npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.76 → 2.0.0-dev.77 - Mend

emilsoftware-utilities 2.0.0-dev.76 → 2.0.0-dev.77

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (39) hide show

package/dist/accessi-module/Controllers/AuthController.js CHANGED Viewed

@@ -34,6 +34,8 @@ const AuthService_1 = require("../Services/AuthService/AuthService");
 const AdminBootstrapService_1 = require("../Services/AdminBootstrapService/AdminBootstrapService");
 const jwt_strategy_1 = require("../jwt/jwt.strategy");
 const accessControl_1 = require("../security/accessControl");
+const authenticatedToken_1 = require("../security/authenticatedToken");
+const authCookies_1 = require("../security/authCookies");
 const sessionRevocation_1 = require("../security/sessionRevocation");
 const accessTokenRevocation_1 = require("../security/accessTokenRevocation");
 const audit_1 = require("../security/audit");
@@ -67,10 +69,13 @@ let AuthController = AuthController_1 = class AuthController {
                 if (!rateLimitDecision.allowed) {
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
                 }
-                if (!(body === null || body === void 0 ? void 0 : body.token)) {
+                const requestToken = typeof (body === null || body === void 0 ? void 0 : body.token) === 'string' && body.token.trim() !== ''
+                    ? body.token
+                    : (0, authenticatedToken_1.extractAccessiBearerToken)(request.headers.authorization);
+                if (!requestToken) {
                     return Utilities_1.RestUtilities.sendErrorMessage(res, 'Token non fornito', AuthController_1.name, common_1.HttpStatus.BAD_REQUEST);
                 }
-                const authenticatedPayload = yield this.authService.getAuthenticatedTokenPayload(body.token);
+                const authenticatedPayload = yield this.authService.getAuthenticatedTokenPayload(requestToken);
                 const userData = authenticatedPayload === null || authenticatedPayload === void 0 ? void 0 : authenticatedPayload.utente;
                 if (!userData) {
                     throw new Error('Il token non contiene un utente Accessi valido.');
@@ -95,6 +100,9 @@ let AuthController = AuthController_1 = class AuthController {
                     }, common_1.HttpStatus.NOT_IMPLEMENTED);
                 }
                 yield (0, sessionRevocation_1.revokeAccessiUserSessions)(this.options, user.codiceUtente);
+                const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
+                if (cookieConfig)
+                    (0, authCookies_1.clearAccessiAuthCookies)(res, cookieConfig);
                 return Utilities_1.RestUtilities.sendOKMessage(res, 'Sessioni revocate con successo.');
             }
             catch (error) {
@@ -135,6 +143,11 @@ let AuthController = AuthController_1 = class AuthController {
                     jti: targetJti,
                     self: isCurrentToken,
                 });
+                if (isCurrentToken) {
+                    const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
+                    if (cookieConfig)
+                        (0, authCookies_1.clearAccessiAuthCookies)(res, cookieConfig);
+                }
                 return Utilities_1.RestUtilities.sendOKMessage(res, 'Token revocato con successo.');
             }
             catch (error) {
@@ -158,6 +171,7 @@ let AuthController = AuthController_1 = class AuthController {
                     userData.token = tokens.access;
                     if (tokens.refresh)
                         userData.refreshToken = tokens.refresh;
+                    (0, authCookies_1.applyAccessiAuthCookies)(res, (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options), userData);
                 }
                 return Utilities_1.RestUtilities.sendBaseResponse(res, userData);
             }
@@ -188,18 +202,30 @@ let AuthController = AuthController_1 = class AuthController {
     refresh(request, body, res) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const tokenKey = typeof (body === null || body === void 0 ? void 0 : body.refreshToken) === 'string'
-                    ? (0, crypto_1.createHash)('sha256').update(body.refreshToken).digest('hex').slice(0, 32)
+                const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
+                const cookieRefreshToken = (cookieConfig === null || cookieConfig === void 0 ? void 0 : cookieConfig.refreshFromCookie)
+                    ? (0, authCookies_1.getAccessiRefreshTokenFromCookie)(request.headers.cookie, cookieConfig)
+                    : undefined;
+                const refreshToken = typeof (body === null || body === void 0 ? void 0 : body.refreshToken) === 'string' && body.refreshToken.trim() !== ''
+                    ? body.refreshToken
+                    : cookieRefreshToken;
+                const tokenKey = typeof refreshToken === 'string'
+                    ? (0, crypto_1.createHash)('sha256').update(refreshToken).digest('hex').slice(0, 32)
                     : undefined;
                 const decision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'refresh', request, tokenKey ? [tokenKey] : []);
                 if (!decision.allowed) {
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, decision.retryAfterSeconds);
                 }
-                const result = yield this.authService.refreshAccessToken(body === null || body === void 0 ? void 0 : body.refreshToken);
+                if (!refreshToken) {
+                    throw new common_1.HttpException('Refresh token mancante.', common_1.HttpStatus.UNAUTHORIZED);
+                }
+                const result = yield this.authService.refreshAccessToken(refreshToken);
                 if (!result.token) {
                     throw new common_1.HttpException('Refresh token non valido.', common_1.HttpStatus.UNAUTHORIZED);
                 }
-                return Utilities_1.RestUtilities.sendBaseResponse(res, Object.assign({ token: result.token }, (result.refreshToken ? { refreshToken: result.refreshToken } : {})));
+                const response = Object.assign({ token: result.token }, (result.refreshToken ? { refreshToken: result.refreshToken } : {}));
+                (0, authCookies_1.applyAccessiAuthCookies)(res, cookieConfig, response);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, response);
             }
             catch (error) {
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.UNAUTHORIZED);
@@ -212,7 +238,9 @@ let AuthController = AuthController_1 = class AuthController {
                 const limit = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'twoFactorVerify', request, [body.challengeId]);
                 if (!limit.allowed)
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
-                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.authService.verifyTwoFactor(body.challengeId, body.code, body.scope));
+                const result = yield this.authService.verifyTwoFactor(body.challengeId, body.code, body.scope);
+                (0, authCookies_1.applyAccessiAuthCookies)(res, (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options), result);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, result);
             }
             catch (error) {
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);

