npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.77 → 2.0.0-dev.79 - Mend

emilsoftware-utilities 2.0.0-dev.77 → 2.0.0-dev.79

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (89) hide show

package/dist/accessi/server/standalone.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"standalone.js","sourceRoot":"","sources":["../../../src/accessi/server/standalone.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAsGA,oDAiGC;AAKD,kDAeC;AA3ND,sDAA8B;AAG9B,yCAAsC;AACtC,mCAAgC;AAChC,yDAA+D;AAK/D,uGAA0G;AAC1G,qEAI+C;AAE/C,mFAAkH;AA8BlH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB,EAAQ,EAAE;QAC1E,QAAQ,IAAI,CAAC,CAAC;QACd,QAAQ,IAAI,CAAC,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;;YACpB,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAW,EAAE;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG;YACZ,2DAA2D;YAC3D,4CAA4C;YAC5C,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC5B,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,uCAAuC,MAAM,MAAM,KAAK,EAAE,CAChF;YACD,wDAAwD;YACxD,qCAAqC;YACrC,0BAA0B,QAAQ,EAAE;YACpC,4DAA4D;YAC5D,6CAA6C;YAC7C,kCAAkC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,EAAE;YAC/E,2DAA2D;YAC3D,2CAA2C;YAC3C,4CAA4C,MAAM,CAAC,GAAG,EAAE;YACxD,iDAAiD,MAAM,CAAC,QAAQ,EAAE;YAClE,kDAAkD,MAAM,CAAC,SAAS,EAAE;YACpE,oEAAoE;YACpE,oDAAoD;YACpD,uCAAuC,QAAQ,EAAE;SAClD,CAAC;QACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAsB,oBAAoB;yDACxC,UAAiC,EAAE;;QAEnC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,cAAc,mCAAI,IAAA,mDAA2B,GAAE,CAAC;QAC/E,IAAA,2CAAyB,EAAC,cAAc,CAAC,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,IAAA,wCAAsB,EAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtE,MAAM,CAAC,OAAO,CAAC,2BAA2B,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAA,iBAAO,GAAE,CAAC;QACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,SAAS,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,EAAE,CAAC;QACtD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,OAAiE,CAAC;QACtE,IAAI,QAAmE,CAAC;QACxE,IAAI,MAA0B,CAAC;QAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,mCAAuB,GAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,QAAQ,EAAE,CAAO,IAAa,EAAE,GAAa,EAAE,EAAE;YACpE,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE;iBACzE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAqB,EAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,IAAA,+BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAA,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;gBAChE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAuB,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAClE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACzB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,WAAW,GAAG,IAAI,CAAC;QAEnB,MAAM,IAAI,GAAG,GAAwB,EAAE;;YACrC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,iBAAiB,mCAAI,KAAM,CAAC,CAAC;YACrE,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC5B,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,EAAE,CAAC;oBAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChC,CAAC,CAAC;gBACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,CAAA,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAG,CAAC,UAAU,EAAE,CAAC;YACzB,CAAC;QACH,CAAC,CAAA,CAAC;QAEF,MAAM,KAAK,GAAG,GAA0B,EAAE;;YACxC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,IAAI,mCAAI,IAAI,CAAC,CAAC;YAC9D,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI;oBAC3B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,wCAAwC,MAAA,OAAO,CAAC,IAAI,mCAAI,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC/F,OAAO,MAAM,CAAC;QAChB,CAAC,CAAA,CAAC;QAEF,OAAO;YACL,GAAG;YACH,IAAI,OAAO;gBACT,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACpE,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,QAAQ;gBACV,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACrE,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,KAAK;YACL,IAAI;SACL,CAAC;IACJ,CAAC;CAAA;AAED;;GAEG;AACH,SAAsB,mBAAmB;yDAAC,UAAiC,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QAEtB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAO,MAAc,EAAiB,EAAE;YACvD,IAAI,YAAY;gBAAE,OAAO;YACzB,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,MAAM,qBAAqB,CAAC,CAAC;YAC3E,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAA,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC;CAAA","sourcesContent":["import