emilsoftware-utilities 2.0.0-dev.76 → 2.0.0-dev.78

package/dist/accessi-module/Controllers/ConsoleEntryController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConsoleEntryController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/ConsoleEntryController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAOyB;AAEzB,+CAAgD;AAEhD,+DAAgI;AAChI,uDAAqD;AACrD,sDAAqD;AACrD,6DAA6F;AAC7F,uEAA2E;AAC3E,2DAAuE;AAEvE,yEAGyC;AAEzC;;;;GAIG;AAII,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,YAAwD,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAEnF,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,IAAA,0CAA2B,GAAE,CAAC;IAC3E,CAAC;IAED,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,KAAM,CAAC;IACpD,CAAC;IAYK,iBAAiB,CAAQ,OAAgB,EAAS,GAAa;;YACnE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAA,mCAAmB,EAAC,IAAI,CAAC,CAAC;gBAE1B,MAAM,UAAU,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBACvH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EACtD,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAYK,mBAAmB,CAChB,OAAgB,EACf,IAAiC,EAClC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,EAAE,CAAC,CAAC,CAAC;gBAC7G,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,CAAC,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,8BAAqB,CAAC;wBAC9B,IAAI,EAAE,+BAA+B;wBACrC,OAAO,EAAE,kFAAkF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AArFY,wDAAsB;AAqB3B;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,0IAA0I;KACxJ,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6CAA0B,EAAE,CAAC;IACnD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IACpG,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,OAAO,CAAC;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;+DAuBtD;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,2HAA2H;KACzI,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IAC9C,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IACpD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC9F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnF,IAAA,aAAI,EAAC,gBAAgB,CAAC;IAEpB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,8CAA2B;;iEA0B1C;iCApFU,sBAAsB;IAHlC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAEf,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,sBAAsB,CAqFlC","sourcesContent":["import {\n  Body,\n  Controller,\n  HttpException,\n  HttpStatus,\n  Inject,\n  Post,\n  Req,\n  Res,\n  UnauthorizedException,\n  UseGuards,\n} from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ConsoleEntryExchangeRequest, ConsoleEntrySessionResponse, ConsoleEntryTicketResponse } from '../Dtos/ConsoleEntryDtos';\nimport { ErrorResponse } from '../Dtos/BaseResponse';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureConsoleAccess, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { extractAccessiBearerToken } from '../security/authenticatedToken';\nimport { getDefaultConsoleEntryStore } from '../security/consoleEntry';\nimport type { ConsoleEntryStore } from '../security/consoleEntry';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n/**\n * Auto-ingresso alla console amministrativa da un frontend gia autenticato.\n * Il frontend scambia la propria sessione Accessi con un ticket monouso, poi apre\n * `/api/accessi/console#entry=<ticket>`: il JWT non passa mai nell'URL.\n */\n@ApiTags('Console')\n@ApiBearerAuth()\n@Controller('accessi/console')\nexport class ConsoleEntryController {\n  constructor(@Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions) {}\n\n  private get store(): ConsoleEntryStore {\n    return this.options.consoleEntry?.store ?? getDefaultConsoleEntryStore();\n  }\n\n  private get ttlMs(): number {\n    return this.options.consoleEntry?.ttlMs ?? 60_000;\n  }\n\n  @ApiOperation({\n    summary: 'Emetti un ticket di ingresso alla console',\n    operationId: 'createConsoleEntryTicket',\n    description: 'Riservato agli utenti abilitati alla console (FLGSUPER/FLGADMIN). Restituisce un ticket monouso legato all utente, valido pochi secondi.',\n  })\n  @ApiOkResponse({ type: ConsoleEntryTicketResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n  @ApiResponse({ status: 403, type: ErrorResponse, description: 'Utente non abilitato alla console.' })\n  @UseGuards(JwtSimpleGuard)\n  @Post('entry')\n  async createEntryTicket(@Req() request: Request, @Res() res: Response) {\n    try {\n      const user = getAuthenticatedAccessiUser(request);\n      ensureConsoleAccess(user);\n\n      const tokenValue = extractAccessiBearerToken(request.headers['authorization']);\n      if (!tokenValue) {\n        throw new UnauthorizedException({ code: 'ACCESSI_CONSOLE_ENTRY_TOKEN_MISSING', message: 'Token Accessi mancante.' });\n      }\n\n      const issued = await this.store.issue(\n        { token: tokenValue, codiceUtente: user.codiceUtente },\n        this.ttlMs,\n      );\n      return RestUtilities.sendBaseResponse(res, issued);\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        ConsoleEntryController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n      );\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Scambia il ticket con la sessione Accessi',\n    operationId: 'exchangeConsoleEntryTicket',\n    description: 'Endpoint pubblico (il ticket e l unica credenziale) protetto da rate limit; il ticket e monouso e scade in pochi secondi.',\n  })\n  @ApiBody({ type: ConsoleEntryExchangeRequest })\n  @ApiOkResponse({ type: ConsoleEntrySessionResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Ticket non valido o scaduto.' })\n  @ApiResponse({ status: 429, type: ErrorResponse, description: 'Troppi tentativi.' })\n  @Post('entry/exchange')\n  async exchangeEntryTicket(\n    @Req() request: Request,\n    @Body() body: ConsoleEntryExchangeRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const decision = await checkPublicAuthRateLimit(this.options, 'consoleEntry', request, [body?.ticket ?? '']);\n      if (!decision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, decision.retryAfterSeconds);\n      }\n\n      const entry = await this.store.consume(body?.ticket);\n      if (!entry) {\n        throw new UnauthorizedException({\n          code: 'ACCESSI_CONSOLE_ENTRY_INVALID',\n          message: 'Ticket di ingresso console non valido o scaduto. Riapri la console dal frontend.',\n        });\n      }\n\n      return RestUtilities.sendBaseResponse(res, { token: { value: entry.token, type: 'Bearer' } });\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        ConsoleEntryController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n      );\n    }\n  }\n}\n"]}
+{"version":3,"file":"ConsoleEntryController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/ConsoleEntryController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAOyB;AAEzB,+CAAgD;AAEhD,+DAAgI;AAChI,uDAAqD;AACrD,sDAAqD;AACrD,6DAA6F;AAC7F,uEAA2E;AAC3E,2DAAuE;AAEvE,yEAGyC;AACzC,yDAGiC;AACjC,sDAA8D;AAE9D;;;;GAIG;AAII,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,YAAwD,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAEnF,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,IAAA,0CAA2B,GAAE,CAAC;IAC3E,CAAC;IAED,IAAY,KAAK;;QACf,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,0CAAE,KAAK,mCAAI,KAAM,CAAC;IACpD,CAAC;IAYK,iBAAiB,CAAQ,OAAgB,EAAS,GAAa;;YACnE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAClD,IAAA,mCAAmB,EAAC,IAAI,CAAC,CAAC;gBAE1B,MAAM,UAAU,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBACvH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EACtD,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,IAAA,4BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACjG,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,4BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChG,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAYK,mBAAmB,CAChB,OAAgB,EACf,IAAiC,EAClC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,EAAE,CAAC,CAAC,CAAC;gBAC7G,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,IAAA,4BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;oBACzG,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,CAAC,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,8BAAqB,CAAC;wBAC9B,IAAI,EAAE,+BAA+B;wBACrC,OAAO,EAAE,kFAAkF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBAED,IAAA,4BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBACrG,MAAM,YAAY,GAAG,IAAA,6CAA+B,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnE,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAA,mCAAqB,EAAC,GAAG,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;oBAClE,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;wBAC/B,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACjD,CAAC;gBACH,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,4BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE;oBACvD,MAAM,EAAE,UAAU;oBAClB,MAAM,EAAE,KAAK,YAAY,8BAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;iBACrE,CAAC,CAAC;gBACH,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,YAAY,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AApGY,wDAAsB;AAqB3B;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,0IAA0I;KACxJ,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6CAA0B,EAAE,CAAC;IACnD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IACpG,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,OAAO,CAAC;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;+DAyBtD;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,2HAA2H;KACzI,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IAC9C,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,8CAA2B,EAAE,CAAC;IACpD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC9F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnF,IAAA,aAAI,EAAC,gBAAgB,CAAC;IAEpB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,8CAA2B;;iEAuC1C;iCAnGU,sBAAsB;IAHlC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAEf,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,sBAAsB,CAoGlC","sourcesContent":["import {\n  Body,\n  Controller,\n  HttpException,\n  HttpStatus,\n  Inject,\n  Post,\n  Req,\n  Res,\n  UnauthorizedException,\n  UseGuards,\n} from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ConsoleEntryExchangeRequest, ConsoleEntrySessionResponse, ConsoleEntryTicketResponse } from '../Dtos/ConsoleEntryDtos';\nimport { ErrorResponse } from '../Dtos/BaseResponse';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureConsoleAccess, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { extractAccessiBearerToken } from '../security/authenticatedToken';\nimport { getDefaultConsoleEntryStore } from '../security/consoleEntry';\nimport type { ConsoleEntryStore } from '../security/consoleEntry';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\nimport {\n  resolveAccessiAuthCookieOptions,\n  setAccessiAuthCookies,\n} from '../security/authCookies';\nimport { countAccessiMetric } from '../observability/metrics';\n\n/**\n * Auto-ingresso alla console amministrativa da un frontend gia autenticato.\n * Il frontend scambia la propria sessione Accessi con un ticket monouso, poi apre\n * `/api/accessi/console#entry=<ticket>`: il JWT non passa mai nell'URL.\n */\n@ApiTags('Console')\n@ApiBearerAuth()\n@Controller('accessi/console')\nexport class ConsoleEntryController {\n  constructor(@Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions) {}\n\n  private get store(): ConsoleEntryStore {\n    return this.options.consoleEntry?.store ?? getDefaultConsoleEntryStore();\n  }\n\n  private get ttlMs(): number {\n    return this.options.consoleEntry?.ttlMs ?? 60_000;\n  }\n\n  @ApiOperation({\n    summary: 'Emetti un ticket di ingresso alla console',\n    operationId: 'createConsoleEntryTicket',\n    description: 'Riservato agli utenti abilitati alla console (FLGSUPER/FLGADMIN). Restituisce un ticket monouso legato all utente, valido pochi secondi.',\n  })\n  @ApiOkResponse({ type: ConsoleEntryTicketResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n  @ApiResponse({ status: 403, type: ErrorResponse, description: 'Utente non abilitato alla console.' })\n  @UseGuards(JwtSimpleGuard)\n  @Post('entry')\n  async createEntryTicket(@Req() request: Request, @Res() res: Response) {\n    try {\n      const user = getAuthenticatedAccessiUser(request);\n      ensureConsoleAccess(user);\n\n      const tokenValue = extractAccessiBearerToken(request.headers['authorization']);\n      if (!tokenValue) {\n        throw new UnauthorizedException({ code: 'ACCESSI_CONSOLE_ENTRY_TOKEN_MISSING', message: 'Token Accessi mancante.' });\n      }\n\n      const issued = await this.store.issue(\n        { token: tokenValue, codiceUtente: user.codiceUtente },\n        this.ttlMs,\n      );\n      countAccessiMetric(this.options, 'console_ticket_total', { action: 'create', result: 'issued' });\n      return RestUtilities.sendBaseResponse(res, issued);\n    } catch (error) {\n      countAccessiMetric(this.options, 'console_ticket_total', { action: 'create', result: 'error' });\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        ConsoleEntryController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n      );\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Scambia il ticket con la sessione Accessi',\n    operationId: 'exchangeConsoleEntryTicket',\n    description: 'Endpoint pubblico (il ticket e l unica credenziale) protetto da rate limit; il ticket e monouso e scade in pochi secondi.',\n  })\n  @ApiBody({ type: ConsoleEntryExchangeRequest })\n  @ApiOkResponse({ type: ConsoleEntrySessionResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Ticket non valido o scaduto.' })\n  @ApiResponse({ status: 429, type: ErrorResponse, description: 'Troppi tentativi.' })\n  @Post('entry/exchange')\n  async exchangeEntryTicket(\n    @Req() request: Request,\n    @Body() body: ConsoleEntryExchangeRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const decision = await checkPublicAuthRateLimit(this.options, 'consoleEntry', request, [body?.ticket ?? '']);\n      if (!decision.allowed) {\n        countAccessiMetric(this.options, 'console_ticket_total', { action: 'exchange', result: 'rate_limited' });\n        return sendPublicAuthRateLimitExceeded(res, decision.retryAfterSeconds);\n      }\n\n      const entry = await this.store.consume(body?.ticket);\n      if (!entry) {\n        throw new UnauthorizedException({\n          code: 'ACCESSI_CONSOLE_ENTRY_INVALID',\n          message: 'Ticket di ingresso console non valido o scaduto. Riapri la console dal frontend.',\n        });\n      }\n\n      countAccessiMetric(this.options, 'console_ticket_total', { action: 'exchange', result: 'consumed' });\n      const cookieConfig = resolveAccessiAuthCookieOptions(this.options);\n      if (cookieConfig) {\n        setAccessiAuthCookies(res, cookieConfig, { access: entry.token });\n        if (!cookieConfig.exposeTokens) {\n          return RestUtilities.sendBaseResponse(res, {});\n        }\n      }\n      return RestUtilities.sendBaseResponse(res, { token: { value: entry.token, type: 'Bearer' } });\n    } catch (error) {\n      countAccessiMetric(this.options, 'console_ticket_total', {\n        action: 'exchange',\n        result: error instanceof UnauthorizedException ? 'invalid' : 'error',\n      });\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        ConsoleEntryController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.UNAUTHORIZED,\n      );\n    }\n  }\n}\n"]}

package/dist/accessi-module/Dtos/GetUserByTokenRequest.d.ts

@@ -1,3 +1,3 @@
 export declare class GetUserByTokenRequest {
-    token: string;
+    token?: string;
 }

package/dist/accessi-module/Dtos/GetUserByTokenRequest.js

@@ -16,10 +16,11 @@ class GetUserByTokenRequest {
 }
 exports.GetUserByTokenRequest = GetUserByTokenRequest;
 __decorate([
-    (0, swagger_1.ApiProperty)({
-        description: "JWT dell'utente.",
+    (0, swagger_1.ApiPropertyOptional)({
+        description: "JWT dell'utente. In modalita cookie puo essere omesso: si usa il cookie httpOnly o l'header Authorization.",
         example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
     }),
+    (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)({ message: 'Il token deve essere una stringa.' }),
     __metadata("design:type", String)
 ], GetUserByTokenRequest.prototype, "token", void 0);