package/dist/accessi-module/Controllers/AuthController.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4H;AAC5H,yDAAuF;AACvF,6CAAuG;AAEvG,mCAAoC;AACpC,yCAAsC;AACtC,+CAAgD;AAEhD,kCAeiB;AACjB,qEAA2F;AAC3F,mGAAgG;AAChG,sDAAqD;AACrD,6DAAwE;AACxE,qEAGuC;AACvC,6EAG2C;AAC3C,6CAAiD;AACjD,yEAGyC;AAQlC,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YACmB,WAAwB,EACxB,qBAA4C,EAClC,OAAwC;QAFlD,gBAAW,GAAX,WAAW,CAAa;QACxB,0BAAqB,GAArB,qBAAqB,CAAuB;QACjB,YAAO,GAAP,OAAO,CAAgB;QALrE,WAAM,GAAW,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAM9C,CAAC;IAgBE,aAAa,CACV,OAAgB,EAChB,GAAa,EACJ,KAAa,EACrB,IAAiC;;YAEzC,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,sBAAsB,EACtB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;KAAA;IAkBK,cAAc,CACX,OAAgB,EACf,IAA2B,EAC5B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,gBAAgB,EAChB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,EAAE,CAAC;oBACjB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,mBAAmB,EACnB,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7F,MAAM,QAAQ,GAAI,oBAA6C,aAA7C,oBAAoB,uBAApB,oBAAoB,CAA2B,MAAM,CAAC;gBACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;gBAED,2EAA2E;gBAC3E,sFAAsF;gBACtF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;KAAA;IAaK,cAAc,CAAQ,OAAgB,EAAS,GAAa;;YAChE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAA,6CAAyB,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7C,MAAM,IAAI,sBAAa,CACrB;wBACE,IAAI,EAAE,qCAAqC;wBAC3C,OAAO,EAAE,yDAAyD;qBACnE,EACD,mBAAU,CAAC,eAAe,CAC3B,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAA,6CAAyB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBACjE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAgBK,WAAW,CACR,OAAgB,EACf,IAAwB,EACzB,GAAa;;;YAEpB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAA,qDAA6B,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,sBAAa,CACrB;wBACE,IAAI,EAAE,0CAA0C;wBAChD,OAAO,EAAE,kEAAkE;qBAC5E,EACD,mBAAU,CAAC,eAAe,CAC3B,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAG,CAAC,MAAC,OAAwC,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;gBAClG,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7E,MAAM,YAAY,GAAG,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,MAAM,SAAS,GAAG,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;gBAElE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,sBAAa,CACrB,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,0CAA0C,EAAE,EAC1F,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,GAAG,SAAS,KAAK,UAAU,CAAC;gBAChD,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC1D,MAAM,IAAI,sBAAa,CACrB;wBACE,IAAI,EAAE,gCAAgC;wBACtC,OAAO,EAAE,uEAAuE;qBACjF,EACD,mBAAU,CAAC,SAAS,CACrB,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,IAAA,gDAAwB,EAC5B,IAAI,CAAC,OAAO,EACZ,SAAS,EACT,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAC5E,CAAC;gBACF,IAAA,oBAAY,EAAC,sBAAsB,EAAE;oBACnC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,KAAK,EAAE,IAAI,CAAC,YAAY;oBACxB,GAAG,EAAE,SAAS;oBACd,IAAI,EAAE,cAAc;iBACrB,CAAC,CAAC;gBACH,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IA0BK,KAAK,CAAQ,OAAgB,EAAU,YAA0B,EAAS,GAAa;;YAC3F,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,OAAO,EACP,CAAC,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,CAAC,CACtB,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;oBACtD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;oBAC/E,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;oBAC/B,IAAI,MAAM,CAAC,OAAO;wBAAE,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC7D,CAAC;gBAED,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,kBAAkB,EAAE,CAAC;oBACrD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACnE,OAAO,yBAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,KAAK,YAAY,sBAAa,EAAE,CAAC;oBACnC,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5F,CAAC;gBAED,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,qCAAuB,EAAE,CAAC;oBAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;wBAC3C,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;wBAC9D,IAAI,EAAE,qCAAuB;wBAC7B,KAAK,EAAE,qCAAuB;wBAC9B,OAAO,EAAE,+EAA+E;qBACzF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBACpD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;gBACJ,CAAC;gBACD,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;KAAA;IAaK,OAAO,CACJ,OAAgB,EACf,IAAyB,EAC1B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,CAAA,KAAK,QAAQ;oBACrD,CAAC,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC3E,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAwB,EAC7C,IAAI,CAAC,OAAO,EACZ,SAAS,EACT,OAAO,EACP,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3B,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,CAAC,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,IAAI,sBAAa,CAAC,2BAA2B,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;gBAChF,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,kBACvC,KAAK,EAAE,MAAM,CAAC,KAAK,IAChB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACrE,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9H,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAeK,cAAc,CAAQ,OAAgB,EAAU,IAA2B,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBACtF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAUK,oBAAoB,CAAQ,GAAa;;YAC7C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAClG,CAAC;KAAA;CACF,CAAA;AAtZY,wCAAc;AAuBnB;IAdL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kCAA2B,EAAE,CAAC;IAC9C,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kCAAkC;QAC/C,IAAI,EAAE,qBAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,+BAA+B,CAAC;IAEnC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,aAAI,GAAE,CAAA;;6DAAO,kCAA2B;;mDAiB1C;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,gBAAgB;KAC9B,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAsB;KAC7B,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,4BAA4B;QACzC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IAEvB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,4BAAqB;;oDAkCpC;AAaK;IAXL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,gBAAgB;QAC7B,WAAW,EACT,+IAA+I;KAClJ,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qBAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAClG,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACF,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDAsBnD;AAgBK;IAdL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,4CAA4C;QACrD,WAAW,EAAE,aAAa;QAC1B,WAAW,EACT,+GAA+G;YAC/G,wHAAwH;KAC3H,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,yBAAkB,EAAE,CAAC;IACrC,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qBAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IAC/G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IAC/F,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,cAAc,CAAC;IAElB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,yBAAkB;;iDA2DjC;AA0BK;IAxBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,wOAAwO;QAC1O,WAAW,EAAE,OAAO;KACrB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,mBAAY,EAAE,CAAC;IAC/B,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,wBAAwB;QACrC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,8BAAuB;KAC9B,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC9F,IAAA,aAAI,EAAC,OAAO,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAApB,mBAAY;;2CAsDtE;AAaK;IAXL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EAAE,oBAAoB;QACjC,WAAW,EACT,wGAAwG;KAC3G,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,0BAAmB,EAAE,CAAC;IACtC,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,2BAAoB,EAAE,CAAC;IAC7C,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+CAA+C,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACnF,IAAA,aAAI,EAAC,SAAS,CAAC;IAEb,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,0BAAmB;;6CAiClC;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACnG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACzG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAeK;IAbL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,gBAAgB;QAC7B,WAAW,EACT,4FAA4F;YAC5F,mHAAmH;KACtH,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,6BAAsB,EAAE,CAAC;IAC1D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC7D,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA+B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA7B,4BAAqB;;oDAQhF;AAUK;IARL,IAAA,YAAG,EAAC,wBAAwB,CAAC;IAC7B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,yBAAyB;QACtC,WAAW,EACT,iGAAiG;KACpG,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mCAA4B,EAAE,CAAC;IACrC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;0DAEhC;yBArZU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAOE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFI,yBAAW;QACD,6CAAqB;GALpD,cAAc,CAsZ1B","sourcesContent":["import { Body, Controller, Get, HttpException, HttpStatus, Inject, Param, Post, Req, Res, UseGuards } from '@nestjs/common';\nimport { ResendTwoFactorRequest, VerifyTwoFactorRequest } from '../Dtos/TwoFactorDtos';\nimport { ApiBody, ApiOkResponse, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { createHash } from 'crypto';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n ActionResponse,\n AdminBootstrapStatusResponse,\n BootstrapAdminRequest,\n BootstrapAdminResponse,\n ConfirmResetPasswordRequest,\n ErrorResponse,\n GetUserByTokenRequest,\n GetUserByTokenResponse,\n LoginRequest,\n LoginResponse,\n PasswordExpiredResponse,\n RefreshTokenRequest,\n RefreshTokenResponse,\n RevokeTokenRequest,\n} from '../Dtos';\nimport { AuthService, PASSWORD_LOGIN_DISABLED } from '../Services/AuthService/AuthService';\nimport { AdminBootstrapService } from '../Services/AdminBootstrapService/AdminBootstrapService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { getAuthenticatedAccessiUser } from '../security/accessControl';\nimport {\n getSessionRevocationStore,\n revokeAccessiUserSessions,\n} from '../security/sessionRevocation';\nimport {\n getAccessTokenRevocationStore,\n revokeAccessiAccessToken,\n} from '../security/accessTokenRevocation';\nimport { auditAccessi } from '../security/audit';\nimport {\n checkPublicAuthRateLimit,\n sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n@ApiTags('Auth')\n@Controller('accessi/auth')\n/*\n Endpoint pubblici di autenticazione locale e verifica sessione.\n * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.\n /\nexport class AuthController {\n logger: Logger = new Logger(AuthController.name);\n\n constructor(\n private readonly authService: AuthService,\n private readonly adminBootstrapService: AdminBootstrapService,\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n ) {}\n\n @ApiOperation({ summary: 'Conferma il reset della password', operationId: 'resetPassword' })\n @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\n @ApiBody({ type: ConfirmResetPasswordRequest })\n @ApiResponse({\n status: 200,\n description: 'Password aggiornata con successo',\n type: ActionResponse,\n })\n @ApiResponse({\n status: 400,\n description: 'Errore nella richiesta o token non valido',\n type: ErrorResponse,\n })\n @Post('confirm-reset-password/:token')\n async resetPassword(\n @Req() request: Request,\n @Res() res: Response,\n @Param('token') token: string,\n @Body() body: ConfirmResetPasswordRequest,\n ) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'passwordResetConfirm',\n request,\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n await this.authService.confirmResetPassword(token, body.newPassword);\n return RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.BAD_REQUEST);\n }\n }\n\n @ApiOperation({\n summary: 'Recupera le informazioni utente dal token JWT',\n operationId: 'getUserByToken',\n })\n @ApiBody({ type: GetUserByTokenRequest })\n @ApiResponse({\n status: 200,\n description: 'Informazioni utente recuperate con successo',\n type: GetUserByTokenResponse,\n })\n @ApiResponse({\n status: 401,\n description: 'Token non valido o scaduto',\n type: ErrorResponse,\n })\n @Post('get-user-by-token')\n async getUserByToken(\n @Req() request: Request,\n @Body() body: GetUserByTokenRequest,\n @Res() res: Response,\n ) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'getUserByToken',\n request,\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n if (!body?.token) {\n return RestUtilities.sendErrorMessage(\n res,\n 'Token non fornito',\n AuthController.name,\n HttpStatus.BAD_REQUEST,\n );\n }\n\n const authenticatedPayload = await this.authService.getAuthenticatedTokenPayload(body.token);\n const userData = (authenticatedPayload as { utente?: unknown })?.utente;\n if (!userData) {\n throw new Error('Il token non contiene un utente Accessi valido.');\n }\n\n // Keep the runtime response aligned with GetUserByTokenResponse and Orval:\n // Result.userData contains the authenticated user directly, not a nested JWT payload.\n return RestUtilities.sendBaseResponse(res, { userData });\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.UNAUTHORIZED);\n }\n }\n\n @ApiOperation({\n summary: 'Revoca tutte le sessioni dell utente corrente',\n operationId: 'revokeSessions',\n description:\n 'Invalida i token emessi prima di questa chiamata. Richiede sessionRevocation.store configurato. I token emessi dopo la revoca restano validi.',\n })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n @ApiResponse({ status: 501, type: ErrorResponse, description: 'Revoca sessioni non configurata.' })\n @UseGuards(JwtSimpleGuard)\n @Post('revoke-sessions')\n async revokeSessions(@Req() request: Request, @Res() res: Response) {\n try {\n const user = getAuthenticatedAccessiUser(request);\n if (!getSessionRevocationStore(this.options)) {\n throw new HttpException(\n {\n code: 'ACCESSI_SESSION_REVOCATION_DISABLED',\n message: 'La revoca sessioni non e configurata su questa istanza.',\n },\n HttpStatus.NOT_IMPLEMENTED,\n );\n }\n await revokeAccessiUserSessions(this.options, user.codiceUtente);\n return RestUtilities.sendOKMessage(res, 'Sessioni revocate con successo.');\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST,\n );\n }\n }\n\n @ApiOperation({\n summary: 'Revoca un singolo access token tramite jti',\n operationId: 'revokeToken',\n description:\n 'Annulla un solo token (logout del dispositivo corrente o token compromesso) senza toccare le altre sessioni. ' +\n 'Se il body non contiene jti viene revocato il token della richiesta. Richiede accessTokenRevocation.store configurato.',\n })\n @ApiBody({ type: RevokeTokenRequest })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n @ApiResponse({ status: 403, type: ErrorResponse, description: 'Non autorizzato a revocare il token indicato.' })\n @ApiResponse({ status: 501, type: ErrorResponse, description: 'Revoca token non configurata.' })\n @UseGuards(JwtSimpleGuard)\n @Post('revoke-token')\n async revokeToken(\n @Req() request: Request,\n @Body() body: RevokeTokenRequest,\n @Res() res: Response,\n ) {\n try {\n const user = getAuthenticatedAccessiUser(request);\n if (!getAccessTokenRevocationStore(this.options)) {\n throw new HttpException(\n {\n code: 'ACCESSI_ACCESS_TOKEN_REVOCATION_DISABLED',\n message: 'La revoca dei singoli token non e configurata su questa istanza.',\n },\n HttpStatus.NOT_IMPLEMENTED,\n );\n }\n\n const payload = ((request as Request & { user?: unknown }).user ?? {}) as Record<string, unknown>;\n const currentJti = typeof payload.jti === 'string' ? payload.jti : undefined;\n const requestedJti = typeof body?.jti === 'string' ? body.jti.trim() : '';\n const targetJti = requestedJti !== '' ? requestedJti : currentJti;\n\n if (!targetJti) {\n throw new HttpException(\n { code: 'ACCESSI_TOKEN_JTI_MISSING', message: 'Il token non contiene un jti revocabile.' },\n HttpStatus.BAD_REQUEST,\n );\n }\n\n const isCurrentToken = targetJti === currentJti;\n if (!isCurrentToken && !user.flagAdmin && !user.flagSuper) {\n throw new HttpException(\n {\n code: 'ACCESSI_TOKEN_REVOKE_FORBIDDEN',\n message: 'Solo gli amministratori possono revocare il token di un altro utente.',\n },\n HttpStatus.FORBIDDEN,\n );\n }\n\n const expiresAt = Number(payload.exp);\n await revokeAccessiAccessToken(\n this.options,\n targetJti,\n isCurrentToken && Number.isFinite(expiresAt) ? expiresAt 1000 : undefined,\n );\n auditAccessi('access_token_revoked', {\n codiceUtente: user.codiceUtente,\n actor: user.codiceUtente,\n jti: targetJti,\n self: isCurrentToken,\n });\n return RestUtilities.sendOKMessage(res, 'Token revocato con successo.');\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST,\n );\n }\n }\n\n @ApiOperation({\n summary: 'Effettua il login utente',\n description:\n \"Con sola email restituisce passwordRequired oppure avvia il codice per utenti passwordless. Con password valida restituisce il login completo o challenge se la 2FA e attiva. Nessun JWT viene emesso prima della verifica del codice.