configurato: verra usato accessi/.well-known/jwks.json.');
         }
     }
+    const previousKeys = (_b = jwt === null || jwt === void 0 ? void 0 : jwt.previousPublicKeys) !== null && _b !== void 0 ? _b : [];
+    if (previousKeys.length > 0 && algorithm.startsWith('HS')) {
+        addWarning('ACCESSI_JWT_PREVIOUS_KEYS_WITH_HMAC', 'previousPublicKeys e configurato ma algorithm e HS*: le chiavi verranno ignorate.');
+    }
+    if (!algorithm.startsWith('HS') && previousKeys.length > 0) {
+        const knownKeyIds = new Set();
+        if (jwt === null || jwt === void 0 ? void 0 : jwt.keyId)
+            knownKeyIds.add(jwt.keyId);
+        previousKeys.forEach((previous, index) => {
+            try {
+                (0, crypto_1.createPublicKey)(previous.publicKey);
+            }
+            catch (_a) {
+                addError('ACCESSI_JWT_PREVIOUS_KEY_INVALID', `previousPublicKeys[${index}] non e una chiave pubblica PEM valida.`);
+            }
+            if (!previous.keyId) {
+                addWarning('ACCESSI_JWT_PREVIOUS_KEY_ID_MISSING', `previousPublicKeys[${index}] non ha keyId: verra usato il fingerprint della chiave.`);
+                return;
+            }
+            if (knownKeyIds.has(previous.keyId)) {
+                addWarning('ACCESSI_JWT_PREVIOUS_KEY_DUPLICATE_KID', `previousPublicKeys[${index}].keyId "${previous.keyId}" e duplicato: vince la chiave corrente.`);
+                return;
+            }
+            knownKeyIds.add(previous.keyId);
+        });
+    }
     if (!(jwt === null || jwt === void 0 ? void 0 : jwt.issuer)) {
         addWarning('ACCESSI_JWT_ISSUER_MISSING', 'jwtOptions.issuer e consigliato in multi-servizio.');
     }
@@ -84,10 +111,10 @@ function validateAccessiOptions(options) {
     if ((options === null || options === void 0 ? void 0 : options.publicBaseUrl) && !isHttpUrl(options.publicBaseUrl)) {
         addWarning('ACCESSI_PUBLIC_BASE_URL_INVALID', 'publicBaseUrl dovrebbe essere un URL http/https.');
     }
-    if (((_b = options === null || options === void 0 ? void 0 : options.publicAuthRateLimit) === null || _b === void 0 ? void 0 : _b.login) && !positive(options.publicAuthRateLimit.login.windowMs)) {
+    if (((_c = options === null || options === void 0 ? void 0 : options.publicAuthRateLimit) === null || _c === void 0 ? void 0 : _c.login) && !positive(options.publicAuthRateLimit.login.windowMs)) {
         addError('ACCESSI_RATE_LIMIT_WINDOW_INVALID', 'publicAuthRateLimit.login.windowMs deve essere positivo.');
     }
-    if (((_c = options === null || options === void 0 ? void 0 : options.publicAuthRateLimit) === null || _c === void 0 ? void 0 : _c.login) && !positive(options.publicAuthRateLimit.login.maxAttempts)) {
+    if (((_d = options === null || options === void 0 ? void 0 : options.publicAuthRateLimit) === null || _d === void 0 ? void 0 : _d.login) && !positive(options.publicAuthRateLimit.login.maxAttempts)) {
         addError('ACCESSI_RATE_LIMIT_ATTEMPTS_INVALID', 'publicAuthRateLimit.login.maxAttempts deve essere positivo.');
     }
     if (options === null || options === void 0 ? void 0 : options.edgeRateLimit) {
@@ -98,7 +125,7 @@ function validateAccessiOptions(options) {
             addError('ACCESSI_EDGE_RATE_LIMIT_ATTEMPTS_INVALID', 'edgeRateLimit.maxAttempts deve essere positivo.');
         }
     }
-    if (((_d = options === null || options === void 0 ? void 0 : options.consoleEntry) === null || _d === void 0 ? void 0 : _d.ttlMs) !== undefined && !positive(options.consoleEntry.ttlMs)) {
+    if (((_e = options === null || options === void 0 ? void 0 : options.consoleEntry) === null || _e === void 0 ? void 0 : _e.ttlMs) !== undefined && !positive(options.consoleEntry.ttlMs)) {
         addError('ACCESSI_CONSOLE_ENTRY_TTL_INVALID', 'consoleEntry.ttlMs deve essere positivo.');
     }
     return { errors, warnings };