package/dist/accessi-module/Dtos/GetUserByTokenRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"GetUserByTokenRequest.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/GetUserByTokenRequest.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAA2C;AAE3C,MAAa,qBAAqB;CAOjC;AAPD,sDAOC;AADC;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,kBAAkB;QAC/B,OAAO,EAAE,yCAAyC;KACnD,CAAC;IACD,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;oDAC5C","sourcesContent":["import { ApiProperty } from '@nestjs/swagger';\nimport { IsString } from 'class-validator';\n\nexport class GetUserByTokenRequest {\n  @ApiProperty({\n    description: \"JWT dell'utente.\",\n    example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',\n  })\n  @IsString({ message: 'Il token deve essere una stringa.' })\n  token!: string;\n}\n"]}
+{"version":3,"file":"GetUserByTokenRequest.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/GetUserByTokenRequest.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAsD;AACtD,qDAAuD;AAEvD,MAAa,qBAAqB;CAQjC;AARD,sDAQC;AADC;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,4GAA4G;QACzH,OAAO,EAAE,yCAAyC;KACnD,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;oDAC5C","sourcesContent":["import { ApiPropertyOptional } from '@nestjs/swagger';\nimport { IsOptional, IsString } from 'class-validator';\n\nexport class GetUserByTokenRequest {\n  @ApiPropertyOptional({\n    description: \"JWT dell'utente. In modalita cookie puo essere omesso: si usa il cookie httpOnly o l'header Authorization.\",\n    example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',\n  })\n  @IsOptional()\n  @IsString({ message: 'Il token deve essere una stringa.' })\n  token?: string;\n}\n"]}

package/dist/accessi-module/Dtos/RefreshTokenDtos.d.ts

@@ -1,7 +1,7 @@
 import { BaseResponse } from './BaseResponse';
 import { TokenResult } from './TokenResult';
 export declare class RefreshTokenRequest {
-    refreshToken: string;
+    refreshToken?: string;
 }
 export declare class RefreshTokenResult {
     token: TokenResult;

package/dist/accessi-module/Dtos/RefreshTokenDtos.js

@@ -19,7 +19,10 @@ class RefreshTokenRequest {
 }
 exports.RefreshTokenRequest = RefreshTokenRequest;
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Refresh token emesso al login, 2FA o SSO.' }),
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Refresh token emesso al login, 2FA o SSO. In modalita cookie puo essere omesso.',
+    }),
+    (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)(),
     __metadata("design:type", String)
 ], RefreshTokenRequest.prototype, "refreshToken", void 0);

package/dist/accessi-module/Dtos/RefreshTokenDtos.js.map

@@ -1 +1 @@
-{"version":3,"file":"RefreshTokenDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/RefreshTokenDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,yDAAyC;AACzC,qDAA2D;AAC3D,iDAA8C;AAC9C,+CAA4C;AAE5C,MAAa,mBAAmB;CAI/B;AAJD,kDAIC;AADC;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;IACzE,IAAA,0BAAQ,GAAE;;yDACW;AAGxB,MAAa,kBAAkB;CAU9B;AAVD,gDAUC;AANC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACtE,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BAChB,yBAAW;iDAAC;AAKpB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAC7F,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BACT,yBAAW;wDAAC;AAG7B,MAAa,oBAAqB,SAAQ,2BAAY;CAKrD;AALD,oDAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IACzC,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;8BACtB,kBAAkB;oDAAC","sourcesContent":["import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsString, ValidateNested } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\nimport { TokenResult } from './TokenResult';\n\nexport class RefreshTokenRequest {\n  @ApiProperty({ description: 'Refresh token emesso al login, 2FA o SSO.' })\n  @IsString()\n  refreshToken!: string;\n}\n\nexport class RefreshTokenResult {\n  @ApiProperty({ type: TokenResult, description: 'Nuovo access token.' })\n  @ValidateNested()\n  @Type(() => TokenResult)\n  token!: TokenResult;\n\n  @ApiPropertyOptional({ type: TokenResult, description: 'Nuovo refresh token, se abilitato.' })\n  @ValidateNested()\n  @Type(() => TokenResult)\n  refreshToken?: TokenResult;\n}\n\nexport class RefreshTokenResponse extends BaseResponse {\n  @ApiProperty({ type: RefreshTokenResult })\n  @ValidateNested()\n  @Type(() => RefreshTokenResult)\n  Result!: RefreshTokenResult;\n}\n"]}
+{"version":3,"file":"RefreshTokenDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/RefreshTokenDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,yDAAyC;AACzC,qDAAuE;AACvE,iDAA8C;AAC9C,+CAA4C;AAE5C,MAAa,mBAAmB;CAO/B;AAPD,kDAOC;AADC;IALC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,iFAAiF;KAC/F,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;yDACW;AAGxB,MAAa,kBAAkB;CAU9B;AAVD,gDAUC;AANC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACtE,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BAChB,yBAAW;iDAAC;AAKpB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,yBAAW,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAC7F,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,yBAAW,CAAC;8BACT,yBAAW;wDAAC;AAG7B,MAAa,oBAAqB,SAAQ,2BAAY;CAKrD;AALD,oDAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IACzC,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;8BACtB,kBAAkB;oDAAC","sourcesContent":["import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsOptional, IsString, ValidateNested } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\nimport { TokenResult } from './TokenResult';\n\nexport class RefreshTokenRequest {\n  @ApiPropertyOptional({\n    description: 'Refresh token emesso al login, 2FA o SSO. In modalita cookie puo essere omesso.',\n  })\n  @IsOptional()\n  @IsString()\n  refreshToken?: string;\n}\n\nexport class RefreshTokenResult {\n  @ApiProperty({ type: TokenResult, description: 'Nuovo access token.' })\n  @ValidateNested()\n  @Type(() => TokenResult)\n  token!: TokenResult;\n\n  @ApiPropertyOptional({ type: TokenResult, description: 'Nuovo refresh token, se abilitato.' })\n  @ValidateNested()\n  @Type(() => TokenResult)\n  refreshToken?: TokenResult;\n}\n\nexport class RefreshTokenResponse extends BaseResponse {\n  @ApiProperty({ type: RefreshTokenResult })\n  @ValidateNested()\n  @Type(() => RefreshTokenResult)\n  Result!: RefreshTokenResult;\n}\n"]}

package/dist/accessi-module/Services/AuthService/AuthService.js

@@ -62,6 +62,7 @@ const TwoFactorService_1 = require("../TwoFactorService/TwoFactorService");
 const jwt = __importStar(require("jsonwebtoken"));
 const Orm_1 = require("../../../Orm");
 const Utilities_1 = require("../../../Utilities");
+const metrics_1 = require("../../observability/metrics");
 const StatoRegistrazione_1 = require("../../Dtos/StatoRegistrazione");
 const UserService_1 = require("../UserService/UserService");
 const FiltriService_1 = require("../FiltriService/FiltriService");
@@ -435,7 +436,7 @@ let AuthService = AuthService_1 = class AuthService {
      */
     handleRefreshTokenReuse(params) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c;
+            var _a, _b, _c, _d;
             const configuredGrace = Number((_b = (_a = this.accessiOptions.refreshTokenRotation) === null || _a === void 0 ? void 0 : _a.reuseGraceMs) !== null && _b !== void 0 ? _b : 10000);
             const graceMs = Number.isFinite(configuredGrace) ? Math.max(0, configuredGrace) : 10000;
             const consumedAtMs = params.consumedAtMs;
@@ -451,15 +452,20 @@ let AuthService = AuthService_1 = class AuthService {
                 familyId: params.familyId,
                 consumedAtMs,
             });
+            (0, metrics_1.countAccessiMetric)(this.accessiOptions, 'refresh_reuse_total', {
+                user_sessions_revoked: ((_c = this.accessiOptions.refreshTokenRotation) === null || _c === void 0 ? void 0 : _c.revokeUserSessionsOnReuse) === true,
+            });
             try {
                 if (params.familyId) {
                     yield (0, refreshTokenRotation_1.revokeRefreshTokenFamily)(this.accessiOptions, params.familyId, params.expiresAtMs);
+                    (0, metrics_1.countAccessiMetric)(this.accessiOptions, 'refresh_family_revoked_total', { reason: 'reuse' });
                 }
-                if (((_c = this.accessiOptions.refreshTokenRotation) === null || _c === void 0 ? void 0 : _c.revokeUserSessionsOnReuse) === true) {
+                if (((_d = this.accessiOptions.refreshTokenRotation) === null || _d === void 0 ? void 0 : _d.revokeUserSessionsOnReuse) === true) {
                     yield (0, sessionRevocation_1.revokeAccessiUserSessions)(this.accessiOptions, params.codiceUtente, Date.now(), 'refresh_token_reuse');
                 }
             }
             catch (error) {
+                (0, metrics_1.recordAccessiMetric)('accessi_store_errors_total', 1, { store: 'refresh_token_rotation' });
                 // La revoca e best effort: il token presentato resta comunque rifiutato.
                 this.logger.error(`Revoca famiglia refresh token fallita: ${error instanceof Error ? error.message : String(error)}`);
             }