\",\n operationId: 'login',\n })\n @ApiBody({ type: LoginRequest })\n @ApiResponse({\n status: 200,\n description: 'Login effettuato con successo',\n type: LoginResponse,\n })\n @ApiResponse({\n status: 401,\n description: 'Credenziali non valide',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: 403,\n description: 'Password scaduta, e necessario aggiornarla.',\n type: PasswordExpiredResponse,\n })\n @ApiResponse({ status: 403, description: 'Utente abilitato solo a SSO.', type: ErrorResponse })\n @Post('login')\n async login(@Req() request: Request, @Body() loginRequest: LoginRequest, @Res() res: Response) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'login',\n request,\n [loginRequest?.email],\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n const userData = await this.authService.login(loginRequest);\n if (!userData) {\n return RestUtilities.sendInvalidCredentials(res);\n }\n\n if (!userData.challenge && !userData.passwordRequired) {\n const tokens = this.authService.createTokenPair(userData.utente, ['password']);\n userData.token = tokens.access;\n if (tokens.refresh) userData.refreshToken = tokens.refresh;\n }\n\n return RestUtilities.sendBaseResponse(res, userData);\n } catch (error) {\n if ((error as Error)?.message === 'PASSWORD_EXPIRED') {\n this.logger.warning('Password scaduta, cambiare password ', error);\n return RestUtilities.sendPasswordExpired(res);\n }\n\n if (error instanceof HttpException) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error.getStatus());\n }\n\n if ((error as Error)?.message === PASSWORD_LOGIN_DISABLED) {\n return res.status(HttpStatus.FORBIDDEN).json({\n severity: 'error', status: HttpStatus.FORBIDDEN, statusCode: 2,\n code: PASSWORD_LOGIN_DISABLED,\n error: PASSWORD_LOGIN_DISABLED,\n message: 'Questo utente e abilitato solo tramite SSO. Accedi con un provider collegato.',\n });\n }\n\n this.logger.error('Errore durante il login', error);\n if (RestUtilities.isDatabaseSchemaError(error)) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n HttpStatus.SERVICE_UNAVAILABLE,\n );\n }\n return RestUtilities.sendInvalidCredentials(res);\n }\n }\n\n @ApiOperation({\n summary: 'Scambia un refresh token con un nuovo access token',\n operationId: 'refreshAccessToken',\n description:\n 'Richiede jwtOptions.refreshExpiresIn. Il refresh token ha typ=refresh e non e accettato dai guard API.',\n })\n @ApiBody({ type: RefreshTokenRequest })\n @ApiOkResponse({ type: RefreshTokenResponse })\n @ApiResponse({ status: 401, description: 'Refresh token non valido, scaduto o revocato.', type: ErrorResponse })\n @ApiResponse({ status: 429, description: 'Troppi tentativi.', type: ErrorResponse })\n @Post('refresh')\n async refresh(\n @Req() request: Request,\n @Body() body: RefreshTokenRequest,\n @Res() res: Response,\n ) {\n try {\n const tokenKey = typeof body?.refreshToken === 'string'\n ? createHash('sha256').update(body.refreshToken).digest('hex').slice(0, 32)\n : undefined;\n const decision = await checkPublicAuthRateLimit(\n this.options,\n 'refresh',\n request,\n tokenKey ? [tokenKey] : [],\n );\n if (!decision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, decision.retryAfterSeconds);\n }\n\n const result = await this.authService.refreshAccessToken(body?.refreshToken);\n if (!result.token) {\n throw new HttpException('Refresh token non valido.', HttpStatus.UNAUTHORIZED);\n }\n return RestUtilities.sendBaseResponse(res, {\n token: result.token,\n ...(result.refreshToken ? { refreshToken: result.refreshToken } : {}),\n });\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n );\n }\n }\n\n @Post('two-factor/verify')\n @ApiOperation({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' })\n @ApiBody({ type: VerifyTwoFactorRequest })\n @ApiResponse({ status: 200, type: LoginResponse })\n @ApiResponse({ status: 401, type: ErrorResponse })\n @ApiResponse({ status: 429, type: ErrorResponse })\n async verifyTwoFactor(@Req() request: Request, @Body() body: VerifyTwoFactorRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'twoFactorVerify', request, [body.challengeId]);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.authService.verifyTwoFactor(body.challengeId, body.code, body.scope));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Post('two-factor/resend')\n @ApiOperation({ summary: 'Reinvia il codice, invalidando il precedente', operationId: 'resendTwoFactor' })\n @ApiBody({ type: ResendTwoFactorRequest })\n @ApiResponse({ status: 200, type: LoginResponse })\n @ApiResponse({ status: 401, type: ErrorResponse })\n @ApiResponse({ status: 429, type: ErrorResponse })\n async resendTwoFactor(@Req() request: Request, @Body() body: ResendTwoFactorRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'twoFactorResend', request, [body.challengeId]);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.authService.resendTwoFactor(body.challengeId));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Post('bootstrap-admin')\n @ApiOperation({\n summary: 'Crea il primo utente admin (bootstrap)',\n operationId: 'bootstrapAdmin',\n description:\n 'Endpoint pubblico ma protetto dal token di avvio: attivo solo con adminBootstrap.enabled. ' +\n 'Crea un utente in stato confermato senza email, con flag admin (e super opzionale) e password fornita o generata.',\n })\n @ApiBody({ type: BootstrapAdminRequest })\n @ApiResponse({ status: 200, type: BootstrapAdminResponse })\n @ApiResponse({ status: 401, description: 'Token di bootstrap non valido', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Bootstrap admin non abilitato', type: ErrorResponse })\n @ApiResponse({ status: 429, description: 'Troppi tentativi', type: ErrorResponse })\n async bootstrapAdmin(@Req() request: Request, @Body() body: BootstrapAdminRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'adminBootstrap', request);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.adminBootstrapService.bootstrap(body));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Get('bootstrap-admin/status')\n @ApiOperation({\n summary: 'Indica se il bootstrap admin e abilitato',\n operationId: 'getAdminBootstrapStatus',\n description:\n 'Endpoint pubblico: la console mostra la sezione \"Crea utente admin\" solo quando enabled e true.',\n })\n @ApiResponse({ status: 200, type: AdminBootstrapStatusResponse })\n async adminBootstrapStatus(@Res() res: Response) {\n return RestUtilities.sendBaseResponse(res, { enabled: this.adminBootstrapService.isEnabled() });\n }\n}\n"]}
1	+ {"version":3,"file":"AuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4H;AAC5H,yDAAuF;AACvF,6CAAuG;AAEvG,mCAAoC;AACpC,yCAAsC;AACtC,+CAAgD;AAEhD,kCAeiB;AACjB,qEAA2F;AAC3F,mGAAgG;AAChG,sDAAqD;AACrD,6DAAwE;AACxE,uEAA2E;AAC3E,yDAKiC;AACjC,qEAGuC;AACvC,6EAG2C;AAC3C,6CAAiD;AACjD,yEAGyC;AAQlC,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YACmB,WAAwB,EACxB,qBAA4C,EAClC,OAAwC;QAFlD,gBAAW,GAAX,WAAW,CAAa;QACxB,0BAAqB,GAArB,qBAAqB,CAAuB;QACjB,YAAO,GAAP,OAAO,CAAgB;QALrE,WAAM,GAAW,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAM9C,CAAC;IAgBE,aAAa,CACV,OAAgB,EAChB,GAAa,EACJ,KAAa,EACrB,IAAiC;;YAEzC,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,sBAAsB,EACtB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;KAAA;IAkBK,cAAc,CACX,OAAgB,EACf,IAA2B,EAC5B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,gBAAgB,EAChB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,YAAY,GAAG,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;oBAC9E,CAAC,CAAC,IAAI,CAAC,KAAK;oBACZ,CAAC,CAAC,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;gBAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,mBAAmB,EACnB,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBAC/F,MAAM,QAAQ,GAAI,oBAA6C,aAA7C,oBAAoB,uBAApB,oBAAoB,CAA2B,MAAM,CAAC;gBACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;gBAED,2EAA2E;gBAC3E,sFAAsF;gBACtF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;KAAA;IAaK,cAAc,CAAQ,OAAgB,EAAS,GAAa;;YAChE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAA,6CAAyB,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7C,MAAM,IAAI,sBAAa,CACrB;wBACE,IAAI,EAAE,qCAAqC;wBAC3C,OAAO,EAAE,yDAAyD;qBACnE,EACD,mBAAU,CAAC,eAAe,CAC3B,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAA,6CAAyB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBACjE,MAAM,YAAY,GAAG,IAAA,6CAA+B,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnE,IAAI,YAAY;oBAAE,IAAA,qCAAuB,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAC7D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAgBK,WAAW,CACR,OAAgB,EACf,IAAwB,EACzB,GAAa;;;YAEpB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAA,qDAA6B,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,sBAAa,CACrB;wBACE,IAAI,EAAE,0CAA0C;wBAChD,OAAO,EAAE,kEAAkE;qBAC5E,EACD,mBAAU,CAAC,eAAe,CAC3B,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAG,CAAC,MAAC,OAAwC,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;gBAClG,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7E,MAAM,YAAY,GAAG,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,MAAM,SAAS,GAAG,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;gBAElE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,sBAAa,CACrB,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,0CAA0C,EAAE,EAC1F,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,GAAG,SAAS,KAAK,UAAU,CAAC;gBAChD,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC1D,MAAM,IAAI,sBAAa,CACrB;wBACE,IAAI,EAAE,gCAAgC;wBACtC,OAAO,EAAE,uEAAuE;qBACjF,EACD,mBAAU,CAAC,SAAS,CACrB,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,IAAA,gDAAwB,EAC5B,IAAI,CAAC,OAAO,EACZ,SAAS,EACT,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAC5E,CAAC;gBACF,IAAA,oBAAY,EAAC,sBAAsB,EAAE;oBACnC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,KAAK,EAAE,IAAI,CAAC,YAAY;oBACxB,GAAG,EAAE,SAAS;oBACd,IAAI,EAAE,cAAc;iBACrB,CAAC,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,YAAY,GAAG,IAAA,6CAA+B,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACnE,IAAI,YAAY;wBAAE,IAAA,qCAAuB,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAC/D,CAAC;gBACD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IA0BK,KAAK,CAAQ,OAAgB,EAAU,YAA0B,EAAS,GAAa;;YAC3F,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,8CAAwB,EACtD,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,OAAO,EACP,CAAC,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,CAAC,CACtB,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;oBACtD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;oBAC/E,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;oBAC/B,IAAI,MAAM,CAAC,OAAO;wBAAE,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;oBAC3D,IAAA,qCAAuB,EAAC,GAAG,EAAE,IAAA,6CAA+B,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACxF,CAAC;gBAED,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,kBAAkB,EAAE,CAAC;oBACrD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACnE,OAAO,yBAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,KAAK,YAAY,sBAAa,EAAE,CAAC;oBACnC,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5F,CAAC;gBAED,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,qCAAuB,EAAE,CAAC;oBAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;wBAC3C,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;wBAC9D,IAAI,EAAE,qCAAuB;wBAC7B,KAAK,EAAE,qCAAuB;wBAC9B,OAAO,EAAE,+EAA+E;qBACzF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBACpD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;gBACJ,CAAC;gBACD,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;KAAA;IAaK,OAAO,CACJ,OAAgB,EACf,IAAyB,EAC1B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,IAAA,6CAA+B,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnE,MAAM,kBAAkB,GAAG,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,iBAAiB;oBACxD,CAAC,CAAC,IAAA,8CAAgC,EAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC;oBACxE,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,YAAY,GAAG,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,CAAA,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE;oBAC5F,CAAC,CAAC,IAAI,CAAC,YAAY;oBACnB,CAAC,CAAC,kBAAkB,CAAC;gBACvB,MAAM,QAAQ,GAAG,OAAO,YAAY,KAAK,QAAQ;oBAC/C,CAAC,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACtE,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAwB,EAC7C,IAAI,CAAC,OAAO,EACZ,SAAS,EACT,OAAO,EACP,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3B,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,CAAC;gBAED,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,sBAAa,CAAC,yBAAyB,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;gBAC9E,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACvE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,IAAI,sBAAa,CAAC,2BAA2B,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;gBAChF,CAAC;gBACD,MAAM,QAAQ,mBACZ,KAAK,EAAE,MAAM,CAAC,KAAK,IAChB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;gBACF,IAAA,qCAAuB,EAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;gBACrD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/F,IAAA,qCAAuB,EAAC,GAAG,EAAE,IAAA,6CAA+B,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;gBACpF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAeK,cAAc,CAAQ,OAAgB,EAAU,IAA2B,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBACtF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAUK,oBAAoB,CAAQ,GAAa;;YAC7C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAClG,CAAC;KAAA;CACF,CAAA;AA/aY,wCAAc;AAuBnB;IAdL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kCAA2B,EAAE,CAAC;IAC9C,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kCAAkC;QAC/C,IAAI,EAAE,qBAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,+BAA+B,CAAC;IAEnC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,aAAI,GAAE,CAAA;;6DAAO,kCAA2B;;mDAiB1C;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,gBAAgB;KAC9B,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAsB;KAC7B,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,4BAA4B;QACzC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IAEvB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,4BAAqB;;oDAqCpC;AAaK;IAXL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,gBAAgB;QAC7B,WAAW,EACT,+IAA+I;KAClJ,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qBAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAClG,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACF,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDAwBnD;AAgBK;IAdL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,4CAA4C;QACrD,WAAW,EAAE,aAAa;QAC1B,WAAW,EACT,+GAA+G;YAC/G,wHAAwH;KAC3H,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,yBAAkB,EAAE,CAAC;IACrC,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qBAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IAC/G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IAC/F,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,cAAc,CAAC;IAElB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,yBAAkB;;iDA+DjC;AA0BK;IAxBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,wOAAwO;QAC1O,WAAW,EAAE,OAAO;KACrB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,mBAAY,EAAE,CAAC;IAC/B,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,wBAAwB;QACrC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,8BAAuB;KAC9B,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC9F,IAAA,aAAI,EAAC,OAAO,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAApB,mBAAY;;2CAuDtE;AAaK;IAXL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EAAE,oBAAoB;QACjC,WAAW,EACT,wGAAwG;KAC3G,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,0BAAmB,EAAE,CAAC;IACtC,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,2BAAoB,EAAE,CAAC;IAC7C,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+CAA+C,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACnF,IAAA,aAAI,EAAC,SAAS,CAAC;IAEb,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,0BAAmB;;6CA8ClC;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACnG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAUlF;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACzG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAeK;IAbL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,gBAAgB;QAC7B,WAAW,EACT,4FAA4F;YAC5F,mHAAmH;KACtH,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,6BAAsB,EAAE,CAAC;IAC1D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC7D,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA+B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA7B,4BAAqB;;oDAQhF;AAUK;IARL,IAAA,YAAG,EAAC,wBAAwB,CAAC;IAC7B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,yBAAyB;QACtC,WAAW,EACT,iGAAiG;KACpG,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mCAA4B,EAAE,CAAC;IACrC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;0DAEhC;yBA9aU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAOE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFI,yBAAW;QACD,6CAAqB;GALpD,cAAc,CA+a1B","sourcesContent":["import { Body, Controller, Get, HttpException, HttpStatus, Inject, Param, Post, Req, Res, UseGuards } from '@nestjs/common';\nimport { ResendTwoFactorRequest, VerifyTwoFactorRequest } from '../Dtos/TwoFactorDtos';\nimport { ApiBody, ApiOkResponse, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { createHash } from 'crypto';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n ActionResponse,\n AdminBootstrapStatusResponse,\n BootstrapAdminRequest,\n BootstrapAdminResponse,\n ConfirmResetPasswordRequest,\n ErrorResponse,\n GetUserByTokenRequest,\n GetUserByTokenResponse,\n LoginRequest,\n LoginResponse,\n PasswordExpiredResponse,\n RefreshTokenRequest,\n RefreshTokenResponse,\n RevokeTokenRequest,\n} from '../Dtos';\nimport { AuthService, PASSWORD_LOGIN_DISABLED } from '../Services/AuthService/AuthService';\nimport { AdminBootstrapService } from '../Services/AdminBootstrapService/AdminBootstrapService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { extractAccessiBearerToken } from '../security/authenticatedToken';\nimport {\n applyAccessiAuthCookies,\n clearAccessiAuthCookies,\n getAccessiRefreshTokenFromCookie,\n resolveAccessiAuthCookieOptions,\n} from '../security/authCookies';\nimport {\n getSessionRevocationStore,\n revokeAccessiUserSessions,\n} from '../security/sessionRevocation';\nimport {\n getAccessTokenRevocationStore,\n revokeAccessiAccessToken,\n} from '../security/accessTokenRevocation';\nimport { auditAccessi } from '../security/audit';\nimport {\n checkPublicAuthRateLimit,\n sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n@ApiTags('Auth')\n@Controller('accessi/auth')\n/*\n Endpoint pubblici di autenticazione locale e verifica sessione.