emilsoftware-utilities 2.0.0-dev.76 → 2.0.0-dev.78

package/dist/accessi-module/Console/console.js

@@ -27,21 +27,54 @@ function payloadString(payload, key) {
   const value = payload[key];
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
+function readBrowserCookie(name) {
+  if (typeof document === "undefined" || !document.cookie) return null;
+  for (const part of document.cookie.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0) continue;
+    if (part.slice(0, separator).trim() !== name) continue;
+    try {
+      return decodeURIComponent(part.slice(separator + 1).trim());
+    } catch {
+      return part.slice(separator + 1).trim();
+    }
+  }
+  return null;
+}
+function isCookieAuthMode() {
+  return typeof window !== "undefined" && window.__ACCESSI_AUTH_COOKIE__ === true;
+}
+var UNSAFE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 async function accessiFetch(url, options) {
   const config = scopedConfig;
+  const cookieMode2 = isCookieAuthMode();
   const headers = new Headers(options.headers);
   headers.set("Accept", "application/json");
   if (options.body !== void 0 && !headers.has("Content-Type")) {
     headers.set("Content-Type", "application/json");
   }
+  if (cookieMode2) {
+    const method = (options.method ?? "GET").toUpperCase();
+    if (UNSAFE_METHODS.has(method)) {
+      const csrfCookie = window.__ACCESSI_CSRF_COOKIE_NAME__ ?? "accessi_csrf";
+      const csrfHeader = window.__ACCESSI_CSRF_HEADER_NAME__ ?? "x-csrf-token";
+      const csrfToken = readBrowserCookie(csrfCookie);
+      if (csrfToken) headers.set(csrfHeader, csrfToken);
+    }
+  }
   const resolvedToken = config ? config.getToken ? await config.getToken() : config.token ?? null : tokenProvider ? await tokenProvider() : accessToken;
-  const authenticatedRequest = resolvedToken !== null && resolvedToken !== void 0;
+  const isAuthEntryRequest = /\/(?:auth\/(?:login|refresh|two-factor\/(?:verify|resend))|console\/entry\/exchange)\b/.test(url);
+  const authenticatedRequest = !isAuthEntryRequest && (cookieMode2 || resolvedToken !== null && resolvedToken !== void 0);
   if (resolvedToken) headers.set("Authorization", `Bearer ${resolvedToken}`);
   const runtimeBaseUrl = config?.baseUrl !== void 0 ? config.baseUrl : baseUrl ?? (typeof window !== "undefined" ? window.__ACCESSI_API_BASE_URL__ ?? null : null);
   const requestUrl = runtimeBaseUrl && url.startsWith("/") ? `${runtimeBaseUrl.replace(/\/+$/, "")}${url}` : url;
   notifyNetworkActivity(true);
   try {
-    const response = await fetch(requestUrl, { ...options, headers });
+    const response = await fetch(requestUrl, {
+      ...options,
+      headers,
+      ...cookieMode2 ? { credentials: "include" } : {}
+    });
     const payload = await response.json().catch(() => void 0);
     if (!response.ok) {
       const message = payloadString(payload, "message") ?? payloadString(payload, "error") ?? `Errore HTTP ${response.status}`;
@@ -78,6 +111,21 @@ var getUserByToken = async (getUserByTokenRequest, options) => {
     }
   );
 };
+var getRevokeTokenUrl = () => {
+  return `/api/accessi/auth/revoke-token`;
+};
+var revokeToken = async (revokeTokenRequest, options) => {
+  return accessiFetch(
+    getRevokeTokenUrl(),
+    {
+      ...options,
+      method: "POST",
+      body: JSON.stringify(
+        revokeTokenRequest
+      )
+    }
+  );
+};
 var getLoginUrl = () => {
   return `/api/accessi/auth/login`;
 };
@@ -1061,6 +1109,8 @@ var WIKI_SECTIONS = [
           ["publicAuthRateLimit", "PublicAuthRateLimitOptions", "no", "Limiti per endpoint pubblici; store condiviso opzionale (Redis) per il cluster."],
           ["edgeRateLimit", "AccessiEdgeRateLimitOptions", "no", "Limite grossolano per IP davanti alle rotte Accessi; opzionale, store condiviso supportato."],
           ["http", "{ cors, trustProxy, securityHeaders }", "no", "CORS, IP reali dietro proxy e header di sicurezza con CSP a nonce per la console e direttive configurabili."],
+          ["authCookie", "{ enabled, secure, sameSite, csrf, ... }", "no", "Cookie HttpOnly e CSRF double-submit al posto del Bearer. Default disattivato."],
+          ["metrics", "{ enabled, sink, prefix }", "no", "Metriche Prometheus di dominio (login, 2FA, refresh, rate limit, store) e sink esterno opzionale."],
           ["publicRegistration", "{ enabled }", "no", "Registrazione pubblica: disattivata per impostazione predefinita."],