package/dist/accessi-module/Services/AuthService/AuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AuthService/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAwG;AACxG,mCAAoC;AACpC,2EAAwF;AACxF,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,sEAAmE;AACnE,4DAAyD;AACzD,kEAA+D;AAC/D,0EAK2C;AAC3C,0EAG2C;AAC3C,wEAI0C;AAC1C,8EAK6C;AAC7C,gDAAoD;AACpD,oEAMwC;AACxC,kEAAqE;AACrE,4CAAyC;AAGzC,8EAA8E;AACjE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAiB1D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,aAA4B,EACT,cAA+C,EACzD,gBAAkC;QAH3C,gBAAW,GAAX,WAAW,CAAa;QACxB,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QACzD,qBAAgB,GAAhB,gBAAgB,CAAkB;QANpC,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qFAAqF;QACrF,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,CAAC;IAClC,CAAC;IAEO,WAAW,CACjB,MAA6B,EAC7B,OAAiB,EACjB,IAA0B,EAC1B,eAAyC,EAAE;;QAE3C,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACpH,MAAM,IAAI,8BAAqB,CAAC,2CAA2C,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,YAAY,CAAC,SAAS,mCAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QACrF,MAAM,gBAAgB,GAAG,OAAO,SAAS,KAAK,QAAQ;YACpD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS;YAChC,CAAC,CAAC,IAAA,qDAAmC,EAAC,IAAI,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,IAAA,oDAAkC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,iCAEf,CAAC,MAAA,YAAY,CAAC,WAAW,mCAAI,EAAE,CAAC,KACnC,MAAM,EACN,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,qEAAqE;YACrE,8DAA8D;YAC9D,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,KAEnB,OAAO,CAAC,GAAG,kBAET,SAAS,EAAE,SAAyC,EACpD,SAAS,EAAE,OAAO,CAAC,SAAS,IACzB,OAAO,CAAC,WAAW,EAEzB,CAAC;QAEF,wFAAwF;QACxF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,cAAc,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,IAAI,OAAO,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG,CAAA,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,8EAA8E;QAC9E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7G,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC;QAEhF,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED,+EAA+E;IACxE,kBAAkB,CACvB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,eAAyC,EAAE;QAE3C,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnE,CAAC;IAED,kFAAkF;IAC3E,kBAAkB,CACvB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,eAAyC,EAAE;QAE3C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAClE,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,kCAC7C,YAAY,KACf,SAAS,IACT,CAAC;IACL,CAAC;IAED,uEAAuE;IAChE,eAAe,CACpB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,OAA+B;;QAE/B,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,mCAAI,IAAA,mBAAU,GAAE,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7F,uBAAS,MAAM,IAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAG;IACrD,CAAC;IAED;;;OAGG;IACI,kBAAkB,CACvB,MAA6B,EAC7B,KAA+C;QAE/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;YACnD,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE;oBACH,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;oBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IAC5E,qBAAqB,CAAC,YAAoB,EAAE,KAAc;;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAC3C,EAAE,YAAY,EAAE,kBACd,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,IAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACjF,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAA,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,CAAC,IAAA,qDAAgC,EAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YACzG,MAAM,CAAC,MAAM,mCAAQ,MAAM,CAAC,MAAM,GAAK,OAAO,CAAE,CAAC;YAEjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC;QACJ,CAAC;KAAA;IAED,8EAA8E;IAChE,sBAAsB,CAAC,YAAoB;;;YACvD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE/E,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAmD,CAAC;YACnH,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,GAAG,CAAC;QAC9H,CAAC;KAAA;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAqB;;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,wBAAwB,EAAE,CAAC;gBACxH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YAChK,CAAC;YACD,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAEzD,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,+BAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB;oBAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,CAAC,CAAC,SAAS,CAAC;gBAEd,qGAAqG;gBACrG,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACnJ,CAAC;YAED,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;KAAA;IAED;;;;;OAKG;IACU,qBAAqB,CAAC,KAAa;;YAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,yDAAuC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClF,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;YACzD,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBACvG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IACE,CAAC,WAAW;gBACZ,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAC9C,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EACnD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,YAAY;gBACZ,OAAO,EAAE,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC;aAC9D,CAAC;QACJ,CAAC;KAAA;IAED;;;OAGG;IACU,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,aAAa,CAAC,OAAO,CAAC;QAC/B,CAAC;KAAA;IAED;;;;OAIG;IACU,kBAAkB,CAAC,YAAoB;;YAClD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACrD,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnE,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,0DAAwC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnF,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,YAAY,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;YAChE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC7E,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,8BAAqB,CAAC,0CAA0C,CAAC,CAAC;YAC9E,CAAC;YAED,MAAM,aAAa,GAAG,OAA0D,CAAC;YACjF,MAAM,QAAQ,GAAG,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;gBACvF,CAAC,CAAC,aAAa,CAAC,GAAG;gBACnB,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,GAAG,GAAG,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAE5C,4EAA4E;YAC5E,2EAA2E;YAC3E,IAAI,MAAM,IAAA,kDAA2B,EAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,8BAAqB,CAAC;oBAC9B,IAAI,EAAE,gCAAgC;oBACtC,OAAO,EAAE,yDAAyD;iBACnE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,IAAA,yCAAqB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBACvG,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,aAAa,GAAG,IAAA,mDAA4B,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxE,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,8BAAqB,CAAC,wCAAwC,CAAC,CAAC;gBAC5E,CAAC;gBACD,IAAI,OAAO,CAAC;gBACZ,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAA,0CAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;gBAClF,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,oCAA2B,CAAC;wBACpC,IAAI,EAAE,sCAAsC;wBAC5C,OAAO,EAAE,6DAA6D;qBACvE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACjC,MAAM,IAAI,CAAC,uBAAuB,CAAC;wBACjC,YAAY;wBACZ,GAAG;wBACH,QAAQ;wBACR,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,WAAW,EAAE,SAAS,GAAG,IAAI;qBAC9B,CAAC,CAAC;oBACH,MAAM,IAAI,8BAAqB,CAAC;wBAC9B,IAAI,EAAE,6BAA6B;wBACnC,OAAO,EAAE,+BAA+B;qBACzC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAE,OAA6B,CAAC,GAAG,CAAC;gBAC/D,CAAC,CAAC,CAAE,OAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC;gBACxG,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAED;;;;;;;OAOG;IACW,uBAAuB,CAAC,MAMrC;;;YACC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAA,MAAA,IAAI,CAAC,cAAc,CAAC,oBAAoB,0CAAE,YAAY,mCAAI,KAAM,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC;YACzF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;YACzC,IACE,OAAO,GAAG,CAAC;mBACR,YAAY,KAAK,SAAS;mBAC1B,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;mBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,IAAI,OAAO,EACvC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAA,oBAAY,EAAC,6BAA6B,EAAE;gBAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY;aACb,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACpB,MAAM,IAAA,+CAAwB,EAC5B,IAAI,CAAC,cAAc,EACnB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,WAAW,CACnB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,oBAAoB,0CAAE,yBAAyB,MAAK,IAAI,EAAE,CAAC;oBACjF,MAAM,IAAA,6CAAyB,EAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAC;gBAC/G,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yEAAyE;gBACzE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0CAA0C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAED,+FAA+F;IAClF,uBAAuB,CAAC,YAAoB,EAAE,WAAmB;;;YAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACvG,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACrI,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAqB;;;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrF,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7I,MAAM,IAAI,8BAAqB,CAAC,8DAA8D,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAAE,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;YAC7I,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;YACzJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,CAAA;oBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;gBAC7F,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAC9D,6KAA6K,EAC7K,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB,EAAE,IAAY,EAAE,KAAc;;YAC5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;YACzD,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,qEAAqE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACpJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,kFAAkF,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAClK,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB;;YAC9C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,CAAC;KAAA;IAED;;;;;;OAMG;IACU,WAAW,CACtB,YAAoB,EACpB,aAAqB,EACrB,OAA+D;;YAE/D,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,MAAK,KAAK,EAAE,CAAC;gBACrC,IAAA,qCAAoB,EAAC,aAAa,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,MAAK,KAAK,EAAE,CAAC;oBACtC,MAAM,IAAI,CAAC,iCAAiC,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBAChF,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAED;;;;OAIG;IACW,iCAAiC,CAAC,YAAoB,EAAE,MAAc;;YAClF,IAAI,CAAC;gBACH,MAAM,IAAA,yDAAqC,EAAC,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wCAAwC,YAAY,KAAK,MAAM,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9H,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACU,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAED,yGAAyG;IACnG,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEvC,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE;wBAClD,aAAa,EAAE,KAAK;wBACpB,cAAc,EAAE,KAAK;qBACtB,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,6BAAiB,CAAC,sBAAsB,CACpE,cAAc,EACd,uBAAuB,CACxB,CAAC;YAEF,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE;oBAClD,aAAa,EAAE,KAAK;oBACpB,cAAc,EAAE,KAAK;iBACtB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAED,8GAA8G;IACxG,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,2EAA2E;IAC3E,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACU,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IAAA,qCAAoB,EAAC,WAAW,CAAC,CAAC;gBAElC,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACjE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAEnE,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;;oBACnF,6EAA6E;oBAC7E,+EAA+E;oBAC/E,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,gBAAgB,CACxC,WAAW,EACX,mHAAmH,EACnH,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uCAAkB,CAAC,IAAI,EAAE,uCAAkB,CAAC,KAAK,CAAC,CAClG,CAAC;oBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;oBACnG,IAAI,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBAC3E,CAAC;oBAED,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,gFAAgF,EAChF,CAAC,YAAY,EAAE,cAAc,CAAC,CAC/B,CAAC;oBAEF,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;wBAChE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,yCAAyC,cAAc,6CAA6C,EACpG,CAAC,YAAY,CAAC,CACf,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAA,CAAC,CAAC;gBAEH,6EAA6E;gBAC7E,MAAM,IAAI,CAAC,iCAAiC,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAryBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFL,yBAAW;QACT,6BAAa,UAED,mCAAgB;GAP1C,WAAW,CAqyBvB","sourcesContent":["import { Inject, Injectable, ServiceUnavailableException, UnauthorizedException } from \"@nestjs/common\";\nimport { randomUUID } from \"crypto\";\nimport { TwoFactorService, TwoFactorProof } from '../TwoFactorService/TwoFactorService';\nimport * as jwt from \"jsonwebtoken\";\nimport { Orm } from \"../../../Orm\";\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\nimport type { AccessiOptions } from \"../../AccessiModule\";\nimport { LoginRequest } from \"../../Dtos/LoginRequest\";\nimport { LoginResult } from \"../../Dtos/LoginResponse\";\nimport { StatoRegistrazione } from \"../../Dtos/StatoRegistrazione\";\nimport { UserService } from \"../UserService/UserService\";\nimport { FiltriService } from \"../FiltriService/FiltriService\";\nimport {\n  buildAuthenticatedTokenPayload,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../../security/authenticatedToken\";\nimport {\n  getAccessiJwtSecret,\n  verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport {\n  isAccessiTokenRevoked,\n  revokeAccessiUserSessions,\n  revokeAccessiUserSessionsIfConfigured,\n} from \"../../security/sessionRevocation\";\nimport {\n  consumeRefreshToken,\n  getRefreshTokenRotationStore,\n  isRefreshTokenFamilyRevoked,\n  revokeRefreshTokenFamily,\n} from \"../../security/refreshTokenRotation\";\nimport { auditAccessi } from \"../../security/audit\";\nimport {\n  getAccessiAccessTokenSigningConfig,\n  getAccessiAccessTokenVerificationConfig,\n  getAccessiRefreshTokenSigningConfig,\n  getAccessiRefreshTokenVerificationConfig,\n  verifyAccessiJwt,\n} from \"../../security/jwtTokenOptions\";\nimport { assertStrongPassword } from '../../security/passwordPolicy';\nimport { Logger } from \"../../../Logger\";\nimport { TokenResult } from '../../Dtos/TokenResult';\n\n/** Error code deliberately returned when a user is configured as SSO-only. */\nexport const PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';\n\n/** Esito di una verifica token usata dall'endpoint di introspection. */\nexport interface AccessiTokenIntrospectionResult {\n  active: boolean;\n  codiceUtente?: number;\n  payload?: Record<string, unknown>;\n}\n\ninterface AccessiTokenIssueOptions {\n  /** Sovrascrive jwtOptions.expiresIn per token a durata ridotta (es. Login as). */\n  expiresIn?: string | number;\n  /** Claim aggiuntive, per esempio l'attore che ha generato un token di impersonazione. */\n  extraClaims?: Record<string, unknown>;\n}\n\n@Injectable()\nexport class AuthService {\n  private readonly logger = new Logger(AuthService.name);\n\n  constructor(\n    private userService: UserService,\n    private filtriService: FiltriService,\n    @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions,\n    private readonly twoFactorService: TwoFactorService,\n  ) {}\n\n  private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\n    if (!this.accessiOptions.passwordExpiration) {\n      return;\n    }\n\n    const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\n    const expirationDays =\n      Number.isFinite(configuredDays) && configuredDays > 0\n        ? Math.trunc(configuredDays)\n        : 90;\n\n    const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\n    await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n  }\n\n  private isMockDemoUserEnabled(): boolean {\n    if (!this.accessiOptions.mockDemoUser) {\n      return false;\n    }\n\n    // La backdoor mock non e mai attiva in produzione, nemmeno con variabili d'ambiente,\n    // perche emette un superutente senza verifica password.\n    const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\n    return nodeEnv !== \"production\";\n  }\n\n  private createToken(\n    utente: LoginResult['utente'],\n    methods: string[],\n    type: 'access' | 'refresh',\n    tokenOptions: AccessiTokenIssueOptions = {},\n  ): TokenResult {\n    if (!utente?.codiceUtente) {\n      throw new Error('Impossibile creare un token senza un utente Accessi valido.');\n    }\n    const loginAs = methods.includes('login_as');\n    if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp') && !loginAs) {\n      throw new UnauthorizedException('Verifica del codice di accesso richiesta.');\n    }\n\n    const expiresIn = tokenOptions.expiresIn ?? this.accessiOptions.jwtOptions.expiresIn;\n    const expiresInIsValid = typeof expiresIn === 'number'\n      ? Number.isFinite(expiresIn) && expiresIn > 0\n      : typeof expiresIn === 'string' && expiresIn.trim() !== '';\n    if (!expiresInIsValid) {\n      throw new Error('Durata token non configurata: impossibile emettere token senza scadenza.');\n    }\n\n    const signing = type === 'refresh'\n      ? getAccessiRefreshTokenSigningConfig(this.accessiOptions)\n      : getAccessiAccessTokenSigningConfig(this.accessiOptions);\n    const token = jwt.sign(\n      {\n        ...(tokenOptions.extraClaims ?? {}),\n        utente,\n        typ: type,\n        amr: methods,\n        jti: randomUUID(),\n        // Millisecondi: rende deterministica la revoca sessioni anche quando\n        // il token e emesso nello stesso secondo del cambio password.\n        iatMs: Date.now(),\n      },\n      signing.key,\n      {\n        expiresIn: expiresIn as jwt.SignOptions['expiresIn'],\n        algorithm: signing.algorithm,\n        ...signing.signOptions,\n      },\n    );\n\n    // Difesa in profondita: un `expiresIn` malformato farebbe emettere un token permanente.