\n * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.\n /\nexport class AuthController {\n logger: Logger = new Logger(AuthController.name);\n\n constructor(\n private readonly authService: AuthService,\n private readonly adminBootstrapService: AdminBootstrapService,\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n ) {}\n\n @ApiOperation({ summary: 'Conferma il reset della password', operationId: 'resetPassword' })\n @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\n @ApiBody({ type: ConfirmResetPasswordRequest })\n @ApiResponse({\n status: 200,\n description: 'Password aggiornata con successo',\n type: ActionResponse,\n })\n @ApiResponse({\n status: 400,\n description: 'Errore nella richiesta o token non valido',\n type: ErrorResponse,\n })\n @Post('confirm-reset-password/:token')\n async resetPassword(\n @Req() request: Request,\n @Res() res: Response,\n @Param('token') token: string,\n @Body() body: ConfirmResetPasswordRequest,\n ) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'passwordResetConfirm',\n request,\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n await this.authService.confirmResetPassword(token, body.newPassword);\n return RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.BAD_REQUEST);\n }\n }\n\n @ApiOperation({\n summary: 'Recupera le informazioni utente dal token JWT',\n operationId: 'getUserByToken',\n })\n @ApiBody({ type: GetUserByTokenRequest })\n @ApiResponse({\n status: 200,\n description: 'Informazioni utente recuperate con successo',\n type: GetUserByTokenResponse,\n })\n @ApiResponse({\n status: 401,\n description: 'Token non valido o scaduto',\n type: ErrorResponse,\n })\n @Post('get-user-by-token')\n async getUserByToken(\n @Req() request: Request,\n @Body() body: GetUserByTokenRequest,\n @Res() res: Response,\n ) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'getUserByToken',\n request,\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n const requestToken = typeof body?.token === 'string' && body.token.trim() !== ''\n ? body.token\n : extractAccessiBearerToken(request.headers.authorization);\n if (!requestToken) {\n return RestUtilities.sendErrorMessage(\n res,\n 'Token non fornito',\n AuthController.name,\n HttpStatus.BAD_REQUEST,\n );\n }\n\n const authenticatedPayload = await this.authService.getAuthenticatedTokenPayload(requestToken);\n const userData = (authenticatedPayload as { utente?: unknown })?.utente;\n if (!userData) {\n throw new Error('Il token non contiene un utente Accessi valido.');\n }\n\n // Keep the runtime response aligned with GetUserByTokenResponse and Orval:\n // Result.userData contains the authenticated user directly, not a nested JWT payload.\n return RestUtilities.sendBaseResponse(res, { userData });\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.UNAUTHORIZED);\n }\n }\n\n @ApiOperation({\n summary: 'Revoca tutte le sessioni dell utente corrente',\n operationId: 'revokeSessions',\n description:\n 'Invalida i token emessi prima di questa chiamata. Richiede sessionRevocation.store configurato. I token emessi dopo la revoca restano validi.',\n })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n @ApiResponse({ status: 501, type: ErrorResponse, description: 'Revoca sessioni non configurata.' })\n @UseGuards(JwtSimpleGuard)\n @Post('revoke-sessions')\n async revokeSessions(@Req() request: Request, @Res() res: Response) {\n try {\n const user = getAuthenticatedAccessiUser(request);\n if (!getSessionRevocationStore(this.options)) {\n throw new HttpException(\n {\n code: 'ACCESSI_SESSION_REVOCATION_DISABLED',\n message: 'La revoca sessioni non e configurata su questa istanza.',\n },\n HttpStatus.NOT_IMPLEMENTED,\n );\n }\n await revokeAccessiUserSessions(this.options, user.codiceUtente);\n const cookieConfig = resolveAccessiAuthCookieOptions(this.options);\n if (cookieConfig) clearAccessiAuthCookies(res, cookieConfig);\n return RestUtilities.sendOKMessage(res, 'Sessioni revocate con successo.');\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST,\n );\n }\n }\n\n @ApiOperation({\n summary: 'Revoca un singolo access token tramite jti',\n operationId: 'revokeToken',\n description:\n 'Annulla un solo token (logout del dispositivo corrente o token compromesso) senza toccare le altre sessioni. ' +\n 'Se il body non contiene jti viene revocato il token della richiesta. Richiede accessTokenRevocation.store configurato.',\n })\n @ApiBody({ type: RevokeTokenRequest })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n @ApiResponse({ status: 403, type: ErrorResponse, description: 'Non autorizzato a revocare il token indicato.' })\n @ApiResponse({ status: 501, type: ErrorResponse, description: 'Revoca token non configurata.' })\n @UseGuards(JwtSimpleGuard)\n @Post('revoke-token')\n async revokeToken(\n @Req() request: Request,\n @Body() body: RevokeTokenRequest,\n @Res() res: Response,\n ) {\n try {\n const user = getAuthenticatedAccessiUser(request);\n if (!getAccessTokenRevocationStore(this.options)) {\n throw new HttpException(\n {\n code: 'ACCESSI_ACCESS_TOKEN_REVOCATION_DISABLED',\n message: 'La revoca dei singoli token non e configurata su questa istanza.',\n },\n HttpStatus.NOT_IMPLEMENTED,\n );\n }\n\n const payload = ((request as Request & { user?: unknown }).user ?? {}) as Record<string, unknown>;\n const currentJti = typeof payload.jti === 'string' ? payload.jti : undefined;\n const requestedJti = typeof body?.jti === 'string' ? body.jti.trim() : '';\n const targetJti = requestedJti !== '' ? requestedJti : currentJti;\n\n if (!targetJti) {\n throw new HttpException(\n { code: 'ACCESSI_TOKEN_JTI_MISSING', message: 'Il token non contiene un jti revocabile.' },\n HttpStatus.BAD_REQUEST,\n );\n }\n\n const isCurrentToken = targetJti === currentJti;\n if (!isCurrentToken && !user.flagAdmin && !user.flagSuper) {\n throw new HttpException(\n {\n code: 'ACCESSI_TOKEN_REVOKE_FORBIDDEN',\n message: 'Solo gli amministratori possono revocare il token di un altro utente.',\n },\n HttpStatus.FORBIDDEN,\n );\n }\n\n const expiresAt = Number(payload.exp);\n await revokeAccessiAccessToken(\n this.options,\n targetJti,\n isCurrentToken && Number.isFinite(expiresAt) ? expiresAt 1000 : undefined,\n );\n auditAccessi('access_token_revoked', {\n codiceUtente: user.codiceUtente,\n actor: user.codiceUtente,\n jti: targetJti,\n self: isCurrentToken,\n });\n if (isCurrentToken) {\n const cookieConfig = resolveAccessiAuthCookieOptions(this.options);\n if (cookieConfig) clearAccessiAuthCookies(res, cookieConfig);\n }\n return RestUtilities.sendOKMessage(res, 'Token revocato con successo.');\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST,\n );\n }\n }\n\n @ApiOperation({\n summary: 'Effettua il login utente',\n description:\n \"Con sola email restituisce passwordRequired oppure avvia il codice per utenti passwordless. Con password valida restituisce il login completo o challenge se la 2FA e attiva. Nessun JWT viene emesso prima della verifica del codice.\",\n operationId: 'login',\n })\n @ApiBody({ type: LoginRequest })\n @ApiResponse({\n status: 200,\n description: 'Login effettuato con successo',\n type: LoginResponse,\n })\n @ApiResponse({\n status: 401,\n description: 'Credenziali non valide',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: 403,\n description: 'Password scaduta, e necessario aggiornarla.',\n type: PasswordExpiredResponse,\n })\n @ApiResponse({ status: 403, description: 'Utente abilitato solo a SSO.', type: ErrorResponse })\n @Post('login')\n async login(@Req() request: Request, @Body() loginRequest: LoginRequest, @Res() res: Response) {\n try {\n const rateLimitDecision = await checkPublicAuthRateLimit(\n this.options,\n 'login',\n request,\n [loginRequest?.email],\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n const userData = await this.authService.login(loginRequest);\n if (!userData) {\n return RestUtilities.sendInvalidCredentials(res);\n }\n\n if (!userData.challenge && !userData.passwordRequired) {\n const tokens = this.authService.createTokenPair(userData.utente, ['password']);\n userData.token = tokens.access;\n if (tokens.refresh) userData.refreshToken = tokens.refresh;\n applyAccessiAuthCookies(res, resolveAccessiAuthCookieOptions(this.options), userData);\n }\n\n return RestUtilities.sendBaseResponse(res, userData);\n } catch (error) {\n if ((error as Error)?.message === 'PASSWORD_EXPIRED') {\n this.logger.warning('Password scaduta, cambiare password ', error);\n return RestUtilities.sendPasswordExpired(res);\n }\n\n if (error instanceof HttpException) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error.getStatus());\n }\n\n if ((error as Error)?.message === PASSWORD_LOGIN_DISABLED) {\n return res.status(HttpStatus.FORBIDDEN).json({\n severity: 'error', status: HttpStatus.FORBIDDEN, statusCode: 2,\n code: PASSWORD_LOGIN_DISABLED,\n error: PASSWORD_LOGIN_DISABLED,\n message: 'Questo utente e abilitato solo tramite SSO. Accedi con un provider collegato.',\n });\n }\n\n this.logger.error('Errore durante il login', error);\n if (RestUtilities.isDatabaseSchemaError(error)) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n HttpStatus.SERVICE_UNAVAILABLE,\n );\n }\n return RestUtilities.sendInvalidCredentials(res);\n }\n }\n\n @ApiOperation({\n summary: 'Scambia un refresh token con un nuovo access token',\n operationId: 'refreshAccessToken',\n description:\n 'Richiede jwtOptions.refreshExpiresIn. Il refresh token ha typ=refresh e non e accettato dai guard API.',\n })\n @ApiBody({ type: RefreshTokenRequest })\n @ApiOkResponse({ type: RefreshTokenResponse })\n @ApiResponse({ status: 401, description: 'Refresh token non valido, scaduto o revocato.', type: ErrorResponse })\n @ApiResponse({ status: 429, description: 'Troppi tentativi.', type: ErrorResponse })\n @Post('refresh')\n async refresh(\n @Req() request: Request,\n @Body() body: RefreshTokenRequest,\n @Res() res: Response,\n ) {\n try {\n const cookieConfig = resolveAccessiAuthCookieOptions(this.options);\n const cookieRefreshToken = cookieConfig?.refreshFromCookie\n ? getAccessiRefreshTokenFromCookie(request.headers.cookie, cookieConfig)\n : undefined;\n const refreshToken = typeof body?.refreshToken === 'string' && body.refreshToken.trim() !== ''\n ? body.refreshToken\n : cookieRefreshToken;\n const tokenKey = typeof refreshToken === 'string'\n ? createHash('sha256').update(refreshToken).digest('hex').slice(0, 32)\n : undefined;\n const decision = await checkPublicAuthRateLimit(\n this.options,\n 'refresh',\n request,\n tokenKey ? [tokenKey] : [],\n );\n if (!decision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, decision.retryAfterSeconds);\n }\n\n if (!refreshToken) {\n throw new HttpException('Refresh token mancante.', HttpStatus.UNAUTHORIZED);\n }\n\n const result = await this.authService.refreshAccessToken(refreshToken);\n if (!result.token) {\n throw new HttpException('Refresh token non valido.', HttpStatus.UNAUTHORIZED);\n }\n const response = {\n token: result.token,\n ...(result.refreshToken ? { refreshToken: result.refreshToken } : {}),\n };\n applyAccessiAuthCookies(res, cookieConfig, response);\n return RestUtilities.sendBaseResponse(res, response);\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n AuthController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n );\n }\n }\n\n @Post('two-factor/verify')\n @ApiOperation({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' })\n @ApiBody({ type: VerifyTwoFactorRequest })\n @ApiResponse({ status: 200, type: LoginResponse })\n @ApiResponse({ status: 401, type: ErrorResponse })\n @ApiResponse({ status: 429, type: ErrorResponse })\n async verifyTwoFactor(@Req() request: Request, @Body() body: VerifyTwoFactorRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'twoFactorVerify', request, [body.challengeId]);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n const result = await this.authService.verifyTwoFactor(body.challengeId, body.code, body.scope);\n applyAccessiAuthCookies(res, resolveAccessiAuthCookieOptions(this.options), result);\n return RestUtilities.sendBaseResponse(res, result);\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Post('two-factor/resend')\n @ApiOperation({ summary: 'Reinvia il codice, invalidando il precedente', operationId: 'resendTwoFactor' })\n @ApiBody({ type: ResendTwoFactorRequest })\n @ApiResponse({ status: 200, type: LoginResponse })\n @ApiResponse({ status: 401, type: ErrorResponse })\n @ApiResponse({ status: 429, type: ErrorResponse })\n async resendTwoFactor(@Req() request: Request, @Body() body: ResendTwoFactorRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'twoFactorResend', request, [body.challengeId]);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.authService.resendTwoFactor(body.challengeId));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Post('bootstrap-admin')\n @ApiOperation({\n summary: 'Crea il primo utente admin (bootstrap)',\n operationId: 'bootstrapAdmin',\n description:\n 'Endpoint pubblico ma protetto dal token di avvio: attivo solo con adminBootstrap.enabled. ' +\n 'Crea un utente in stato confermato senza email, con flag admin (e super opzionale) e password fornita o generata.',\n })\n @ApiBody({ type: BootstrapAdminRequest })\n @ApiResponse({ status: 200, type: BootstrapAdminResponse })\n @ApiResponse({ status: 401, description: 'Token di bootstrap non valido', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Bootstrap admin non abilitato', type: ErrorResponse })\n @ApiResponse({ status: 429, description: 'Troppi tentativi', type: ErrorResponse })\n async bootstrapAdmin(@Req() request: Request, @Body() body: BootstrapAdminRequest, @Res() res: Response) {\n try {\n const limit = await checkPublicAuthRateLimit(this.options, 'adminBootstrap', request);\n if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n return RestUtilities.sendBaseResponse(res, await this.adminBootstrapService.bootstrap(body));\n } catch (error) {\n return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n }\n }\n\n @Get('bootstrap-admin/status')\n @ApiOperation({\n summary: 'Indica se il bootstrap admin e abilitato',\n operationId: 'getAdminBootstrapStatus',\n description:\n 'Endpoint pubblico: la console mostra la sezione \"Crea utente admin\" solo quando enabled e true.',\n })\n @ApiResponse({ status: 200, type: AdminBootstrapStatusResponse })\n async adminBootstrapStatus(@Res() res: Response) {\n return RestUtilities.sendBaseResponse(res, { enabled: this.adminBootstrapService.isEnabled() });\n }\n}\n"]}