           ["federatedAuthentication", "FederatedAuthenticationOptions", "no", `Abilita l'SSO generico.`],
           ["extensionFieldsOptions", "ExtensionFieldsOptions[]", "no", "Tabelle esterne allegate al profilo."],
@@ -2255,6 +2305,7 @@ var consoleMarkerIndex = window.location.pathname.indexOf(consoleMarker);
 var consoleBasePath = consoleMarkerIndex >= 0 ? window.location.pathname.slice(0, consoleMarkerIndex + consoleMarker.length) : `${window.location.pathname.replace(/\/$/, "")}`;
 var USERS_PAGE_SIZE = 25;
 var token = sessionStorage.getItem("accessi-console-token");
+var cookieMode = typeof window !== "undefined" && window.__ACCESSI_AUTH_COOKIE__ === true;
 var currentUser = null;
 var federatedAuthenticationAvailable = false;
 var usersPage = 0;
@@ -2708,18 +2759,22 @@ async function completeLoginStep(response) {
     byId("login-submit").textContent = "Accedi";
     return;
   }
-  if (!response.token?.value) throw new Error("Risposta di autenticazione incompleta.");
-  token = response.token.value;
-  sessionStorage.setItem("accessi-console-token", token);
-  setAccessiConsoleToken(token);
+  if (response.token?.value) {
+    token = response.token.value;
+    sessionStorage.setItem("accessi-console-token", token);
+    setAccessiConsoleToken(token);
+  } else if (!cookieMode) {
+    throw new Error("Risposta di autenticazione incompleta.");
+  }
   resetLogin();
   await bootstrap();
 }
 async function bootstrap() {
+  const hadToken = token !== null;
   try {
     setAccessiConsoleToken(token);
-    if (!token) throw new Error("Inserisci le credenziali amministrative.");
-    const payload = result(await getUserByToken({ token }));
+    if (!token && !cookieMode) throw new Error("Inserisci le credenziali amministrative.");
+    const payload = result(await getUserByToken({ token: token ?? "" }));
     currentUser = payload.userData;
     requireConsoleAccess();
     applyRoleNavigation();
@@ -2736,19 +2791,20 @@ async function bootstrap() {
     federatedAuthenticationAvailable = false;
     sessionStorage.removeItem("accessi-console-token");
     finishBoot("login");
-    byId("login-error").textContent = error instanceof Error ? error.message : "Sessione non valida.";
+    byId("login-error").textContent = cookieMode && !hadToken ? "" : error instanceof Error ? error.message : "Sessione non valida.";
   }
 }
 async function exchangeConsoleEntry(ticket) {
   try {
     const session = result(await exchangeConsoleEntryTicket({ ticket }));
     const value = session.token?.value;
-    if (typeof value !== "string" || value === "") {
+    if (typeof value === "string" && value !== "") {
+      token = value;
+      sessionStorage.setItem("accessi-console-token", value);
+      setAccessiConsoleToken(value);
+    } else if (!cookieMode) {
       throw new Error("Apertura automatica della console non riuscita.");
     }
-    token = value;
-    sessionStorage.setItem("accessi-console-token", value);
-    setAccessiConsoleToken(value);
     await bootstrap();
   } catch (error) {
     token = null;
@@ -4036,13 +4092,18 @@ byId("resend-code").onclick = async () => {
   }
 };
 byId("logout").onclick = () => {
-  resetLogin();
-  token = null;
-  currentUser = null;
-  setAccessiConsoleToken(null);
-  sessionStorage.removeItem("accessi-console-token");
-  window.history.replaceState(null, "", consoleBasePath);
-  void bootstrap();
+  void (async () => {
+    if (cookieMode) {
+      await revokeToken({}).catch(() => void 0);
+    }
+    resetLogin();
+    token = null;
+    currentUser = null;
+    setAccessiConsoleToken(null);
+    sessionStorage.removeItem("accessi-console-token");
+    window.history.replaceState(null, "", consoleBasePath);
+    void bootstrap();
+  })();
 };
 byId("nav").onclick = (event) => {
   const link = event.target.closest("a[data-view]");
@@ -4054,7 +4115,7 @@ window.addEventListener("popstate", () => {
   if (token && currentUser) handleAction(() => show(viewFromLocation()));
 });
 window.addEventListener(ACCESSI_UNAUTHORIZED_EVENT, () => {
-  if (!token) return;
+  if (!token && !cookieMode) return;
   token = null;
   currentUser = null;
   setAccessiConsoleToken(null);
@@ -4102,7 +4163,7 @@ if (entryTicket) {
   window.history.replaceState(null, "", window.location.pathname);
   finishBoot("login");
   showTwoFactor({ challengeId: ssoChallenge, resendAfterSeconds: 60 });
-} else if (token) {
+} else if (token || cookieMode) {
   void bootstrap();
 } else {
   finishBoot("login");