\n    const decoded = jwt.decode(token);\n    const decodedPayload = decoded && typeof decoded === 'object' ? decoded as jwt.JwtPayload : undefined;\n    if (typeof decodedPayload?.exp !== 'number') {\n      throw new Error('Token emesso senza scadenza: configurazione JWT non valida.');\n    }\n\n    // Il contratto TokenResult espone sempre la validita in secondi, anche quando\n    // jwtOptions.expiresIn usa un formato leggibile come '24h'.\n    const issuedAt = typeof decodedPayload.iat === 'number' ? decodedPayload.iat : Math.floor(Date.now() / 1000);\n    const expiresInSeconds = Math.max(0, Math.trunc(decodedPayload.exp - issuedAt));\n\n    return {\n      expiresIn: String(expiresInSeconds),\n      value: token,\n      type: 'Bearer',\n    };\n  }\n\n  /** Creates the normal internal JWT consumed by all existing Accessi guards. */\n  public createAccessiToken(\n    utente: LoginResult['utente'],\n    methods: string[] = [],\n    tokenOptions: AccessiTokenIssueOptions = {},\n  ): TokenResult {\n    return this.createToken(utente, methods, 'access', tokenOptions);\n  }\n\n  /** Emette il refresh token quando `jwtOptions.refreshExpiresIn` e configurato. */\n  public createRefreshToken(\n    utente: LoginResult['utente'],\n    methods: string[] = [],\n    tokenOptions: AccessiTokenIssueOptions = {},\n  ): TokenResult | undefined {\n    const expiresIn = this.accessiOptions.jwtOptions.refreshExpiresIn;\n    if (!expiresIn) return undefined;\n    return this.createToken(utente, methods, 'refresh', {\n      ...tokenOptions,\n      expiresIn,\n    });\n  }\n\n  /** Crea la coppia access + refresh token usata da login, 2FA e SSO. */\n  public createTokenPair(\n    utente: LoginResult['utente'],\n    methods: string[] = [],\n    options?: { familyId?: string },\n  ): { access: TokenResult; refresh?: TokenResult } {\n    // La famiglia identifica il login: access e refresh condividono lo stesso\n    // `fid`, cosi la revoca per riuso sospetto invalida entrambi.\n    const familyId = options?.familyId ?? randomUUID();\n    const access = this.createAccessiToken(utente, methods, { extraClaims: { fid: familyId } });\n    const refresh = this.createRefreshToken(utente, methods, { extraClaims: { fid: familyId } });\n    return { access, ...(refresh ? { refresh } : {}) };\n  }\n\n  /**\n   * Emette l'access token per l'utente target, con l'attore registrato nelle\n   * claim `act` e `loginAs`. La durata e' quella standard di jwtOptions.expiresIn.\n   */\n  public createLoginAsToken(\n    utente: LoginResult['utente'],\n    actor: { codiceUtente: number; email?: string },\n  ): TokenResult {\n    return this.createAccessiToken(utente, ['login_as'], {\n      extraClaims: {\n        loginAs: true,\n        act: {\n          sub: String(actor.codiceUtente),\n          email: actor.email,\n        },\n      },\n    });\n  }\n\n  /** Builds the standard login response for a user authenticated by a supported method. */\n  public async getLoginResultForUser(codiceUtente: number, scope?: string): Promise<LoginResult> {\n    const users = await this.userService.getUsers(\n      { codiceUtente },\n      { includeExtensionFields: true, includeGrants: true, ...(scope ? { scope } : {}) },\n    );\n    const result = users[0];\n    if (!result?.utente) {\n      throw new Error('Utente Accessi non trovato.');\n    }\n    const current = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(current)) throw new UnauthorizedException('Utente non abilitato.');\n    result.utente = { ...result.utente, ...current };\n\n    return {\n      utente: result.utente,\n      filtri: await this.filtriService.getFiltriUser(codiceUtente),\n      userGrants: result.userGrants,\n      extensionFields: result.extensionFields,\n    };\n  }\n\n  /** Users without a row retain the historic password-login enabled default. */\n  private async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n    if (this.accessiOptions.federatedAuthentication?.enabled !== true) return true;\n\n    const rows = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n      [codiceUtente],\n    );\n    const policy = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { passwordLoginEnabled?: unknown } | undefined;\n    return policy?.passwordLoginEnabled !== false && policy?.passwordLoginEnabled !== 0 && policy?.passwordLoginEnabled !== '0';\n  }\n\n  /**\n   * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.\n   * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.\n   * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.\n   */\n  async login(request: LoginRequest): Promise<LoginResult> {\n    const mockDemoUserEnabled = this.isMockDemoUserEnabled();\n\n    if (\n      mockDemoUserEnabled &&\n      request.email.toLowerCase() === \"demo\"\n    ) {\n      return this.getDemoUser();\n    }\n\n    if (\n      mockDemoUserEnabled &&\n      request.email.toLowerCase() === \"admin\"\n    ) {\n      return this.getAdminUser();\n    }\n\n    const utente = await this.userService.getUserByEmail(\n      request.email.trim().toLowerCase()\n    );\n    if (!utente) {\n      if (!request.password) return { passwordRequired: true };\n      throw new Error(\"Nome utente o password errata!\");\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);\n    if (isAuthenticatedUserEnabledForJwt(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {\n      return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: (currentUser.email ?? '').trim(), mode: 'passwordless' }) };\n    }\n    // The email-only step has the same response for unknown and ordinary local accounts.\n    if (!request.password) return { passwordRequired: true };\n\n    switch (utente.statoRegistrazione) {\n      case undefined:\n        throw new Error(\n          \"Struttura dati compromessa: Stato Registrazione inesistente.\"\n        );\n      case StatoRegistrazione.BLOCC:\n      case StatoRegistrazione.DELETE:\n        throw new Error(\"Utente non abilitato\");\n      case StatoRegistrazione.INVIO:\n        throw new Error(\"Rinnovo password necessario.\");\n    }\n\n    if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\n      throw new Error(\n        `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\n      );\n    }\n\n    if (!isAuthenticatedUserEnabledForJwt(currentUser)) throw new Error('Utente non abilitato');\n    if (!(await this.isPasswordLoginEnabled(utente.codiceUtente))) {\n      throw new Error(PASSWORD_LOGIN_DISABLED);\n    }\n\n    if (typeof request.password !== 'string' || request.password.length === 0) {\n      throw new Error('Nome utente o password errata!');\n    }\n\n    const isPasswordValid = await this.verifyPassword(\n      utente.codiceUtente,\n      request.password\n    );\n    if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\n\n    if (\n      this.accessiOptions.passwordExpiration &&\n      this.accessiOptions.passwordExpiration == true\n    ) {\n      const today = new Date();\n      const targetDate = utente.dataScadenzaPassword\n        ? new Date(utente.dataScadenzaPassword)\n        : undefined;\n\n      // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.\n      if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {\n        throw new Error(\"PASSWORD_EXPIRED\");\n      }\n    }\n\n    if (currentUser.flagDueFattori) {\n      return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email ?? '', mode: 'password' }) };\n    }\n\n    const updateLastAccessDateQuery =\n      \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\n    await Orm.query(\n      this.accessiOptions.databaseOptions,\n      updateLastAccessDateQuery,\n      [utente.codiceUtente]\n    );\n\n    return this.getLoginResultForUser(utente.codiceUtente, request.scope);\n  }\n\n  /**\n   * Verifica un access token Accessi senza sollevare eccezioni per token invalidi.\n   *\n   * Gli errori di configurazione o database continuano a propagarsi: un problema\n   * infrastrutturale non deve essere confuso con un token scaduto.\n   */\n  public async introspectAccessToken(token: string): Promise<AccessiTokenIntrospectionResult> {\n    if (typeof token !== \"string\" || token.trim() === \"\") {\n      return { active: false };\n    }\n\n    const verification = getAccessiAccessTokenVerificationConfig(this.accessiOptions);\n    let decoded: unknown;\n    try {\n      decoded = verifyAccessiJwt(token.trim(), verification);\n    } catch {\n      return { active: false };\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n    if (!codiceUtente) {\n      return { active: false };\n    }\n    if (await isAccessiTokenRevoked(this.accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n      return { active: false };\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (\n      !currentUser ||\n      !isAuthenticatedUserEnabledForJwt(currentUser) ||\n      !isAccessiTokenAllowedForUser(decoded, currentUser)\n    ) {\n      return { active: false };\n    }\n\n    return {\n      active: true,\n      codiceUtente,\n      payload: buildAuthenticatedTokenPayload(decoded, currentUser),\n    };\n  }\n\n  /**\n   * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.\n   * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.\n   */\n  public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\n    if (typeof token !== \"string\" || token.trim() === \"\") {\n      throw new Error(\"Token non fornito.\");\n    }\n\n    const introspection = await this.introspectAccessToken(token);\n    if (!introspection.active || !introspection.payload) {\n      throw new Error(\"Token non valido o utente non autorizzato.\");\n    }\n\n    return introspection.payload;\n  }\n\n  /**\n   * Scambia un refresh token valido con una nuova coppia access + refresh.\n   *\n   * Il refresh token non e accettato dai guard API: ha `typ: \"refresh\"`.\n   */\n  public async refreshAccessToken(refreshToken: string): Promise<LoginResult> {\n    if (!this.accessiOptions.jwtOptions.refreshExpiresIn) {\n      throw new UnauthorizedException('Refresh token non abilitato.');\n    }\n    if (typeof refreshToken !== 'string' || refreshToken.trim() === '') {\n      throw new UnauthorizedException('Refresh token mancante.');\n    }\n\n    const verification = getAccessiRefreshTokenVerificationConfig(this.accessiOptions);\n    let decoded: unknown;\n    try {\n      decoded = verifyAccessiJwt(refreshToken.trim(), verification);\n    } catch {\n      throw new UnauthorizedException('Refresh token non valido o scaduto.');\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded, 'refresh');\n    if (!codiceUtente) {\n      throw new UnauthorizedException('Refresh token privo di un utente valido.');\n    }\n\n    const decodedRecord = decoded as { jti?: unknown; fid?: unknown; exp?: unknown };\n    const familyId = typeof decodedRecord.fid === 'string' && decodedRecord.fid.trim() !== ''\n      ? decodedRecord.fid\n      : undefined;\n    const jti = typeof decodedRecord.jti === 'string' ? decodedRecord.jti : undefined;\n    const expiresAt = Number(decodedRecord.exp);\n\n    // La famiglia va controllata per prima: un token appena emesso da uno store\n    // compromesso deve produrre un codice stabile, non il generico 401 utente.\n    if (await isRefreshTokenFamilyRevoked(this.accessiOptions, familyId)) {\n      throw new UnauthorizedException({\n        code: 'ACCESSI_REFRESH_FAMILY_REVOKED',\n        message: 'Sessione revocata per riuso sospetto del refresh token.',\n      });\n    }\n\n    if (await isAccessiTokenRevoked(this.accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n      throw new UnauthorizedException('Sessione revocata.');\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw new UnauthorizedException('Utente non piu autorizzato.');\n    }\n\n    const rotationStore = getRefreshTokenRotationStore(this.accessiOptions);\n    if (rotationStore) {\n      if (!jti || !Number.isFinite(expiresAt)) {\n        throw new UnauthorizedException('Refresh token privo di jti o scadenza.');\n      }\n      let outcome;\n      try {\n        outcome = await consumeRefreshToken(this.accessiOptions, jti, expiresAt * 1000);\n      } catch {\n        throw new ServiceUnavailableException({\n          code: 'ACCESSI_REFRESH_ROTATION_UNAVAILABLE',\n          message: 'Rotazione refresh token non disponibile. Riprova piu tardi.',\n        });\n      }\n      if (outcome && !outcome.consumed) {\n        await this.handleRefreshTokenReuse({\n          codiceUtente,\n          jti,\n          familyId,\n          consumedAtMs: outcome.consumedAtMs,\n          expiresAtMs: expiresAt * 1000,\n        });\n        throw new UnauthorizedException({\n          code: 'ACCESSI_REFRESH_TOKEN_REUSE',\n          message: 'Refresh token gia utilizzato.',\n        });\n      }\n    }\n\n    const login = await this.getLoginResultForUser(codiceUtente);\n    const methods = Array.isArray((decoded as { amr?: unknown }).amr)\n      ? ((decoded as { amr: unknown[] }).amr.filter((method): method is string => typeof method === 'string'))\n      : [];\n    const pair = this.createTokenPair(login.utente, methods, { familyId });\n    login.token = pair.access;\n    if (pair.refresh) login.refreshToken = pair.refresh;\n    return login;\n  }\n\n  /**\n   * Gestisce il riuso di un refresh token gia consumato.\n   *\n   * Il riuso entro `reuseGraceMs` e trattato come retry concorrente del client e\n   * non revoca nulla. Oltre la finestra e considerato un possibile furto: viene\n   * revocata l'intera famiglia (stesso login) e, solo se esplicitamente\n   * configurato, anche le altre sessioni dell'utente.\n   */\n  private async handleRefreshTokenReuse(params: {\n    codiceUtente: number;\n    jti: string;\n    familyId?: string;\n    consumedAtMs?: number;\n    expiresAtMs: number;\n  }): Promise<void> {\n    const configuredGrace = Number(this.accessiOptions.refreshTokenRotation?.reuseGraceMs ?? 10_000);\n    const graceMs = Number.isFinite(configuredGrace) ? Math.max(0, configuredGrace) : 10_000;\n    const consumedAtMs = params.consumedAtMs;\n    if (\n      graceMs > 0\n      && consumedAtMs !== undefined\n      && Number.isFinite(consumedAtMs)\n      && Date.now() - consumedAtMs <= graceMs\n    ) {\n      return;\n    }\n\n    auditAccessi('accessi_refresh_token_reuse', {\n      codiceUtente: params.codiceUtente,\n      jti: params.jti,\n      familyId: params.familyId,\n      consumedAtMs,\n    });\n\n    try {\n      if (params.familyId) {\n        await revokeRefreshTokenFamily(\n          this.accessiOptions,\n          params.familyId,\n          params.expiresAtMs,\n        );\n      }\n      if (this.accessiOptions.refreshTokenRotation?.revokeUserSessionsOnReuse === true) {\n        await revokeAccessiUserSessions(this.accessiOptions, params.codiceUtente, Date.now(), 'refresh_token_reuse');\n      }\n    } catch (error) {\n      // La revoca e best effort: il token presentato resta comunque rifiutato.\n      this.logger.error(\n        `Revoca famiglia refresh token fallita: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n  }\n\n  /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */\n  public async beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori) throw new UnauthorizedException();\n    return { challenge: await this.twoFactorService.issue({ codiceUtente, email: user.email ?? '', mode: 'federated', identityKey }) };\n  }\n\n  private async validateTwoFactorProof(proof: TwoFactorProof): Promise<void> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori || user.email?.trim().toLowerCase() !== proof.email.trim().toLowerCase()) {\n      throw new UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');\n    }\n    if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled) throw new UnauthorizedException('Accesso senza password disabilitato.');\n    if (proof.mode === 'password' && !(await this.isPasswordLoginEnabled(proof.codiceUtente))) throw new UnauthorizedException('Login locale disabilitato.');\n    if (proof.mode === 'federated') {\n      if (!this.accessiOptions.federatedAuthentication?.enabled) throw new UnauthorizedException();\n      const rows = await Orm.query(this.accessiOptions.databaseOptions,\n        'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1',\n        [proof.identityKey, proof.codiceUtente], false);\n      if (!rows.length) throw new UnauthorizedException('Identita SSO non piu abilitata.');\n    }\n  }\n\n  public async verifyTwoFactor(challengeId: string, code: string, scope?: string): Promise<LoginResult> {\n    const proof = await this.twoFactorService.consume(challengeId, code);\n    await this.validateTwoFactorProof(proof);\n    const result = await this.getLoginResultForUser(proof.codiceUtente, scope);\n    const tokens = this.createTokenPair(result.utente, [proof.mode, 'otp']);\n    result.token = tokens.access;\n    if (tokens.refresh) result.refreshToken = tokens.refresh;\n    await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);\n    if (proof.mode === 'federated') {\n      await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);\n    }\n    return result;\n  }\n\n  public async resendTwoFactor(challengeId: string): Promise<LoginResult> {\n    await this.validateTwoFactorProof(await this.twoFactorService.describe(challengeId));\n    return { challenge: await this.twoFactorService.resend(challengeId) };\n  }\n\n  /**\n   * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.\n   * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di\n   * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.