package/dist/accessi-module/Controllers/ConsoleEntryController.js CHANGED Viewed

@@ -33,6 +33,7 @@ const accessControl_1 = require("../security/accessControl");
 const authenticatedToken_1 = require("../security/authenticatedToken");
 const consoleEntry_1 = require("../security/consoleEntry");
 const publicAuthRateLimit_1 = require("../security/publicAuthRateLimit");
+const authCookies_1 = require("../security/authCookies");
 /**
  * Auto-ingresso alla console amministrativa da un frontend gia autenticato.
  * Il frontend scambia la propria sessione Accessi con un ticket monouso, poi apre
@@ -82,6 +83,13 @@ let ConsoleEntryController = ConsoleEntryController_1 = class ConsoleEntryContro
                         message: 'Ticket di ingresso console non valido o scaduto. Riapri la console dal frontend.',
                     });
                 }
+                const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
+                if (cookieConfig) {
+                    (0, authCookies_1.setAccessiAuthCookies)(res, cookieConfig, { access: entry.token });
+                    if (!cookieConfig.exposeTokens) {
+                        return Utilities_1.RestUtilities.sendBaseResponse(res, {});
+                    }
+                }
                 return Utilities_1.RestUtilities.sendBaseResponse(res, { token: { value: entry.token, type: 'Bearer' } });
             }
             catch (error) {