express from 'express';\nimport type { Application, Request, Response } from 'express';\nimport type { Server } from 'http';\nimport { Logger } from '../../Logger';\nimport { Orm } from '../../Orm';\nimport { initializeAccessiModule } from '../../accessi-module';\nimport type {\n AccessiModuleInitializationResult,\n} from '../../accessi-module';\nimport type { AccessiOptions } from '../../accessi-module/AccessiModule';\nimport { createAccessiOptionsFromEnv } from '../../accessi-module/database-updates/accessiOptionsFromEnv';\nimport {\n checkAccessiReadiness,\n createAccessiLiveReport,\n readinessHttpStatus,\n} from '../../accessi-module/health/readiness';\nimport type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';\nimport { assertValidAccessiOptions, validateAccessiOptions } from '../../accessi-module/security/validateOptions';\n\nexport type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';\n\n\nexport interface AccessiServiceOptions {\n /** Applicazione Express gia esistente. Default: nuova app. /\n app?: Application;\n /* Configurazione completa. Default: `createAccessiOptionsFromEnv()`. /\n accessiOptions?: AccessiOptions;\n port?: number;\n host?: string;\n /* Path base degli endpoint health. Default: `/health`. /\n healthPath?: string;\n /* Espone `/health/metrics` in formato Prometheus. Default: true. /\n metrics?: boolean;\n /* Check aggiuntivi per la readiness. /\n readinessChecks?: AccessiReadinessCheck[];\n /* Timeout chiusura server. Default: 10000 ms. /\n shutdownTimeoutMs?: number;\n}\n\nexport interface AccessiService {\n app: Application;\n nestApp: AccessiModuleInitializationResult['nestApp'];\n document: AccessiModuleInitializationResult['document'];\n start(): Promise<Server>;\n stop(): Promise<void>;\n}\n\nfunction normalizePath(value: string): string {\n return `/${value.replace(/^\\/+\|\\/+$/g, '')}`;\n}\n\nfunction createMetrics() {\n const startedAt = Date.now();\n let requests = 0;\n let inFlight = 0;\n const statuses = new Map<string, number>();\n\n const middleware = (_req: Request, res: Response, next: () => void): void => {\n requests += 1;\n inFlight += 1;\n res.on('finish', () => {\n inFlight = Math.max(0, inFlight - 1);\n const status = String(res.statusCode);\n statuses.set(status, (statuses.get(status) ?? 0) + 1);\n });\n next();\n };\n\n const render = (): string => {\n const memory = process.memoryUsage();\n const lines = [\n '# HELP accessi_http_requests_total Richieste HTTP totali.',\n '# TYPE accessi_http_requests_total counter',\n ...[...statuses.entries()].map(\n ([status, count]) => `accessi_http_requests_total{status=\"${status}\"} ${count}`,\n ),\n '# HELP accessi_http_in_flight Richieste HTTP in corso.',\n '# TYPE accessi_http_in_flight gauge',\n `accessi_http_in_flight ${inFlight}`,\n '# HELP accessi_process_uptime_seconds Uptime del processo.',\n '# TYPE accessi_process_uptime_seconds gauge',\n `accessi_process_uptime_seconds ${Math.floor((Date.now() - startedAt) / 1000)}`,\n '# HELP accessi_process_memory_bytes Memoria del processo.',\n '# TYPE accessi_process_memory_bytes gauge',\n `accessi_process_memory_bytes{type=\"rss\"} ${memory.rss}`,\n `accessi_process_memory_bytes{type=\"heapUsed\"} ${memory.heapUsed}`,\n `accessi_process_memory_bytes{type=\"heapTotal\"} ${memory.heapTotal}`,\n '# HELP accessi_http_requests_started_total Richieste HTTP avviate.',\n '# TYPE accessi_http_requests_started_total counter',\n `accessi_http_requests_started_total ${requests}`,\n ];\n return `${lines.join('\\n')}\\n`;\n };\n\n return { middleware, render };\n}\n\n/\n Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.\n \n Non apre la porta finche non viene chiamato `start()`.