\n   * Con `revokeSessions` (default true) invalida le sessioni precedenti: un cambio password deve\n   * interrompere i token gia emessi.\n   */\n  public async setPassword(\n    codiceUtente: number,\n    nuovaPassword: string,\n    options?: { enforcePolicy?: boolean; revokeSessions?: boolean },\n  ) {\n    if (options?.enforcePolicy !== false) {\n      assertStrongPassword(nuovaPassword);\n    }\n    try {\n      const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\n      const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\n\n      const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\n        codiceUtente,\n        hashedPassword,\n      ]);\n      await this.refreshPasswordExpiration(codiceUtente);\n      if (options?.revokeSessions !== false) {\n        await this.revokeSessionsAfterSecurityChange(codiceUtente, 'password_change');\n      }\n      return result;\n    } catch (error) {\n      throw error;\n    }\n  }\n\n  /**\n   * Revoca le sessioni dopo un evento che deve invalidare i token esistenti.\n   * Best effort: un errore dello store non deve annullare l'operazione gia\n   * persistita (cambio password, blocco, cancellazione).\n   */\n  private async revokeSessionsAfterSecurityChange(codiceUtente: number, reason: string): Promise<void> {\n    try {\n      await revokeAccessiUserSessionsIfConfigured(this.accessiOptions, codiceUtente, reason);\n    } catch (error) {\n      this.logger.error(\n        `Revoca sessioni fallita per l'utente ${codiceUtente} (${reason}): ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n  }\n\n  /**\n   * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.\n   * E idempotente: hash moderni e gia migrati vengono ignorati.\n   */\n  public async migrateLegacyEncryptedPasswords(): Promise<void> {\n    const startedAt = performance.now();\n    this.logger.info(\"Avvio migrazione password legacy accessi.\");\n    const results = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n      []\n    );\n\n    const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\n      codiceUtente?: number;\n      password?: string;\n    }[];\n    let migratedCount = 0;\n    let skippedCount = 0;\n\n    for (const row of rows) {\n      const codiceUtente = Number(row.codiceUtente);\n      const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\n      if (\n        !codiceUtente ||\n        !storedPassword ||\n        PasswordUtilities.isPasswordHash(storedPassword) ||\n        PasswordUtilities.isLegacyPasswordHash(storedPassword)\n      ) {\n        skippedCount += 1;\n        continue;\n      }\n\n      const protectedLegacyPassword =\n        PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\n\n      await Orm.execute(\n        this.accessiOptions.databaseOptions,\n        \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n        [protectedLegacyPassword, codiceUtente, storedPassword]\n      );\n      migratedCount += 1;\n    }\n\n    this.logger.info(\n      `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n    );\n  }\n\n  /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */\n  async verifyPassword(\n    codiceUtente: number,\n    plainPassword: string\n  ): Promise<boolean> {\n    const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\n    const result = (await Orm.query(\n      this.accessiOptions.databaseOptions,\n      query,\n      [codiceUtente]\n    ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\n      password: string;\n    }[];\n\n    const stored = result[0];\n    if (!stored || typeof stored.password !== \"string\") {\n      return false;\n    }\n\n    const storedPassword = stored.password;\n\n    if (PasswordUtilities.isPasswordHash(storedPassword)) {\n      return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\n    }\n\n    const legacyEncryptedPassword = CryptUtilities.encrypt(\n      plainPassword,\n      this.accessiOptions.encryptionKey\n    );\n\n    if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\n      const isMigratedLegacyPasswordValid =\n        PasswordUtilities.verifyLegacyEncryptedPassword(\n          legacyEncryptedPassword,\n          storedPassword\n        );\n\n      if (isMigratedLegacyPasswordValid) {\n        await this.setPassword(codiceUtente, plainPassword, {\n          enforcePolicy: false,\n          revokeSessions: false,\n        });\n      }\n\n      return isMigratedLegacyPasswordValid;\n    }\n\n    const isLegacyPasswordValid = PasswordUtilities.timingSafeStringEquals(\n      storedPassword,\n      legacyEncryptedPassword,\n    );\n\n    if (isLegacyPasswordValid) {\n      await this.setPassword(codiceUtente, plainPassword, {\n        enforcePolicy: false,\n        revokeSessions: false,\n      });\n    }\n\n    return isLegacyPasswordValid;\n  }\n\n  /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */\n  async getAdminUser(): Promise<LoginResult> {\n    return {\n      utente: {\n        codiceUtente: 6789,\n        email: \"admin\",\n        statoRegistrazione: StatoRegistrazione.CONF,\n        cognome: \"Admin\",\n        nome: \"Admin\",\n        flagGdpr: true,\n        avatar: \"/path/to/avatar.jpg\",\n        flagDueFattori: false,\n        codiceLingua: \"IT\",\n        cellulare: \"+391234567890\",\n        flagSuper: true,\n        roles: [],\n        permissions: [],\n      },\n      filtri: null,\n      userGrants: {\n        abilitazioni: [],\n        grants: [],\n        ruoli: [],\n      },\n    };\n  }\n\n  /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */\n  getDemoUser(): LoginResult {\n    return {\n      utente: {\n        codiceUtente: 12345,\n        email: \"jdoe\",\n        statoRegistrazione: StatoRegistrazione.CONF,\n        cognome: \"Doe\",\n        nome: \"John\",\n        flagGdpr: true,\n        avatar: \"/path/to/avatar.jpg\",\n        flagDueFattori: false,\n        codiceLingua: \"IT\",\n        cellulare: \"+391234567890\",\n        flagSuper: false,\n        roles: [],\n        permissions: [],\n      },\n      filtri: null,\n      userGrants: {\n        abilitazioni: [],\n        grants: [],\n        ruoli: [],\n      },\n    };\n  }\n\n  /**\n   * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.\n   * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.\n   */\n  public async confirmResetPassword(\n    token: string,\n    newPassword: string\n  ): Promise<void> {\n    try {\n      if (typeof token !== \"string\" || token.trim() === \"\") {\n        throw new Error(\"Token non valido.\");\n      }\n\n      assertStrongPassword(newPassword);\n\n      const secret = getAccessiJwtSecret(this.accessiOptions, 'reset');\n      const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\n\n      const hashedPassword = PasswordUtilities.hashPassword(newPassword);\n\n      await Orm.withTransaction(this.accessiOptions.databaseOptions, async (transaction) => {\n        // A conditional write claims the nonce under the database row lock. A second\n        // concurrent reset cannot also consume it; failures roll the whole reset back.\n        const claimed = await Orm.transactionQuery<unknown>(\n          transaction,\n          'UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE',\n          [StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione.CONF, StatoRegistrazione.INVIO],\n        );\n        const row = (Array.isArray(claimed) ? claimed[0] : claimed) as Record<string, unknown> | undefined;\n        if (Number(row?.CODUTE ?? row?.codute) !== codiceUtente) {\n          throw new Error('Token non valido, gia usato o utente non autorizzato.');\n        }\n\n        await Orm.transactionQuery(\n          transaction,\n          'UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)',\n          [codiceUtente, hashedPassword],\n        );\n\n        if (this.accessiOptions.passwordExpiration) {\n          const days = Number(this.accessiOptions.passwordExpirationDays);\n          const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;\n          await Orm.transactionQuery(\n            transaction,\n            `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`,\n            [codiceUtente],\n          );\n        }\n      });\n\n      // Il reset e un cambio password: i token emessi prima non devono piu valere.\n      await this.revokeSessionsAfterSecurityChange(codiceUtente, 'password_reset');\n    } catch (error) {\n      throw error;\n    }\n  }\n}\n"]}
+{"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AuthService/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAwG;AACxG,mCAAoC;AACpC,2EAAwF;AACxF,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,yDAAsF;AACtF,sEAAmE;AACnE,4DAAyD;AACzD,kEAA+D;AAC/D,0EAK2C;AAC3C,0EAG2C;AAC3C,wEAI0C;AAC1C,8EAK6C;AAC7C,gDAAoD;AACpD,oEAMwC;AACxC,kEAAqE;AACrE,4CAAyC;AAGzC,8EAA8E;AACjE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAiB1D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,aAA4B,EACT,cAA+C,EACzD,gBAAkC;QAH3C,gBAAW,GAAX,WAAW,CAAa;QACxB,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QACzD,qBAAgB,GAAhB,gBAAgB,CAAkB;QANpC,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qFAAqF;QACrF,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,CAAC;IAClC,CAAC;IAEO,WAAW,CACjB,MAA6B,EAC7B,OAAiB,EACjB,IAA0B,EAC1B,eAAyC,EAAE;;QAE3C,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACpH,MAAM,IAAI,8BAAqB,CAAC,2CAA2C,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,YAAY,CAAC,SAAS,mCAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QACrF,MAAM,gBAAgB,GAAG,OAAO,SAAS,KAAK,QAAQ;YACpD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS;YAChC,CAAC,CAAC,IAAA,qDAAmC,EAAC,IAAI,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,IAAA,oDAAkC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,iCAEf,CAAC,MAAA,YAAY,CAAC,WAAW,mCAAI,EAAE,CAAC,KACnC,MAAM,EACN,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,qEAAqE;YACrE,8DAA8D;YAC9D,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,KAEnB,OAAO,CAAC,GAAG,kBAET,SAAS,EAAE,SAAyC,EACpD,SAAS,EAAE,OAAO,CAAC,SAAS,IACzB,OAAO,CAAC,WAAW,EAEzB,CAAC;QAEF,wFAAwF;QACxF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,cAAc,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,IAAI,OAAO,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG,CAAA,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,8EAA8E;QAC9E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7G,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC;QAEhF,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED,+EAA+E;IACxE,kBAAkB,CACvB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,eAAyC,EAAE;QAE3C,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnE,CAAC;IAED,kFAAkF;IAC3E,kBAAkB,CACvB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,eAAyC,EAAE;QAE3C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAClE,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,kCAC7C,YAAY,KACf,SAAS,IACT,CAAC;IACL,CAAC;IAED,uEAAuE;IAChE,eAAe,CACpB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,OAA+B;;QAE/B,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,mCAAI,IAAA,mBAAU,GAAE,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7F,uBAAS,MAAM,IAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAG;IACrD,CAAC;IAED;;;OAGG;IACI,kBAAkB,CACvB,MAA6B,EAC7B,KAA+C;QAE/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;YACnD,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE;oBACH,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;oBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IAC5E,qBAAqB,CAAC,YAAoB,EAAE,KAAc;;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAC3C,EAAE,YAAY,EAAE,kBACd,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,IAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACjF,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAA,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,CAAC,IAAA,qDAAgC,EAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YACzG,MAAM,CAAC,MAAM,mCAAQ,MAAM,CAAC,MAAM,GAAK,OAAO,CAAE,CAAC;YAEjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC;QACJ,CAAC;KAAA;IAED,8EAA8E;IAChE,sBAAsB,CAAC,YAAoB;;;YACvD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE/E,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAmD,CAAC;YACnH,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,GAAG,CAAC;QAC9H,CAAC;KAAA;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAqB;;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,wBAAwB,EAAE,CAAC;gBACxH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YAChK,CAAC;YACD,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAEzD,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,+BAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB;oBAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,CAAC,CAAC,SAAS,CAAC;gBAEd,qGAAqG;gBACrG,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACnJ,CAAC;YAED,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;KAAA;IAED;;;;;OAKG;IACU,qBAAqB,CAAC,KAAa;;YAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,yDAAuC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClF,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;YACzD,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBACvG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IACE,CAAC,WAAW;gBACZ,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAC9C,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EACnD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,YAAY;gBACZ,OAAO,EAAE,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC;aAC9D,CAAC;QACJ,CAAC;KAAA;IAED;;;OAGG;IACU,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,aAAa,CAAC,OAAO,CAAC;QAC/B,CAAC;KAAA;IAED;;;;OAIG;IACU,kBAAkB,CAAC,YAAoB;;YAClD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACrD,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnE,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,0DAAwC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnF,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,YAAY,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;YAChE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC7E,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,8BAAqB,CAAC,0CAA0C,CAAC,CAAC;YAC9E,CAAC;YAED,MAAM,aAAa,GAAG,OAA0D,CAAC;YACjF,MAAM,QAAQ,GAAG,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;gBACvF,CAAC,CAAC,aAAa,CAAC,GAAG;gBACnB,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,GAAG,GAAG,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAE5C,4EAA4E;YAC5E,2EAA2E;YAC3E,IAAI,MAAM,IAAA,kDAA2B,EAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,8BAAqB,CAAC;oBAC9B,IAAI,EAAE,gCAAgC;oBACtC,OAAO,EAAE,yDAAyD;iBACnE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,IAAA,yCAAqB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBACvG,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,aAAa,GAAG,IAAA,mDAA4B,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxE,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,8BAAqB,CAAC,wCAAwC,CAAC,CAAC;gBAC5E,CAAC;gBACD,IAAI,OAAO,CAAC;gBACZ,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAA,0CAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;gBAClF,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,oCAA2B,CAAC;wBACpC,IAAI,EAAE,sCAAsC;wBAC5C,OAAO,EAAE,6DAA6D;qBACvE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACjC,MAAM,IAAI,CAAC,uBAAuB,CAAC;wBACjC,YAAY;wBACZ,GAAG;wBACH,QAAQ;wBACR,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,WAAW,EAAE,SAAS,GAAG,IAAI;qBAC9B,CAAC,CAAC;oBACH,MAAM,IAAI,8BAAqB,CAAC;wBAC9B,IAAI,EAAE,6BAA6B;wBACnC,OAAO,EAAE,+BAA+B;qBACzC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAE,OAA6B,CAAC,GAAG,CAAC;gBAC/D,CAAC,CAAC,CAAE,OAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC;gBACxG,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAED;;;;;;;OAOG;IACW,uBAAuB,CAAC,MAMrC;;;YACC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAA,MAAA,IAAI,CAAC,cAAc,CAAC,oBAAoB,0CAAE,YAAY,mCAAI,KAAM,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC;YACzF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;YACzC,IACE,OAAO,GAAG,CAAC;mBACR,YAAY,KAAK,SAAS;mBAC1B,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;mBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,IAAI,OAAO,EACvC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAA,oBAAY,EAAC,6BAA6B,EAAE;gBAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY;aACb,CAAC,CAAC;YACH,IAAA,4BAAkB,EAAC,IAAI,CAAC,cAAc,EAAE,qBAAqB,EAAE;gBAC7D,qBAAqB,EAAE,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,oBAAoB,0CAAE,yBAAyB,MAAK,IAAI;aACpG,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACpB,MAAM,IAAA,+CAAwB,EAC5B,IAAI,CAAC,cAAc,EACnB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,WAAW,CACnB,CAAC;oBACF,IAAA,4BAAkB,EAAC,IAAI,CAAC,cAAc,EAAE,8BAA8B,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC/F,CAAC;gBACD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,oBAAoB,0CAAE,yBAAyB,MAAK,IAAI,EAAE,CAAC;oBACjF,MAAM,IAAA,6CAAyB,EAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAC;gBAC/G,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,6BAAmB,EAAC,4BAA4B,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC1F,yEAAyE;gBACzE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0CAA0C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAED,+FAA+F;IAClF,uBAAuB,CAAC,YAAoB,EAAE,WAAmB;;;YAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACvG,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACrI,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAqB;;;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrF,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7I,MAAM,IAAI,8BAAqB,CAAC,8DAA8D,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAAE,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;YAC7I,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;YACzJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,CAAA;oBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;gBAC7F,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAC9D,6KAA6K,EAC7K,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB,EAAE,IAAY,EAAE,KAAc;;YAC5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;YACzD,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,qEAAqE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACpJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,kFAAkF,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAClK,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB;;YAC9C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,CAAC;KAAA;IAED;;;;;;OAMG;IACU,WAAW,CACtB,YAAoB,EACpB,aAAqB,EACrB,OAA+D;;YAE/D,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,MAAK,KAAK,EAAE,CAAC;gBACrC,IAAA,qCAAoB,EAAC,aAAa,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,MAAK,KAAK,EAAE,CAAC;oBACtC,MAAM,IAAI,CAAC,iCAAiC,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBAChF,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAED;;;;OAIG;IACW,iCAAiC,CAAC,YAAoB,EAAE,MAAc;;YAClF,IAAI,CAAC;gBACH,MAAM,IAAA,yDAAqC,EAAC,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wCAAwC,YAAY,KAAK,MAAM,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9H,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACU,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAED,yGAAyG;IACnG,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEvC,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE;wBAClD,aAAa,EAAE,KAAK;wBACpB,cAAc,EAAE,KAAK;qBACtB,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,6BAAiB,CAAC,sBAAsB,CACpE,cAAc,EACd,uBAAuB,CACxB,CAAC;YAEF,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE;oBAClD,aAAa,EAAE,KAAK;oBACpB,cAAc,EAAE,KAAK;iBACtB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAED,8GAA8G;IACxG,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,2EAA2E;IAC3E,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACU,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IAAA,qCAAoB,EAAC,WAAW,CAAC,CAAC;gBAElC,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACjE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAEnE,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;;oBACnF,6EAA6E;oBAC7E,+EAA+E;oBAC/E,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,gBAAgB,CACxC,WAAW,EACX,mHAAmH,EACnH,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uCAAkB,CAAC,IAAI,EAAE,uCAAkB,CAAC,KAAK,CAAC,CAClG,CAAC;oBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;oBACnG,IAAI,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBAC3E,CAAC;oBAED,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,gFAAgF,EAChF,CAAC,YAAY,EAAE,cAAc,CAAC,CAC/B,CAAC;oBAEF,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;wBAChE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,yCAAyC,cAAc,6CAA6C,EACpG,CAAC,YAAY,CAAC,CACf,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAA,CAAC,CAAC;gBAEH,6EAA6E;gBAC7E,MAAM,IAAI,CAAC,iCAAiC,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA1yBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFL,yBAAW;QACT,6BAAa,UAED,mCAAgB;GAP1C,WAAW,CA0yBvB","sourcesContent":["import { Inject, Injectable, ServiceUnavailableException, UnauthorizedException } from \"@nestjs/common\";\nimport { randomUUID } from \"crypto\";\nimport { TwoFactorService, TwoFactorProof } from '../TwoFactorService/TwoFactorService';\nimport * as jwt from \"jsonwebtoken\";\nimport { Orm } from \"../../../Orm\";\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\nimport type { AccessiOptions } from \"../../AccessiModule\";\nimport { LoginRequest } from \"../../Dtos/LoginRequest\";\nimport { LoginResult } from \"../../Dtos/LoginResponse\";\nimport { countAccessiMetric, recordAccessiMetric } from \"../../observability/metrics\";\nimport { StatoRegistrazione } from \"../../Dtos/StatoRegistrazione\";\nimport { UserService } from \"../UserService/UserService\";\nimport { FiltriService } from \"../FiltriService/FiltriService\";\nimport {\n  buildAuthenticatedTokenPayload,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../../security/authenticatedToken\";\nimport {\n  getAccessiJwtSecret,\n  verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport {\n  isAccessiTokenRevoked,\n  revokeAccessiUserSessions,\n  revokeAccessiUserSessionsIfConfigured,\n} from \"../../security/sessionRevocation\";\nimport {\n  consumeRefreshToken,\n  getRefreshTokenRotationStore,\n  isRefreshTokenFamilyRevoked,\n  revokeRefreshTokenFamily,\n} from \"../../security/refreshTokenRotation\";\nimport { auditAccessi } from \"../../security/audit\";\nimport {\n  getAccessiAccessTokenSigningConfig,\n  getAccessiAccessTokenVerificationConfig,\n  getAccessiRefreshTokenSigningConfig,\n  getAccessiRefreshTokenVerificationConfig,\n  verifyAccessiJwt,\n} from \"../../security/jwtTokenOptions\";\nimport { assertStrongPassword } from '../../security/passwordPolicy';\nimport { Logger } from \"../../../Logger\";\nimport { TokenResult } from '../../Dtos/TokenResult';\n\n/** Error code deliberately returned when a user is configured as SSO-only. */\nexport const PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';\n\n/** Esito di una verifica token usata dall'endpoint di introspection. */\nexport interface AccessiTokenIntrospectionResult {\n  active: boolean;\n  codiceUtente?: number;\n  payload?: Record<string, unknown>;\n}\n\ninterface AccessiTokenIssueOptions {\n  /** Sovrascrive jwtOptions.expiresIn per token a durata ridotta (es. Login as). */\n  expiresIn?: string | number;\n  /** Claim aggiuntive, per esempio l'attore che ha generato un token di impersonazione. */\n  extraClaims?: Record<string, unknown>;\n}\n\n@Injectable()\nexport class AuthService {\n  private readonly logger = new Logger(AuthService.name);\n\n  constructor(\n    private userService: UserService,\n    private filtriService: FiltriService,\n    @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions,\n    private readonly twoFactorService: TwoFactorService,\n  ) {}\n\n  private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\n    if (!this.accessiOptions.passwordExpiration) {\n      return;\n    }\n\n    const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\n    const expirationDays =\n      Number.isFinite(configuredDays) && configuredDays > 0\n        ? Math.trunc(configuredDays)\n        : 90;\n\n    const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\n    await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n  }\n\n  private isMockDemoUserEnabled(): boolean {\n    if (!this.accessiOptions.mockDemoUser) {\n      return false;\n    }\n\n    // La backdoor mock non e mai attiva in produzione, nemmeno con variabili d'ambiente,\n    // perche emette un superutente senza verifica password.\n    const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\n    return nodeEnv !== \"production\";\n  }\n\n  private createToken(\n    utente: LoginResult['utente'],\n    methods: string[],\n    type: 'access' | 'refresh',\n    tokenOptions: AccessiTokenIssueOptions = {},\n  ): TokenResult {\n    if (!utente?.codiceUtente) {\n      throw new Error('Impossibile creare un token senza un utente Accessi valido.');\n    }\n    const loginAs = methods.includes('login_as');\n    if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp') && !loginAs) {\n      throw new UnauthorizedException('Verifica del codice di accesso richiesta.');\n    }\n\n    const expiresIn = tokenOptions.expiresIn ?? this.accessiOptions.jwtOptions.expiresIn;\n    const expiresInIsValid = typeof expiresIn === 'number'\n      ? Number.isFinite(expiresIn) && expiresIn > 0\n      : typeof expiresIn === 'string' && expiresIn.trim() !== '';\n    if (!expiresInIsValid) {\n      throw new Error('Durata token non configurata: impossibile emettere token senza scadenza.');\n    }\n\n    const signing = type === 'refresh'\n      ? getAccessiRefreshTokenSigningConfig(this.accessiOptions)\n      : getAccessiAccessTokenSigningConfig(this.accessiOptions);\n    const token = jwt.sign(\n      {\n        ...(tokenOptions.extraClaims ?? {}),\n        utente,\n        typ: type,\n        amr: methods,\n        jti: randomUUID(),\n        // Millisecondi: rende deterministica la revoca sessioni anche quando\n        // il token e emesso nello stesso secondo del cambio password.\n        iatMs: Date.now(),\n      },\n      signing.key,\n      {\n        expiresIn: expiresIn as jwt.SignOptions['expiresIn'],\n        algorithm: signing.algorithm,\n        ...signing.signOptions,\n      },\n    );\n\n    // Difesa in profondita: un `expiresIn` malformato farebbe emettere un token permanente.\n    const decoded = jwt.decode(token);\n    const decodedPayload = decoded && typeof decoded === 'object' ? decoded as jwt.JwtPayload : undefined;\n    if (typeof decodedPayload?.exp !== 'number') {\n      throw new Error('Token emesso senza scadenza: configurazione JWT non valida.');\n    }\n\n    // Il contratto TokenResult espone sempre la validita in secondi, anche quando\n    // jwtOptions.expiresIn usa un formato leggibile come '24h'.\n    const issuedAt = typeof decodedPayload.iat === 'number' ? decodedPayload.iat : Math.floor(Date.now() / 1000);\n    const expiresInSeconds = Math.max(0, Math.trunc(decodedPayload.exp - issuedAt));\n\n    return {\n      expiresIn: String(expiresInSeconds),\n      value: token,\n      type: 'Bearer',\n    };\n  }\n\n  /** Creates the normal internal JWT consumed by all existing Accessi guards. */\n  public createAccessiToken(\n    utente: LoginResult['utente'],\n    methods: string[] = [],\n    tokenOptions: AccessiTokenIssueOptions = {},\n  ): TokenResult {\n    return this.createToken(utente, methods, 'access', tokenOptions);\n  }\n\n  /** Emette il refresh token quando `jwtOptions.refreshExpiresIn` e configurato. */\n  public createRefreshToken(\n    utente: LoginResult['utente'],\n    methods: string[] = [],\n    tokenOptions: AccessiTokenIssueOptions = {},\n  ): TokenResult | undefined {\n    const expiresIn = this.accessiOptions.jwtOptions.refreshExpiresIn;\n    if (!expiresIn) return undefined;\n    return this.createToken(utente, methods, 'refresh', {\n      ...tokenOptions,\n      expiresIn,\n    });\n  }\n\n  /** Crea la coppia access + refresh token usata da login, 2FA e SSO. */\n  public createTokenPair(\n    utente: LoginResult['utente'],\n    methods: string[] = [],\n    options?: { familyId?: string },\n  ): { access: TokenResult; refresh?: TokenResult } {\n    // La famiglia identifica il login: access e refresh condividono lo stesso\n    // `fid`, cosi la revoca per riuso sospetto invalida entrambi.\n    const familyId = options?.familyId ?? randomUUID();\n    const access = this.createAccessiToken(utente, methods, { extraClaims: { fid: familyId } });\n    const refresh = this.createRefreshToken(utente, methods, { extraClaims: { fid: familyId } });\n    return { access, ...(refresh ? { refresh } : {}) };\n  }\n\n  /**\n   * Emette l'access token per l'utente target, con l'attore registrato nelle\n   * claim `act` e `loginAs`. La durata e' quella standard di jwtOptions.expiresIn.\n   */\n  public createLoginAsToken(\n    utente: LoginResult['utente'],\n    actor: { codiceUtente: number; email?: string },\n  ): TokenResult {\n    return this.createAccessiToken(utente, ['login_as'], {\n      extraClaims: {\n        loginAs: true,\n        act: {\n          sub: String(actor.codiceUtente),\n          email: actor.email,\n        },\n      },\n    });\n  }\n\n  /** Builds the standard login response for a user authenticated by a supported method. */\n  public async getLoginResultForUser(codiceUtente: number, scope?: string): Promise<LoginResult> {\n    const users = await this.userService.getUsers(\n      { codiceUtente },\n      { includeExtensionFields: true, includeGrants: true, ...(scope ? { scope } : {}) },\n    );\n    const result = users[0];\n    if (!result?.utente) {\n      throw new Error('Utente Accessi non trovato.');\n    }\n    const current = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(current)) throw new UnauthorizedException('Utente non abilitato.');\n    result.utente = { ...result.utente, ...current };\n\n    return {\n      utente: result.utente,\n      filtri: await this.filtriService.getFiltriUser(codiceUtente),\n      userGrants: result.userGrants,\n      extensionFields: result.extensionFields,\n    };\n  }\n\n  /** Users without a row retain the historic password-login enabled default. */\n  private async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n    if (this.accessiOptions.federatedAuthentication?.enabled !== true) return true;\n\n    const rows = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n      [codiceUtente],\n    );\n    const policy = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { passwordLoginEnabled?: unknown } | undefined;\n    return policy?.passwordLoginEnabled !== false && policy?.passwordLoginEnabled !== 0 && policy?.passwordLoginEnabled !== '0';\n  }\n\n  /**\n   * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.\n   * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.\n   * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.\n   */\n  async login(request: LoginRequest): Promise<LoginResult> {\n    const mockDemoUserEnabled = this.isMockDemoUserEnabled();\n\n    if (\n      mockDemoUserEnabled &&\n      request.email.toLowerCase() === \"demo\"\n    ) {\n      return this.getDemoUser();\n    }\n\n    if (\n      mockDemoUserEnabled &&\n      request.email.toLowerCase() === \"admin\"\n    ) {\n      return this.getAdminUser();\n    }\n\n    const utente = await this.userService.getUserByEmail(\n      request.email.trim().toLowerCase()\n    );\n    if (!utente) {\n      if (!request.password) return { passwordRequired: true };\n      throw new Error(\"Nome utente o password errata!\");\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);\n    if (isAuthenticatedUserEnabledForJwt(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {\n      return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: (currentUser.email ?? '').trim(), mode: 'passwordless' }) };\n    }\n    // The email-only step has the same response for unknown and ordinary local accounts.\n    if (!request.password) return { passwordRequired: true };\n\n    switch (utente.statoRegistrazione) {\n      case undefined:\n        throw new Error(\n          \"Struttura dati compromessa: Stato Registrazione inesistente.\"\n        );\n      case StatoRegistrazione.BLOCC:\n      case StatoRegistrazione.DELETE:\n        throw new Error(\"Utente non abilitato\");\n      case StatoRegistrazione.INVIO:\n        throw new Error(\"Rinnovo password necessario.\");\n    }\n\n    if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\n      throw new Error(\n        `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\n      );\n    }\n\n    if (!isAuthenticatedUserEnabledForJwt(currentUser)) throw new Error('Utente non abilitato');\n    if (!(await this.isPasswordLoginEnabled(utente.codiceUtente))) {\n      throw new Error(PASSWORD_LOGIN_DISABLED);\n    }\n\n    if (typeof request.password !== 'string' || request.password.length === 0) {\n      throw new Error('Nome utente o password errata!');\n    }\n\n    const isPasswordValid = await this.verifyPassword(\n      utente.codiceUtente,\n      request.password\n    );\n    if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\n\n    if (\n      this.accessiOptions.passwordExpiration &&\n      this.accessiOptions.passwordExpiration == true\n    ) {\n      const today = new Date();\n      const targetDate = utente.dataScadenzaPassword\n        ? new Date(utente.dataScadenzaPassword)\n        : undefined;\n\n      // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.\n      if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {\n        throw new Error(\"PASSWORD_EXPIRED\");\n      }\n    }\n\n    if (currentUser.flagDueFattori) {\n      return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email ?? '', mode: 'password' }) };\n    }\n\n    const updateLastAccessDateQuery =\n      \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\n    await Orm.query(\n      this.accessiOptions.databaseOptions,\n      updateLastAccessDateQuery,\n      [utente.codiceUtente]\n    );\n\n    return this.getLoginResultForUser(utente.codiceUtente, request.scope);\n  }\n\n  /**\n   * Verifica un access token Accessi senza sollevare eccezioni per token invalidi.\n   *\n   * Gli errori di configurazione o database continuano a propagarsi: un problema\n   * infrastrutturale non deve essere confuso con un token scaduto.\n   */\n  public async introspectAccessToken(token: string): Promise<AccessiTokenIntrospectionResult> {\n    if (typeof token !== \"string\" || token.trim() === \"\") {\n      return { active: false };\n    }\n\n    const verification = getAccessiAccessTokenVerificationConfig(this.accessiOptions);\n    let decoded: unknown;\n    try {\n      decoded = verifyAccessiJwt(token.trim(), verification);\n    } catch {\n      return { active: false };\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n    if (!codiceUtente) {\n      return { active: false };\n    }\n    if (await isAccessiTokenRevoked(this.accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n      return { active: false };\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (\n      !currentUser ||\n      !isAuthenticatedUserEnabledForJwt(currentUser) ||\n      !isAccessiTokenAllowedForUser(decoded, currentUser)\n    ) {\n      return { active: false };\n    }\n\n    return {\n      active: true,\n      codiceUtente,\n      payload: buildAuthenticatedTokenPayload(decoded, currentUser),\n    };\n  }\n\n  /**\n   * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.