package/dist/accessi-module/Controllers/ConsoleEntryController.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ConsoleEntryController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/ConsoleEntryController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAOyB;AAEzB,+CAAgD;AAEhD,+DAAgI;AAChI,uDAAqD;AACrD,sDAAqD;AACrD,6DAA6F;AAC7F,uEAA2E;AAC3E,2DAAuE;AAEvE,yEAGyC;~~AAEzC~~;;;;GAIG;AAII,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,YAAwD,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAEnF,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,IAAA,0CAA2B,GAAE,CAAC;IAC3E,CAAC;IAED,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,KAAM,CAAC;IACpD,CAAC;IAYK,iBAAiB,CAAQ,OAAgB,EAAS,GAAa;;YACnE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAA,mCAAmB,EAAC,IAAI,CAAC,CAAC;gBAE1B,MAAM,UAAU,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBACvH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EACtD,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAYK,mBAAmB,CAChB,OAAgB,EACf,IAAiC,EAClC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,EAAE,CAAC,CAAC,CAAC;gBAC7G,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,CAAC,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,8BAAqB,CAAC;wBAC9B,IAAI,EAAE,+BAA+B;wBACrC,OAAO,EAAE,kFAAkF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;~~AArFY~~,wDAAsB;AAqB3B;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,0IAA0I;KACxJ,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6CAA0B,EAAE,CAAC;IACnD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IACpG,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,OAAO,CAAC;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;+DAuBtD;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,2HAA2H;KACzI,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IAC9C,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IACpD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC9F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnF,IAAA,aAAI,EAAC,gBAAgB,CAAC;IAEpB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,8CAA2B;;~~iEA0B1C~~;~~iCApFU~~,sBAAsB;IAHlC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAEf,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,sBAAsB,~~CAqFlC~~","sourcesContent":["import {\n Body,\n Controller,\n HttpException,\n HttpStatus,\n Inject,\n Post,\n Req,\n Res,\n UnauthorizedException,\n UseGuards,\n} from '@nestjs/common';\nimport {\n ApiBearerAuth,\n ApiBody,\n ApiOkResponse,\n ApiOperation,\n ApiResponse,\n ApiTags,\n} from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ConsoleEntryExchangeRequest, ConsoleEntrySessionResponse, ConsoleEntryTicketResponse } from '../Dtos/ConsoleEntryDtos';\nimport { ErrorResponse } from '../Dtos/BaseResponse';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureConsoleAccess, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { extractAccessiBearerToken } from '../security/authenticatedToken';\nimport { getDefaultConsoleEntryStore } from '../security/consoleEntry';\nimport type { ConsoleEntryStore } from '../security/consoleEntry';\nimport {\n checkPublicAuthRateLimit,\n sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n/*\n Auto-ingresso alla console amministrativa da un frontend gia autenticato.\n * Il frontend scambia la propria sessione Accessi con un ticket monouso, poi apre\n * `/api/accessi/console#entry=<ticket>`: il JWT non passa mai nell'URL.\n */\n@ApiTags('Console')\n@ApiBearerAuth()\n@Controller('accessi/console')\nexport class ConsoleEntryController {\n constructor(@Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions) {}\n\n private get store(): ConsoleEntryStore {\n return this.options.consoleEntry?.store ?? getDefaultConsoleEntryStore();\n }\n\n private get ttlMs(): number {\n return this.options.consoleEntry?.ttlMs ?? 60_000;\n }\n\n @ApiOperation({\n summary: 'Emetti un ticket di ingresso alla console',\n operationId: 'createConsoleEntryTicket',\n description: 'Riservato agli utenti abilitati alla console (FLGSUPER/FLGADMIN). Restituisce un ticket monouso legato all utente, valido pochi secondi.',\n })\n @ApiOkResponse({ type: ConsoleEntryTicketResponse })\n @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n @ApiResponse({ status: 403, type: ErrorResponse, description: 'Utente non abilitato alla console.' })\n @UseGuards(JwtSimpleGuard)\n @Post('entry')\n async createEntryTicket(@Req() request: Request, @Res() res: Response) {\n try {\n const user = getAuthenticatedAccessiUser(request);\n ensureConsoleAccess(user);\n\n const tokenValue = extractAccessiBearerToken(request.headers['authorization']);\n if (!tokenValue) {\n throw new UnauthorizedException({ code: 'ACCESSI_CONSOLE_ENTRY_TOKEN_MISSING', message: 'Token Accessi mancante.' });\n }\n\n const issued = await this.store.issue(\n { token: tokenValue, codiceUtente: user.codiceUtente },\n this.ttlMs,\n );\n return RestUtilities.sendBaseResponse(res, issued);\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n ConsoleEntryController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n );\n }\n }\n\n @ApiOperation({\n summary: 'Scambia il ticket con la sessione Accessi',\n operationId: 'exchangeConsoleEntryTicket',\n description: 'Endpoint pubblico (il ticket e l unica credenziale) protetto da rate limit; il ticket e monouso e scade in pochi secondi.',\n })\n @ApiBody({ type: ConsoleEntryExchangeRequest })\n @ApiOkResponse({ type: ConsoleEntrySessionResponse })\n @ApiResponse({ status: 401, type: ErrorResponse, description: 'Ticket non valido o scaduto.' })\n @ApiResponse({ status: 429, type: ErrorResponse, description: 'Troppi tentativi.' })\n @Post('entry/exchange')\n async exchangeEntryTicket(\n @Req() request: Request,\n @Body() body: ConsoleEntryExchangeRequest,\n @Res() res: Response,\n ) {\n try {\n const decision = await checkPublicAuthRateLimit(this.options, 'consoleEntry', request, [body?.ticket ?? '']);\n if (!decision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, decision.retryAfterSeconds);\n }\n\n const entry = await this.store.consume(body?.ticket);\n if (!entry) {\n throw new UnauthorizedException({\n code: 'ACCESSI_CONSOLE_ENTRY_INVALID',\n message: 'Ticket di ingresso console non valido o scaduto. Riapri la console dal frontend.',\n });\n }\n\n return RestUtilities.sendBaseResponse(res, { token: { value: entry.token, type: 'Bearer' } });\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n ConsoleEntryController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n );\n }\n }\n}\n"]}
1	+ {"version":3,"file":"ConsoleEntryController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/ConsoleEntryController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAOyB;AAEzB,+CAAgD;AAEhD,+DAAgI;AAChI,uDAAqD;AACrD,sDAAqD;AACrD,6DAA6F;AAC7F,uEAA2E;AAC3E,2DAAuE;AAEvE,yEAGyC;AACzC,yDAGiC;AAEjC;;;;GAIG;AAII,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,YAAwD,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAEnF,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,IAAA,0CAA2B,GAAE,CAAC;IAC3E,CAAC;IAED,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,KAAM,CAAC;IACpD,CAAC;IAYK,iBAAiB,CAAQ,OAAgB,EAAS,GAAa;;YACnE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAA,mCAAmB,EAAC,IAAI,CAAC,CAAC;gBAE1B,MAAM,UAAU,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBACvH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EACtD,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAYK,mBAAmB,CAChB,OAAgB,EACf,IAAiC,EAClC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,EAAE,CAAC,CAAC,CAAC;gBAC7G,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,CAAC,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,8BAAqB,CAAC;wBAC9B,IAAI,EAAE,+BAA+B;wBACrC,OAAO,EAAE,kFAAkF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,YAAY,GAAG,IAAA,6CAA+B,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnE,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAA,mCAAqB,EAAC,GAAG,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;oBAClE,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;wBAC/B,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACjD,CAAC;gBACH,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA5FY,wDAAsB;AAqB3B;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,0IAA0I;KACxJ,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6CAA0B,EAAE,CAAC;IACnD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IACpG,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,OAAO,CAAC;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;+DAuBtD;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,2HAA2H;KACzI,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IAC9C,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IACpD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC9F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnF,IAAA,aAAI,EAAC,gBAAgB,CAAC;IAEpB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,8CAA2B;;iEAiC1C;iCA3FU,sBAAsB;IAHlC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAEf,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,sBAAsB,CA4FlC","sourcesContent":["import {\n Body,\n Controller,\n HttpException,\n HttpStatus,\n Inject,\n Post,\n Req,\n Res,\n UnauthorizedException,\n UseGuards,\n} from '@nestjs/common';\nimport {\n ApiBearerAuth,\n ApiBody,\n ApiOkResponse,\n ApiOperation,\n ApiResponse,\n ApiTags,\n} from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ConsoleEntryExchangeRequest, ConsoleEntrySessionResponse, ConsoleEntryTicketResponse } from '../Dtos/ConsoleEntryDtos';\nimport { ErrorResponse } from '../Dtos/BaseResponse';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureConsoleAccess, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { extractAccessiBearerToken } from '../security/authenticatedToken';\nimport { getDefaultConsoleEntryStore } from '../security/consoleEntry';\nimport type { ConsoleEntryStore } from '../security/consoleEntry';\nimport {\n checkPublicAuthRateLimit,\n sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\nimport {\n resolveAccessiAuthCookieOptions,\n setAccessiAuthCookies,\n} from '../security/authCookies';\n\n/*\n Auto-ingresso alla console amministrativa da un frontend gia autenticato.\n * Il frontend scambia la propria sessione Accessi con un ticket monouso, poi apre\n * `/api/accessi/console#entry=<ticket>`: il JWT non passa mai nell'URL.\n */\n@ApiTags('Console')\n@ApiBearerAuth()\n@Controller('accessi/console')\nexport class ConsoleEntryController {\n constructor(@Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions) {}\n\n private get store(): ConsoleEntryStore {\n return this.options.consoleEntry?.store ?? getDefaultConsoleEntryStore();\n }\n\n private get ttlMs(): number {\n return this.options.consoleEntry?.ttlMs ?? 60_000;\n }\n\n @ApiOperation({\n summary: 'Emetti un ticket di ingresso alla console',\n operationId: 'createConsoleEntryTicket',\n description: 'Riservato agli utenti abilitati alla console (FLGSUPER/FLGADMIN). Restituisce un ticket monouso legato all utente, valido pochi secondi.',\n })\n @ApiOkResponse({ type: ConsoleEntryTicketResponse })\n @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n @ApiResponse({ status: 403, type: ErrorResponse, description: 'Utente non abilitato alla console.' })\n @UseGuards(JwtSimpleGuard)\n @Post('entry')\n async createEntryTicket(@Req() request: Request, @Res() res: Response) {\n try {\n const user = getAuthenticatedAccessiUser(request);\n ensureConsoleAccess(user);\n\n const tokenValue = extractAccessiBearerToken(request.headers['authorization']);\n if (!tokenValue) {\n throw new UnauthorizedException({ code: 'ACCESSI_CONSOLE_ENTRY_TOKEN_MISSING', message: 'Token Accessi mancante.' });\n }\n\n const issued = await this.store.issue(\n { token: tokenValue, codiceUtente: user.codiceUtente },\n this.ttlMs,\n );\n return RestUtilities.sendBaseResponse(res, issued);\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n ConsoleEntryController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n );\n }\n }\n\n @ApiOperation({\n summary: 'Scambia il ticket con la sessione Accessi',\n operationId: 'exchangeConsoleEntryTicket',\n description: 'Endpoint pubblico (il ticket e l unica credenziale) protetto da rate limit; il ticket e monouso e scade in pochi secondi.',\n })\n @ApiBody({ type: ConsoleEntryExchangeRequest })\n @ApiOkResponse({ type: ConsoleEntrySessionResponse })\n @ApiResponse({ status: 401, type: ErrorResponse, description: 'Ticket non valido o scaduto.' })\n @ApiResponse({ status: 429, type: ErrorResponse, description: 'Troppi tentativi.' })\n @Post('entry/exchange')\n async exchangeEntryTicket(\n @Req() request: Request,\n @Body() body: ConsoleEntryExchangeRequest,\n @Res() res: Response,\n ) {\n try {\n const decision = await checkPublicAuthRateLimit(this.options, 'consoleEntry', request, [body?.ticket ?? '']);\n if (!decision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, decision.retryAfterSeconds);\n }\n\n const entry = await this.store.consume(body?.ticket);\n if (!entry) {\n throw new UnauthorizedException({\n code: 'ACCESSI_CONSOLE_ENTRY_INVALID',\n message: 'Ticket di ingresso console non valido o scaduto. Riapri la console dal frontend.',\n });\n }\n\n const cookieConfig = resolveAccessiAuthCookieOptions(this.options);\n if (cookieConfig) {\n setAccessiAuthCookies(res, cookieConfig, { access: entry.token });\n if (!cookieConfig.exposeTokens) {\n return RestUtilities.sendBaseResponse(res, {});\n }\n }\n return RestUtilities.sendBaseResponse(res, { token: { value: entry.token, type: 'Bearer' } });\n } catch (error) {\n return RestUtilities.sendErrorMessage(\n res,\n error,\n ConsoleEntryController.name,\n error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n );\n }\n }\n}\n"]}

package/dist/accessi-module/Dtos/GetUserByTokenRequest.d.ts CHANGED Viewed

@@ -1,3 +1,3 @@
 export declare class GetUserByTokenRequest {
-    token: string;
+    token?: string;
 }

package/dist/accessi-module/Dtos/GetUserByTokenRequest.js CHANGED Viewed

@@ -16,10 +16,11 @@ class GetUserByTokenRequest {
 }
 exports.GetUserByTokenRequest = GetUserByTokenRequest;
 __decorate([
-    (0, swagger_1.ApiProperty)({
-        description: "JWT dell'utente.",
+    (0, swagger_1.ApiPropertyOptional)({
+        description: "JWT dell'utente. In modalita cookie puo essere omesso: si usa il cookie httpOnly o l'header Authorization.",
         example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
     }),
+    (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)({ message: 'Il token deve essere una stringa.' }),
     __metadata("design:type", String)
 ], GetUserByTokenRequest.prototype, "token", void 0);

package/dist/accessi-module/Dtos/GetUserByTokenRequest.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"GetUserByTokenRequest.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/GetUserByTokenRequest.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,~~6CAA8C~~;~~AAC9C~~,~~qDAA2C~~;~~AAE3C~~,MAAa,qBAAqB;~~CAOjC~~;~~AAPD~~,~~sDAOC~~;AADC;~~IALC~~,IAAA,~~qBAAW~~,EAAC;~~QACX~~,WAAW,EAAE,~~kBAAkB~~;~~QAC/B~~,OAAO,EAAE,yCAAyC;KACnD,CAAC;IACD,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;oDAC5C","sourcesContent":["import { ~~ApiProperty~~ } from '@nestjs/swagger';\nimport { IsString } from 'class-validator';\n\nexport class GetUserByTokenRequest {\n @~~ApiProperty~~({\n description: \"JWT dell'utente.\",\n example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',\n })\n @IsString({ message: 'Il token deve essere una stringa.' })\n token!: string;\n}\n"]}
1	+ {"version":3,"file":"GetUserByTokenRequest.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/GetUserByTokenRequest.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAsD;AACtD,qDAAuD;AAEvD,MAAa,qBAAqB;CAQjC;AARD,sDAQC;AADC;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,4GAA4G;QACzH,OAAO,EAAE,yCAAyC;KACnD,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;oDAC5C","sourcesContent":["import { ApiPropertyOptional } from '@nestjs/swagger';\nimport { IsOptional, IsString } from 'class-validator';\n\nexport class GetUserByTokenRequest {\n @ApiPropertyOptional({\n description: \"JWT dell'utente. In modalita cookie puo essere omesso: si usa il cookie httpOnly o l'header Authorization.\",\n example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',\n })\n @IsOptional()\n @IsString({ message: 'Il token deve essere una stringa.' })\n token?: string;\n}\n"]}

package/dist/accessi-module/Dtos/RefreshTokenDtos.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import { BaseResponse } from './BaseResponse';
 import { TokenResult } from './TokenResult';
 export declare class RefreshTokenRequest {
-    refreshToken: string;
+    refreshToken?: string;
 }
 export declare class RefreshTokenResult {
     token: TokenResult;

package/dist/accessi-module/Dtos/RefreshTokenDtos.js CHANGED Viewed

@@ -19,7 +19,10 @@ class RefreshTokenRequest {
 }
 exports.RefreshTokenRequest = RefreshTokenRequest;
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Refresh token emesso al login, 2FA o SSO.' }),
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Refresh token emesso al login, 2FA o SSO. In modalita cookie puo essere omesso.',
+    }),
+    (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)(),
     __metadata("design:type", String)
 ], RefreshTokenRequest.prototype, "refreshToken", void 0);

package/dist/accessi-module/Dtos/RefreshTokenDtos.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RefreshTokenDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/RefreshTokenDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,yDAAyC;AACzC,~~qDAA2D~~;~~AAC3D~~,iDAA8C;AAC9C,+CAA4C;AAE5C,MAAa,mBAAmB;~~CAI~~/B;~~AAJD~~,~~kDAIC~~;AADC;~~IAFC~~,IAAA,~~qBAAW~~,EAAC,~~EAAE,~~WAAW,EAAE,~~2CAA2C~~,~~EAAE,~~CAAC;~~IACzE~~,IAAA,0BAAQ,GAAE;;yDACW;AAGxB,MAAa,kBAAkB;CAU9B;AAVD,gDAUC;AANC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACtE,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BAChB,yBAAW;iDAAC;AAKpB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAC7F,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BACT,yBAAW;wDAAC;AAG7B,MAAa,oBAAqB,SAAQ,2BAAY;CAKrD;AALD,oDAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IACzC,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;8BACtB,kBAAkB;oDAAC","sourcesContent":["import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsString, ValidateNested } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\nimport { TokenResult } from './TokenResult';\n\nexport class RefreshTokenRequest {\n @~~ApiProperty~~({ description: 'Refresh token emesso al login, 2FA o SSO.' })\n @IsString()\n refreshToken!: string;\n}\n\nexport class RefreshTokenResult {\n @ApiProperty({ type: TokenResult, description: 'Nuovo access token.' })\n @ValidateNested()\n @Type(() => TokenResult)\n token!: TokenResult;\n\n @ApiPropertyOptional({ type: TokenResult, description: 'Nuovo refresh token, se abilitato.' })\n @ValidateNested()\n @Type(() => TokenResult)\n refreshToken?: TokenResult;\n}\n\nexport class RefreshTokenResponse extends BaseResponse {\n @ApiProperty({ type: RefreshTokenResult })\n @ValidateNested()\n @Type(() => RefreshTokenResult)\n Result!: RefreshTokenResult;\n}\n"]}
1	+ {"version":3,"file":"RefreshTokenDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/RefreshTokenDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,yDAAyC;AACzC,qDAAuE;AACvE,iDAA8C;AAC9C,+CAA4C;AAE5C,MAAa,mBAAmB;CAO/B;AAPD,kDAOC;AADC;IALC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,iFAAiF;KAC/F,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;yDACW;AAGxB,MAAa,kBAAkB;CAU9B;AAVD,gDAUC;AANC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACtE,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BAChB,yBAAW;iDAAC;AAKpB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAC7F,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BACT,yBAAW;wDAAC;AAG7B,MAAa,oBAAqB,SAAQ,2BAAY;CAKrD;AALD,oDAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IACzC,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;8BACtB,kBAAkB;oDAAC","sourcesContent":["import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsOptional, IsString, ValidateNested } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\nimport { TokenResult } from './TokenResult';\n\nexport class RefreshTokenRequest {\n @ApiPropertyOptional({\n description: 'Refresh token emesso al login, 2FA o SSO. In modalita cookie puo essere omesso.',\n })\n @IsOptional()\n @IsString()\n refreshToken?: string;\n}\n\nexport class RefreshTokenResult {\n @ApiProperty({ type: TokenResult, description: 'Nuovo access token.' })\n @ValidateNested()\n @Type(() => TokenResult)\n token!: TokenResult;\n\n @ApiPropertyOptional({ type: TokenResult, description: 'Nuovo refresh token, se abilitato.' })\n @ValidateNested()\n @Type(() => TokenResult)\n refreshToken?: TokenResult;\n}\n\nexport class RefreshTokenResponse extends BaseResponse {\n @ApiProperty({ type: RefreshTokenResult })\n @ValidateNested()\n @Type(() => RefreshTokenResult)\n Result!: RefreshTokenResult;\n}\n"]}