\n   * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.\n   */\n  public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\n    if (typeof token !== \"string\" || token.trim() === \"\") {\n      throw new Error(\"Token non fornito.\");\n    }\n\n    const introspection = await this.introspectAccessToken(token);\n    if (!introspection.active || !introspection.payload) {\n      throw new Error(\"Token non valido o utente non autorizzato.\");\n    }\n\n    return introspection.payload;\n  }\n\n  /**\n   * Scambia un refresh token valido con una nuova coppia access + refresh.\n   *\n   * Il refresh token non e accettato dai guard API: ha `typ: \"refresh\"`.\n   */\n  public async refreshAccessToken(refreshToken: string): Promise<LoginResult> {\n    if (!this.accessiOptions.jwtOptions.refreshExpiresIn) {\n      throw new UnauthorizedException('Refresh token non abilitato.');\n    }\n    if (typeof refreshToken !== 'string' || refreshToken.trim() === '') {\n      throw new UnauthorizedException('Refresh token mancante.');\n    }\n\n    const verification = getAccessiRefreshTokenVerificationConfig(this.accessiOptions);\n    let decoded: unknown;\n    try {\n      decoded = verifyAccessiJwt(refreshToken.trim(), verification);\n    } catch {\n      throw new UnauthorizedException('Refresh token non valido o scaduto.');\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded, 'refresh');\n    if (!codiceUtente) {\n      throw new UnauthorizedException('Refresh token privo di un utente valido.');\n    }\n\n    const decodedRecord = decoded as { jti?: unknown; fid?: unknown; exp?: unknown };\n    const familyId = typeof decodedRecord.fid === 'string' && decodedRecord.fid.trim() !== ''\n      ? decodedRecord.fid\n      : undefined;\n    const jti = typeof decodedRecord.jti === 'string' ? decodedRecord.jti : undefined;\n    const expiresAt = Number(decodedRecord.exp);\n\n    // La famiglia va controllata per prima: un token appena emesso da uno store\n    // compromesso deve produrre un codice stabile, non il generico 401 utente.\n    if (await isRefreshTokenFamilyRevoked(this.accessiOptions, familyId)) {\n      throw new UnauthorizedException({\n        code: 'ACCESSI_REFRESH_FAMILY_REVOKED',\n        message: 'Sessione revocata per riuso sospetto del refresh token.',\n      });\n    }\n\n    if (await isAccessiTokenRevoked(this.accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n      throw new UnauthorizedException('Sessione revocata.');\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw new UnauthorizedException('Utente non piu autorizzato.');\n    }\n\n    const rotationStore = getRefreshTokenRotationStore(this.accessiOptions);\n    if (rotationStore) {\n      if (!jti || !Number.isFinite(expiresAt)) {\n        throw new UnauthorizedException('Refresh token privo di jti o scadenza.');\n      }\n      let outcome;\n      try {\n        outcome = await consumeRefreshToken(this.accessiOptions, jti, expiresAt * 1000);\n      } catch {\n        throw new ServiceUnavailableException({\n          code: 'ACCESSI_REFRESH_ROTATION_UNAVAILABLE',\n          message: 'Rotazione refresh token non disponibile. Riprova piu tardi.',\n        });\n      }\n      if (outcome && !outcome.consumed) {\n        await this.handleRefreshTokenReuse({\n          codiceUtente,\n          jti,\n          familyId,\n          consumedAtMs: outcome.consumedAtMs,\n          expiresAtMs: expiresAt * 1000,\n        });\n        throw new UnauthorizedException({\n          code: 'ACCESSI_REFRESH_TOKEN_REUSE',\n          message: 'Refresh token gia utilizzato.',\n        });\n      }\n    }\n\n    const login = await this.getLoginResultForUser(codiceUtente);\n    const methods = Array.isArray((decoded as { amr?: unknown }).amr)\n      ? ((decoded as { amr: unknown[] }).amr.filter((method): method is string => typeof method === 'string'))\n      : [];\n    const pair = this.createTokenPair(login.utente, methods, { familyId });\n    login.token = pair.access;\n    if (pair.refresh) login.refreshToken = pair.refresh;\n    return login;\n  }\n\n  /**\n   * Gestisce il riuso di un refresh token gia consumato.\n   *\n   * Il riuso entro `reuseGraceMs` e trattato come retry concorrente del client e\n   * non revoca nulla. Oltre la finestra e considerato un possibile furto: viene\n   * revocata l'intera famiglia (stesso login) e, solo se esplicitamente\n   * configurato, anche le altre sessioni dell'utente.\n   */\n  private async handleRefreshTokenReuse(params: {\n    codiceUtente: number;\n    jti: string;\n    familyId?: string;\n    consumedAtMs?: number;\n    expiresAtMs: number;\n  }): Promise<void> {\n    const configuredGrace = Number(this.accessiOptions.refreshTokenRotation?.reuseGraceMs ?? 10_000);\n    const graceMs = Number.isFinite(configuredGrace) ? Math.max(0, configuredGrace) : 10_000;\n    const consumedAtMs = params.consumedAtMs;\n    if (\n      graceMs > 0\n      && consumedAtMs !== undefined\n      && Number.isFinite(consumedAtMs)\n      && Date.now() - consumedAtMs <= graceMs\n    ) {\n      return;\n    }\n\n    auditAccessi('accessi_refresh_token_reuse', {\n      codiceUtente: params.codiceUtente,\n      jti: params.jti,\n      familyId: params.familyId,\n      consumedAtMs,\n    });\n    countAccessiMetric(this.accessiOptions, 'refresh_reuse_total', {\n      user_sessions_revoked: this.accessiOptions.refreshTokenRotation?.revokeUserSessionsOnReuse === true,\n    });\n\n    try {\n      if (params.familyId) {\n        await revokeRefreshTokenFamily(\n          this.accessiOptions,\n          params.familyId,\n          params.expiresAtMs,\n        );\n        countAccessiMetric(this.accessiOptions, 'refresh_family_revoked_total', { reason: 'reuse' });\n      }\n      if (this.accessiOptions.refreshTokenRotation?.revokeUserSessionsOnReuse === true) {\n        await revokeAccessiUserSessions(this.accessiOptions, params.codiceUtente, Date.now(), 'refresh_token_reuse');\n      }\n    } catch (error) {\n      recordAccessiMetric('accessi_store_errors_total', 1, { store: 'refresh_token_rotation' });\n      // La revoca e best effort: il token presentato resta comunque rifiutato.\n      this.logger.error(\n        `Revoca famiglia refresh token fallita: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n  }\n\n  /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */\n  public async beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori) throw new UnauthorizedException();\n    return { challenge: await this.twoFactorService.issue({ codiceUtente, email: user.email ?? '', mode: 'federated', identityKey }) };\n  }\n\n  private async validateTwoFactorProof(proof: TwoFactorProof): Promise<void> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori || user.email?.trim().toLowerCase() !== proof.email.trim().toLowerCase()) {\n      throw new UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');\n    }\n    if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled) throw new UnauthorizedException('Accesso senza password disabilitato.');\n    if (proof.mode === 'password' && !(await this.isPasswordLoginEnabled(proof.codiceUtente))) throw new UnauthorizedException('Login locale disabilitato.');\n    if (proof.mode === 'federated') {\n      if (!this.accessiOptions.federatedAuthentication?.enabled) throw new UnauthorizedException();\n      const rows = await Orm.query(this.accessiOptions.databaseOptions,\n        'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1',\n        [proof.identityKey, proof.codiceUtente], false);\n      if (!rows.length) throw new UnauthorizedException('Identita SSO non piu abilitata.');\n    }\n  }\n\n  public async verifyTwoFactor(challengeId: string, code: string, scope?: string): Promise<LoginResult> {\n    const proof = await this.twoFactorService.consume(challengeId, code);\n    await this.validateTwoFactorProof(proof);\n    const result = await this.getLoginResultForUser(proof.codiceUtente, scope);\n    const tokens = this.createTokenPair(result.utente, [proof.mode, 'otp']);\n    result.token = tokens.access;\n    if (tokens.refresh) result.refreshToken = tokens.refresh;\n    await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);\n    if (proof.mode === 'federated') {\n      await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);\n    }\n    return result;\n  }\n\n  public async resendTwoFactor(challengeId: string): Promise<LoginResult> {\n    await this.validateTwoFactorProof(await this.twoFactorService.describe(challengeId));\n    return { challenge: await this.twoFactorService.resend(challengeId) };\n  }\n\n  /**\n   * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.\n   * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di\n   * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.\n   * Con `revokeSessions` (default true) invalida le sessioni precedenti: un cambio password deve\n   * interrompere i token gia emessi.\n   */\n  public async setPassword(\n    codiceUtente: number,\n    nuovaPassword: string,\n    options?: { enforcePolicy?: boolean; revokeSessions?: boolean },\n  ) {\n    if (options?.enforcePolicy !== false) {\n      assertStrongPassword(nuovaPassword);\n    }\n    try {\n      const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\n      const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\n\n      const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\n        codiceUtente,\n        hashedPassword,\n      ]);\n      await this.refreshPasswordExpiration(codiceUtente);\n      if (options?.revokeSessions !== false) {\n        await this.revokeSessionsAfterSecurityChange(codiceUtente, 'password_change');\n      }\n      return result;\n    } catch (error) {\n      throw error;\n    }\n  }\n\n  /**\n   * Revoca le sessioni dopo un evento che deve invalidare i token esistenti.\n   * Best effort: un errore dello store non deve annullare l'operazione gia\n   * persistita (cambio password, blocco, cancellazione).\n   */\n  private async revokeSessionsAfterSecurityChange(codiceUtente: number, reason: string): Promise<void> {\n    try {\n      await revokeAccessiUserSessionsIfConfigured(this.accessiOptions, codiceUtente, reason);\n    } catch (error) {\n      this.logger.error(\n        `Revoca sessioni fallita per l'utente ${codiceUtente} (${reason}): ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n  }\n\n  /**\n   * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.\n   * E idempotente: hash moderni e gia migrati vengono ignorati.\n   */\n  public async migrateLegacyEncryptedPasswords(): Promise<void> {\n    const startedAt = performance.now();\n    this.logger.info(\"Avvio migrazione password legacy accessi.\");\n    const results = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n      []\n    );\n\n    const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\n      codiceUtente?: number;\n      password?: string;\n    }[];\n    let migratedCount = 0;\n    let skippedCount = 0;\n\n    for (const row of rows) {\n      const codiceUtente = Number(row.codiceUtente);\n      const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\n      if (\n        !codiceUtente ||\n        !storedPassword ||\n        PasswordUtilities.isPasswordHash(storedPassword) ||\n        PasswordUtilities.isLegacyPasswordHash(storedPassword)\n      ) {\n        skippedCount += 1;\n        continue;\n      }\n\n      const protectedLegacyPassword =\n        PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\n\n      await Orm.execute(\n        this.accessiOptions.databaseOptions,\n        \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n        [protectedLegacyPassword, codiceUtente, storedPassword]\n      );\n      migratedCount += 1;\n    }\n\n    this.logger.info(\n      `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n    );\n  }\n\n  /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */\n  async verifyPassword(\n    codiceUtente: number,\n    plainPassword: string\n  ): Promise<boolean> {\n    const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\n    const result = (await Orm.query(\n      this.accessiOptions.databaseOptions,\n      query,\n      [codiceUtente]\n    ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\n      password: string;\n    }[];\n\n    const stored = result[0];\n    if (!stored || typeof stored.password !== \"string\") {\n      return false;\n    }\n\n    const storedPassword = stored.password;\n\n    if (PasswordUtilities.isPasswordHash(storedPassword)) {\n      return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\n    }\n\n    const legacyEncryptedPassword = CryptUtilities.encrypt(\n      plainPassword,\n      this.accessiOptions.encryptionKey\n    );\n\n    if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\n      const isMigratedLegacyPasswordValid =\n        PasswordUtilities.verifyLegacyEncryptedPassword(\n          legacyEncryptedPassword,\n          storedPassword\n        );\n\n      if (isMigratedLegacyPasswordValid) {\n        await this.setPassword(codiceUtente, plainPassword, {\n          enforcePolicy: false,\n          revokeSessions: false,\n        });\n      }\n\n      return isMigratedLegacyPasswordValid;\n    }\n\n    const isLegacyPasswordValid = PasswordUtilities.timingSafeStringEquals(\n      storedPassword,\n      legacyEncryptedPassword,\n    );\n\n    if (isLegacyPasswordValid) {\n      await this.setPassword(codiceUtente, plainPassword, {\n        enforcePolicy: false,\n        revokeSessions: false,\n      });\n    }\n\n    return isLegacyPasswordValid;\n  }\n\n  /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */\n  async getAdminUser(): Promise<LoginResult> {\n    return {\n      utente: {\n        codiceUtente: 6789,\n        email: \"admin\",\n        statoRegistrazione: StatoRegistrazione.CONF,\n        cognome: \"Admin\",\n        nome: \"Admin\",\n        flagGdpr: true,\n        avatar: \"/path/to/avatar.jpg\",\n        flagDueFattori: false,\n        codiceLingua: \"IT\",\n        cellulare: \"+391234567890\",\n        flagSuper: true,\n        roles: [],\n        permissions: [],\n      },\n      filtri: null,\n      userGrants: {\n        abilitazioni: [],\n        grants: [],\n        ruoli: [],\n      },\n    };\n  }\n\n  /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */\n  getDemoUser(): LoginResult {\n    return {\n      utente: {\n        codiceUtente: 12345,\n        email: \"jdoe\",\n        statoRegistrazione: StatoRegistrazione.CONF,\n        cognome: \"Doe\",\n        nome: \"John\",\n        flagGdpr: true,\n        avatar: \"/path/to/avatar.jpg\",\n        flagDueFattori: false,\n        codiceLingua: \"IT\",\n        cellulare: \"+391234567890\",\n        flagSuper: false,\n        roles: [],\n        permissions: [],\n      },\n      filtri: null,\n      userGrants: {\n        abilitazioni: [],\n        grants: [],\n        ruoli: [],\n      },\n    };\n  }\n\n  /**\n   * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.\n   * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.\n   */\n  public async confirmResetPassword(\n    token: string,\n    newPassword: string\n  ): Promise<void> {\n    try {\n      if (typeof token !== \"string\" || token.trim() === \"\") {\n        throw new Error(\"Token non valido.\");\n      }\n\n      assertStrongPassword(newPassword);\n\n      const secret = getAccessiJwtSecret(this.accessiOptions, 'reset');\n      const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\n\n      const hashedPassword = PasswordUtilities.hashPassword(newPassword);\n\n      await Orm.withTransaction(this.accessiOptions.databaseOptions, async (transaction) => {\n        // A conditional write claims the nonce under the database row lock. A second\n        // concurrent reset cannot also consume it; failures roll the whole reset back.\n        const claimed = await Orm.transactionQuery<unknown>(\n          transaction,\n          'UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE',\n          [StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione.CONF, StatoRegistrazione.INVIO],\n        );\n        const row = (Array.isArray(claimed) ? claimed[0] : claimed) as Record<string, unknown> | undefined;\n        if (Number(row?.CODUTE ?? row?.codute) !== codiceUtente) {\n          throw new Error('Token non valido, gia usato o utente non autorizzato.');\n        }\n\n        await Orm.transactionQuery(\n          transaction,\n          'UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)',\n          [codiceUtente, hashedPassword],\n        );\n\n        if (this.accessiOptions.passwordExpiration) {\n          const days = Number(this.accessiOptions.passwordExpirationDays);\n          const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;\n          await Orm.transactionQuery(\n            transaction,\n            `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`,\n            [codiceUtente],\n          );\n        }\n      });\n\n      // Il reset e un cambio password: i token emessi prima non devono piu valere.\n      await this.revokeSessionsAfterSecurityChange(codiceUtente, 'password_reset');\n    } catch (error) {\n      throw error;\n    }\n  }\n}\n"]}

package/dist/accessi-module/index.d.ts

@@ -62,6 +62,12 @@ export { buildAccessiJwks, createAccessiJwksHandler, getAccessiJwksPath, setupAc
 export type { AccessiJwksDocument, AccessiJwksKey } from './security/jwks';
 export { applyAccessiBaseSecurityHeaders, applyAccessiContentSecurityPolicy, buildAccessiContentSecurityPolicy, createAccessiSecurityHeadersMiddleware, resolveAccessiSecurityHeaders } from './security/securityHeaders';
 export type { AccessiCspDirectives, AccessiCspOptions, AccessiCspSurface, AccessiSecurityHeadersOptions, AccessiSecurityHeadersSetting, ResolvedAccessiCsp, ResolvedAccessiSecurityHeaders } from './security/securityHeaders';
+export { createAccessiAuthCookieMiddleware, resolveAccessiAuthCookieOptions, getAccessiAccessTokenFromCookie, getAccessiRefreshTokenFromCookie, setAccessiAuthCookies, clearAccessiAuthCookies, applyAccessiAuthCookies, parseAccessiCookieHeader, isAccessiCsrfExemptPath } from './security/authCookies';
+export type { AccessiAuthCookieOptions, AccessiAuthCookieSetting, AccessiAuthTokenPair, ResolvedAccessiAuthCookieOptions } from './security/authCookies';
+export { accessiMetricName, countAccessiMetric, createAccessiMetricsRegistry, getAccessiMetricsRegistry, getAccessiMetricsSink, observeAccessiMetric, recordAccessiDuration, recordAccessiMetric, renderAccessiMetrics, resetAccessiMetrics } from './observability/metrics';
+export type { AccessiMetricLabelValue, AccessiMetricLabels, AccessiMetricsOptions, AccessiMetricsRegistry, AccessiMetricsSink, AccessiMetricsSnapshot } from './observability/metrics';
+export { instrumentAccessiRedisClient } from './observability/redisMetrics';
+export type { AccessiRedisEvalClient } from './observability/redisMetrics';
 export { getAccessiAccessTokenSigningConfig, getAccessiAccessTokenVerificationConfig, getAccessiRefreshTokenSigningConfig, getAccessiRefreshTokenVerificationConfig, resolveAccessiVerificationKeys, verifyAccessiJwt } from './security/jwtTokenOptions';
 export type { AccessiJwtVerificationConfig, AccessiUnknownKeyIdEvent } from './security/jwtTokenOptions';
 export { FederatedAuthService } from './federated-auth/FederatedAuthService';

package/dist/accessi-module/index.js

@@ -27,7 +27,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.isValidAdminBootstrapToken = exports.clearAdminBootstrapToken = exports.getAdminBootstrapToken = exports.getOrCreateAdminBootstrapToken = exports.AdminBootstrapService = exports.SchemaExportService = exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.leadingStatementKeyword = exports.analyzeCatalogScript = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.revokeAccessiAccessTokenIfConfigured = exports.revokeAccessiAccessToken = exports.isAccessiAccessTokenRevoked = exports.getAccessTokenRevocationStore = exports.createRedisAccessTokenRevocationStore = exports.createMemoryAccessTokenRevocationStore = exports.revokeRefreshTokenFamily = exports.isRefreshTokenFamilyRevoked = exports.getRefreshTokenRotationStore = exports.consumeRefreshToken = exports.createRedisRefreshTokenRotationStore = exports.createMemoryRefreshTokenRotationStore = exports.getSessionRevocationStore = exports.isAccessiTokenRevoked = exports.revokeAccessiUserSessionsIfConfigured = exports.revokeAccessiUserSessions = exports.createRedisSessionRevocationStore = exports.createMemorySessionRevocationStore = exports.auditAccessi = exports.validateAccessiOptions = exports.assertValidAccessiOptions = exports.createAccessiEdgeRateLimitMiddleware = exports.getDefaultRateLimitStore = exports.createRedisRateLimitStore = exports.createMemoryRateLimitStore = exports.getDefaultConsoleEntryStore = exports.createRedisConsoleEntryStore = exports.createMemoryConsoleEntryStore = exports.AccessiDatabaseUpdater = exports.FederatedAuthExchangeController = exports.AccessiIntrospectionController = exports.AccessiModule = void 0;
-exports.createAccessiHealthModule = exports.readinessHttpStatus = exports.createAccessiLiveReport = exports.collectAccessiHealthStores = exports.checkAccessiDatabase = exports.checkAccessiReadiness = exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.verifyAccessiJwt = exports.resolveAccessiVerificationKeys = exports.getAccessiRefreshTokenVerificationConfig = exports.getAccessiRefreshTokenSigningConfig = exports.getAccessiAccessTokenVerificationConfig = exports.getAccessiAccessTokenSigningConfig = exports.resolveAccessiSecurityHeaders = exports.createAccessiSecurityHeadersMiddleware = exports.buildAccessiContentSecurityPolicy = exports.applyAccessiContentSecurityPolicy = exports.applyAccessiBaseSecurityHeaders = exports.setupAccessiJwks = exports.getAccessiJwksPath = exports.createAccessiJwksHandler = exports.buildAccessiJwks = exports.LOGIN_AS_QUERY_PARAM = exports.buildLoginAsUrl = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = void 0;
+exports.checkAccessiDatabase = exports.checkAccessiReadiness = exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.verifyAccessiJwt = exports.resolveAccessiVerificationKeys = exports.getAccessiRefreshTokenVerificationConfig = exports.getAccessiRefreshTokenSigningConfig = exports.getAccessiAccessTokenVerificationConfig = exports.getAccessiAccessTokenSigningConfig = exports.instrumentAccessiRedisClient = exports.resetAccessiMetrics = exports.renderAccessiMetrics = exports.recordAccessiMetric = exports.recordAccessiDuration = exports.observeAccessiMetric = exports.getAccessiMetricsSink = exports.getAccessiMetricsRegistry = exports.createAccessiMetricsRegistry = exports.countAccessiMetric = exports.accessiMetricName = exports.isAccessiCsrfExemptPath = exports.parseAccessiCookieHeader = exports.applyAccessiAuthCookies = exports.clearAccessiAuthCookies = exports.setAccessiAuthCookies = exports.getAccessiRefreshTokenFromCookie = exports.getAccessiAccessTokenFromCookie = exports.resolveAccessiAuthCookieOptions = exports.createAccessiAuthCookieMiddleware = exports.resolveAccessiSecurityHeaders = exports.createAccessiSecurityHeadersMiddleware = exports.buildAccessiContentSecurityPolicy = exports.applyAccessiContentSecurityPolicy = exports.applyAccessiBaseSecurityHeaders = exports.setupAccessiJwks = exports.getAccessiJwksPath = exports.createAccessiJwksHandler = exports.buildAccessiJwks = exports.LOGIN_AS_QUERY_PARAM = exports.buildLoginAsUrl = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = void 0;
+exports.createAccessiHealthModule = exports.readinessHttpStatus = exports.createAccessiLiveReport = exports.collectAccessiHealthStores = void 0;
 exports.initializeAccessiModule = initializeAccessiModule;
 const express_1 = __importDefault(require("express"));
 const core_1 = require("@nestjs/core");
@@ -45,6 +46,7 @@ const emailConfiguration_1 = require("./security/emailConfiguration");
 const jwks_1 = require("./security/jwks");
 const edgeRateLimit_1 = require("./security/edgeRateLimit");
 const securityHeaders_1 = require("./security/securityHeaders");
+const authCookies_1 = require("./security/authCookies");
 function describeDatabaseTarget(options) {
     var _a, _b, _c, _d;
     const dbOptions = options.databaseOptions;
@@ -92,6 +94,10 @@ function initializeAccessiModule(app, options) {
             if (edgeRateLimit) {
                 app.use(edgeRateLimit);
             }
+            const authCookie = (0, authCookies_1.createAccessiAuthCookieMiddleware)(options, isAccessiRoute);
+            if (authCookie) {
+                app.use(authCookie);
+            }
             if (((_c = options.http) === null || _c === void 0 ? void 0 : _c.securityHeaders) !== false) {
                 const securityHeaders = (0, securityHeaders_1.createAccessiSecurityHeadersMiddleware)((_d = options.http) === null || _d === void 0 ? void 0 : _d.securityHeaders, isAccessiRoute, { isOpenApiUi: (path) => (0, OpenApiConfig_1.isOpenApiRequestPath)(path, resolvedOpenApi) });
                 if (securityHeaders) {
@@ -112,7 +118,7 @@ function initializeAccessiModule(app, options) {
             const nestApp = yield core_1.NestFactory.create(AccessiModule_1.AccessiModule.forRoot(options), nestExpressInstance, Object.assign({ bufferLogs: options.bufferLogs !== false }, (options.logger ? { logger: options.logger } : {})));
             logger.info("Applicazione Nest accessi creata.");
             if (((_e = options.http) === null || _e === void 0 ? void 0 : _e.cors) !== false) {
-                nestApp.enableCors((_g = (_f = options.http) === null || _f === void 0 ? void 0 : _f.cors) !== null && _g !== void 0 ? _g : { exposedHeaders: ['X-Total-Count'] });
+                nestApp.enableCors((_g = (_f = options.http) === null || _f === void 0 ? void 0 : _f.cors) !== null && _g !== void 0 ? _g : { exposedHeaders: ['X-Total-Count', 'X-CSRF-Token'] });
             }
             nestApp.useGlobalPipes((0, accessiValidation_1.createAccessiValidationPipe)());
             nestApp.useGlobalFilters(new AccessiHttpExceptionFilter_1.AccessiHttpExceptionFilter());
@@ -233,6 +239,29 @@ Object.defineProperty(exports, "applyAccessiContentSecurityPolicy", { enumerable
 Object.defineProperty(exports, "buildAccessiContentSecurityPolicy", { enumerable: true, get: function () { return securityHeaders_2.buildAccessiContentSecurityPolicy; } });
 Object.defineProperty(exports, "createAccessiSecurityHeadersMiddleware", { enumerable: true, get: function () { return securityHeaders_2.createAccessiSecurityHeadersMiddleware; } });
 Object.defineProperty(exports, "resolveAccessiSecurityHeaders", { enumerable: true, get: function () { return securityHeaders_2.resolveAccessiSecurityHeaders; } });
+var authCookies_2 = require("./security/authCookies");
+Object.defineProperty(exports, "createAccessiAuthCookieMiddleware", { enumerable: true, get: function () { return authCookies_2.createAccessiAuthCookieMiddleware; } });
+Object.defineProperty(exports, "resolveAccessiAuthCookieOptions", { enumerable: true, get: function () { return authCookies_2.resolveAccessiAuthCookieOptions; } });
+Object.defineProperty(exports, "getAccessiAccessTokenFromCookie", { enumerable: true, get: function () { return authCookies_2.getAccessiAccessTokenFromCookie; } });
+Object.defineProperty(exports, "getAccessiRefreshTokenFromCookie", { enumerable: true, get: function () { return authCookies_2.getAccessiRefreshTokenFromCookie; } });
+Object.defineProperty(exports, "setAccessiAuthCookies", { enumerable: true, get: function () { return authCookies_2.setAccessiAuthCookies; } });
+Object.defineProperty(exports, "clearAccessiAuthCookies", { enumerable: true, get: function () { return authCookies_2.clearAccessiAuthCookies; } });
+Object.defineProperty(exports, "applyAccessiAuthCookies", { enumerable: true, get: function () { return authCookies_2.applyAccessiAuthCookies; } });
+Object.defineProperty(exports, "parseAccessiCookieHeader", { enumerable: true, get: function () { return authCookies_2.parseAccessiCookieHeader; } });
+Object.defineProperty(exports, "isAccessiCsrfExemptPath", { enumerable: true, get: function () { return authCookies_2.isAccessiCsrfExemptPath; } });
+var metrics_1 = require("./observability/metrics");
+Object.defineProperty(exports, "accessiMetricName", { enumerable: true, get: function () { return metrics_1.accessiMetricName; } });
+Object.defineProperty(exports, "countAccessiMetric", { enumerable: true, get: function () { return metrics_1.countAccessiMetric; } });
+Object.defineProperty(exports, "createAccessiMetricsRegistry", { enumerable: true, get: function () { return metrics_1.createAccessiMetricsRegistry; } });
+Object.defineProperty(exports, "getAccessiMetricsRegistry", { enumerable: true, get: function () { return metrics_1.getAccessiMetricsRegistry; } });
+Object.defineProperty(exports, "getAccessiMetricsSink", { enumerable: true, get: function () { return metrics_1.getAccessiMetricsSink; } });
+Object.defineProperty(exports, "observeAccessiMetric", { enumerable: true, get: function () { return metrics_1.observeAccessiMetric; } });
+Object.defineProperty(exports, "recordAccessiDuration", { enumerable: true, get: function () { return metrics_1.recordAccessiDuration; } });
+Object.defineProperty(exports, "recordAccessiMetric", { enumerable: true, get: function () { return metrics_1.recordAccessiMetric; } });
+Object.defineProperty(exports, "renderAccessiMetrics", { enumerable: true, get: function () { return metrics_1.renderAccessiMetrics; } });
+Object.defineProperty(exports, "resetAccessiMetrics", { enumerable: true, get: function () { return metrics_1.resetAccessiMetrics; } });
+var redisMetrics_1 = require("./observability/redisMetrics");
+Object.defineProperty(exports, "instrumentAccessiRedisClient", { enumerable: true, get: function () { return redisMetrics_1.instrumentAccessiRedisClient; } });
 var jwtTokenOptions_1 = require("./security/jwtTokenOptions");
 Object.defineProperty(exports, "getAccessiAccessTokenSigningConfig", { enumerable: true, get: function () { return jwtTokenOptions_1.getAccessiAccessTokenSigningConfig; } });
 Object.defineProperty(exports, "getAccessiAccessTokenVerificationConfig", { enumerable: true, get: function () { return jwtTokenOptions_1.getAccessiAccessTokenVerificationConfig; } });