package/dist/accessi-module/index.d.ts CHANGED Viewed

@@ -62,6 +62,8 @@ export { buildAccessiJwks, createAccessiJwksHandler, getAccessiJwksPath, setupAc
 export type { AccessiJwksDocument, AccessiJwksKey } from './security/jwks';
 export { applyAccessiBaseSecurityHeaders, applyAccessiContentSecurityPolicy, buildAccessiContentSecurityPolicy, createAccessiSecurityHeadersMiddleware, resolveAccessiSecurityHeaders } from './security/securityHeaders';
 export type { AccessiCspDirectives, AccessiCspOptions, AccessiCspSurface, AccessiSecurityHeadersOptions, AccessiSecurityHeadersSetting, ResolvedAccessiCsp, ResolvedAccessiSecurityHeaders } from './security/securityHeaders';
+export { createAccessiAuthCookieMiddleware, resolveAccessiAuthCookieOptions, getAccessiAccessTokenFromCookie, getAccessiRefreshTokenFromCookie, setAccessiAuthCookies, clearAccessiAuthCookies, applyAccessiAuthCookies, parseAccessiCookieHeader, isAccessiCsrfExemptPath } from './security/authCookies';
+export type { AccessiAuthCookieOptions, AccessiAuthCookieSetting, AccessiAuthTokenPair, ResolvedAccessiAuthCookieOptions } from './security/authCookies';
 export { getAccessiAccessTokenSigningConfig, getAccessiAccessTokenVerificationConfig, getAccessiRefreshTokenSigningConfig, getAccessiRefreshTokenVerificationConfig, resolveAccessiVerificationKeys, verifyAccessiJwt } from './security/jwtTokenOptions';
 export type { AccessiJwtVerificationConfig, AccessiUnknownKeyIdEvent } from './security/jwtTokenOptions';
 export { FederatedAuthService } from './federated-auth/FederatedAuthService';

package/dist/accessi-module/index.js CHANGED Viewed

@@ -27,7 +27,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.isValidAdminBootstrapToken = exports.clearAdminBootstrapToken = exports.getAdminBootstrapToken = exports.getOrCreateAdminBootstrapToken = exports.AdminBootstrapService = exports.SchemaExportService = exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.leadingStatementKeyword = exports.analyzeCatalogScript = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.revokeAccessiAccessTokenIfConfigured = exports.revokeAccessiAccessToken = exports.isAccessiAccessTokenRevoked = exports.getAccessTokenRevocationStore = exports.createRedisAccessTokenRevocationStore = exports.createMemoryAccessTokenRevocationStore = exports.revokeRefreshTokenFamily = exports.isRefreshTokenFamilyRevoked = exports.getRefreshTokenRotationStore = exports.consumeRefreshToken = exports.createRedisRefreshTokenRotationStore = exports.createMemoryRefreshTokenRotationStore = exports.getSessionRevocationStore = exports.isAccessiTokenRevoked = exports.revokeAccessiUserSessionsIfConfigured = exports.revokeAccessiUserSessions = exports.createRedisSessionRevocationStore = exports.createMemorySessionRevocationStore = exports.auditAccessi = exports.validateAccessiOptions = exports.assertValidAccessiOptions = exports.createAccessiEdgeRateLimitMiddleware = exports.getDefaultRateLimitStore = exports.createRedisRateLimitStore = exports.createMemoryRateLimitStore = exports.getDefaultConsoleEntryStore = exports.createRedisConsoleEntryStore = exports.createMemoryConsoleEntryStore = exports.AccessiDatabaseUpdater = exports.FederatedAuthExchangeController = exports.AccessiIntrospectionController = exports.AccessiModule = void 0;
-exports.createAccessiHealthModule = exports.readinessHttpStatus = exports.createAccessiLiveReport = exports.collectAccessiHealthStores = exports.checkAccessiDatabase = exports.checkAccessiReadiness = exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.verifyAccessiJwt = exports.resolveAccessiVerificationKeys = exports.getAccessiRefreshTokenVerificationConfig = exports.getAccessiRefreshTokenSigningConfig = exports.getAccessiAccessTokenVerificationConfig = exports.getAccessiAccessTokenSigningConfig = exports.resolveAccessiSecurityHeaders = exports.createAccessiSecurityHeadersMiddleware = exports.buildAccessiContentSecurityPolicy = exports.applyAccessiContentSecurityPolicy = exports.applyAccessiBaseSecurityHeaders = exports.setupAccessiJwks = exports.getAccessiJwksPath = exports.createAccessiJwksHandler = exports.buildAccessiJwks = exports.LOGIN_AS_QUERY_PARAM = exports.buildLoginAsUrl = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = void 0;
+exports.createAccessiHealthModule = exports.readinessHttpStatus = exports.createAccessiLiveReport = exports.collectAccessiHealthStores = exports.checkAccessiDatabase = exports.checkAccessiReadiness = exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.verifyAccessiJwt = exports.resolveAccessiVerificationKeys = exports.getAccessiRefreshTokenVerificationConfig = exports.getAccessiRefreshTokenSigningConfig = exports.getAccessiAccessTokenVerificationConfig = exports.getAccessiAccessTokenSigningConfig = exports.isAccessiCsrfExemptPath = exports.parseAccessiCookieHeader = exports.applyAccessiAuthCookies = exports.clearAccessiAuthCookies = exports.setAccessiAuthCookies = exports.getAccessiRefreshTokenFromCookie = exports.getAccessiAccessTokenFromCookie = exports.resolveAccessiAuthCookieOptions = exports.createAccessiAuthCookieMiddleware = exports.resolveAccessiSecurityHeaders = exports.createAccessiSecurityHeadersMiddleware = exports.buildAccessiContentSecurityPolicy = exports.applyAccessiContentSecurityPolicy = exports.applyAccessiBaseSecurityHeaders = exports.setupAccessiJwks = exports.getAccessiJwksPath = exports.createAccessiJwksHandler = exports.buildAccessiJwks = exports.LOGIN_AS_QUERY_PARAM = exports.buildLoginAsUrl = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = void 0;
 exports.initializeAccessiModule = initializeAccessiModule;
 const express_1 = __importDefault(require("express"));
 const core_1 = require("@nestjs/core");
@@ -45,6 +45,7 @@ const emailConfiguration_1 = require("./security/emailConfiguration");
 const jwks_1 = require("./security/jwks");
 const edgeRateLimit_1 = require("./security/edgeRateLimit");
 const securityHeaders_1 = require("./security/securityHeaders");
+const authCookies_1 = require("./security/authCookies");
 function describeDatabaseTarget(options) {
     var _a, _b, _c, _d;
     const dbOptions = options.databaseOptions;
@@ -92,6 +93,10 @@ function initializeAccessiModule(app, options) {
             if (edgeRateLimit) {
                 app.use(edgeRateLimit);
             }
+            const authCookie = (0, authCookies_1.createAccessiAuthCookieMiddleware)(options, isAccessiRoute);
+            if (authCookie) {
+                app.use(authCookie);
+            }
             if (((_c = options.http) === null || _c === void 0 ? void 0 : _c.securityHeaders) !== false) {
                 const securityHeaders = (0, securityHeaders_1.createAccessiSecurityHeadersMiddleware)((_d = options.http) === null || _d === void 0 ? void 0 : _d.securityHeaders, isAccessiRoute, { isOpenApiUi: (path) => (0, OpenApiConfig_1.isOpenApiRequestPath)(path, resolvedOpenApi) });
                 if (securityHeaders) {
@@ -112,7 +117,7 @@ function initializeAccessiModule(app, options) {
             const nestApp = yield core_1.NestFactory.create(AccessiModule_1.AccessiModule.forRoot(options), nestExpressInstance, Object.assign({ bufferLogs: options.bufferLogs !== false }, (options.logger ? { logger: options.logger } : {})));
             logger.info("Applicazione Nest accessi creata.");
             if (((_e = options.http) === null || _e === void 0 ? void 0 : _e.cors) !== false) {
-                nestApp.enableCors((_g = (_f = options.http) === null || _f === void 0 ? void 0 : _f.cors) !== null && _g !== void 0 ? _g : { exposedHeaders: ['X-Total-Count'] });
+                nestApp.enableCors((_g = (_f = options.http) === null || _f === void 0 ? void 0 : _f.cors) !== null && _g !== void 0 ? _g : { exposedHeaders: ['X-Total-Count', 'X-CSRF-Token'] });
             }
             nestApp.useGlobalPipes((0, accessiValidation_1.createAccessiValidationPipe)());
             nestApp.useGlobalFilters(new AccessiHttpExceptionFilter_1.AccessiHttpExceptionFilter());
@@ -233,6 +238,16 @@ Object.defineProperty(exports, "applyAccessiContentSecurityPolicy", { enumerable
 Object.defineProperty(exports, "buildAccessiContentSecurityPolicy", { enumerable: true, get: function () { return securityHeaders_2.buildAccessiContentSecurityPolicy; } });
 Object.defineProperty(exports, "createAccessiSecurityHeadersMiddleware", { enumerable: true, get: function () { return securityHeaders_2.createAccessiSecurityHeadersMiddleware; } });
 Object.defineProperty(exports, "resolveAccessiSecurityHeaders", { enumerable: true, get: function () { return securityHeaders_2.resolveAccessiSecurityHeaders; } });
+var authCookies_2 = require("./security/authCookies");
+Object.defineProperty(exports, "createAccessiAuthCookieMiddleware", { enumerable: true, get: function () { return authCookies_2.createAccessiAuthCookieMiddleware; } });
+Object.defineProperty(exports, "resolveAccessiAuthCookieOptions", { enumerable: true, get: function () { return authCookies_2.resolveAccessiAuthCookieOptions; } });
+Object.defineProperty(exports, "getAccessiAccessTokenFromCookie", { enumerable: true, get: function () { return authCookies_2.getAccessiAccessTokenFromCookie; } });
+Object.defineProperty(exports, "getAccessiRefreshTokenFromCookie", { enumerable: true, get: function () { return authCookies_2.getAccessiRefreshTokenFromCookie; } });
+Object.defineProperty(exports, "setAccessiAuthCookies", { enumerable: true, get: function () { return authCookies_2.setAccessiAuthCookies; } });
+Object.defineProperty(exports, "clearAccessiAuthCookies", { enumerable: true, get: function () { return authCookies_2.clearAccessiAuthCookies; } });
+Object.defineProperty(exports, "applyAccessiAuthCookies", { enumerable: true, get: function () { return authCookies_2.applyAccessiAuthCookies; } });
+Object.defineProperty(exports, "parseAccessiCookieHeader", { enumerable: true, get: function () { return authCookies_2.parseAccessiCookieHeader; } });
+Object.defineProperty(exports, "isAccessiCsrfExemptPath", { enumerable: true, get: function () { return authCookies_2.isAccessiCsrfExemptPath; } });
 var jwtTokenOptions_1 = require("./security/jwtTokenOptions");
 Object.defineProperty(exports, "getAccessiAccessTokenSigningConfig", { enumerable: true, get: function () { return jwtTokenOptions_1.getAccessiAccessTokenSigningConfig; } });
 Object.defineProperty(exports, "getAccessiAccessTokenVerificationConfig", { enumerable: true, get: function () { return jwtTokenOptions_1.getAccessiAccessTokenVerificationConfig; } });