\n /\nexport async function createAccessiService(\n options: AccessiServiceOptions = {},\n): Promise<AccessiService> {\n const logger = new Logger('AccessiService');\n const accessiOptions = options.accessiOptions ?? createAccessiOptionsFromEnv();\n assertValidAccessiOptions(accessiOptions);\n for (const warning of validateAccessiOptions(accessiOptions).warnings) {\n logger.warning(`Configurazione Accessi: ${warning.code} - ${warning.message}`);\n }\n\n const app = options.app ?? express();\n const healthPath = normalizePath(options.healthPath ?? '/health');\n const metrics = createMetrics();\n const readinessChecks = options.readinessChecks ?? [];\n let initialized = false;\n let nestApp: AccessiModuleInitializationResult['nestApp'] \| undefined;\n let document: AccessiModuleInitializationResult['document'] \| undefined;\n let server: Server \| undefined;\n let stopping = false;\n\n app.use(metrics.middleware);\n\n app.get(`${healthPath}/live`, (_req: Request, res: Response) => {\n res.status(200).json(createAccessiLiveReport());\n });\n\n app.get(`${healthPath}/ready`, async (_req: Request, res: Response) => {\n if (!initialized \|\| !nestApp) {\n res.status(503).json({\n status: 'error',\n checks: { bootstrap: { ok: false, detail: 'bootstrap non completato' } },\n });\n return;\n }\n\n const report = await checkAccessiReadiness(accessiOptions, readinessChecks);\n res.status(readinessHttpStatus(report)).json(report);\n });\n\n if (options.metrics !== false) {\n app.get(`${healthPath}/metrics`, (_req: Request, res: Response) => {\n res.setHeader('Content-Type', 'text/plain; version=0.0.4');\n res.status(200).send(metrics.render());\n });\n }\n\n const result = await initializeAccessiModule(app, accessiOptions);\n nestApp = result.nestApp;\n document = result.document;\n initialized = true;\n\n const stop = async (): Promise<void> => {\n if (stopping) return;\n stopping = true;\n const timeout = Math.max(1_000, options.shutdownTimeoutMs ?? 10_000);\n await Promise.race([\n new Promise<void>((resolve) => {\n if (!server) return resolve();\n server.close(() => resolve());\n }),\n new Promise<void>((resolve) => setTimeout(resolve, timeout)),\n ]);\n try {\n await nestApp?.close();\n } finally {\n await Orm.closePools();\n }\n };\n\n const start = async (): Promise<Server> => {\n if (server) return server;\n const port = options.port ?? Number(process.env.PORT ?? 3000);\n server = await new Promise<Server>((resolve, reject) => {\n const listener = options.host\n ? app.listen(port, options.host, () => resolve(listener))\n : app.listen(port, () => resolve(listener));\n listener.once('error', reject);\n });\n const address = server.address();\n const actualPort = typeof address === 'object' && address ? address.port : port;\n logger.info(`Accessi Service in ascolto su http://${options.host ?? '0.0.0.0'}:${actualPort}`);\n return server;\n };\n\n return {\n app,\n get nestApp() {\n if (!nestApp) throw new Error('Accessi Service non inizializzato.');\n return nestApp;\n },\n get document() {\n if (!document) throw new Error('Documento OpenAPI non disponibile.');\n return document;\n },\n start,\n stop,\n };\n}\n\n/\n Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.\n */\nexport async function startAccessiService(options: AccessiServiceOptions = {}): Promise<AccessiService> {\n const service = await createAccessiService(options);\n await service.start();\n\n let shuttingDown = false;\n const shutdown = async (signal: string): Promise<void> => {\n if (shuttingDown) return;\n shuttingDown = true;\n new Logger('AccessiService').info(`Ricevuto ${signal}: arresto in corso.`);\n await service.stop();\n };\n\n process.once('SIGTERM', () => { void shutdown('SIGTERM'); });\n process.once('SIGINT', () => { void shutdown('SIGINT'); });\n return service;\n}\n"]}
1	+ {"version":3,"file":"standalone.js","sourceRoot":"","sources":["../../../src/accessi/server/standalone.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAuGA,oDAiGC;AAKD,kDAeC;AA5ND,sDAA8B;AAG9B,yCAAsC;AACtC,mCAAgC;AAChC,yDAA+D;AAK/D,uGAA0G;AAC1G,qEAI+C;AAE/C,mFAAkH;AAClH,wEAAkF;AA8BlF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB,EAAQ,EAAE;QAC1E,QAAQ,IAAI,CAAC,CAAC;QACd,QAAQ,IAAI,CAAC,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;;YACpB,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAW,EAAE;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG;YACZ,2DAA2D;YAC3D,4CAA4C;YAC5C,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC5B,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,uCAAuC,MAAM,MAAM,KAAK,EAAE,CAChF;YACD,wDAAwD;YACxD,qCAAqC;YACrC,0BAA0B,QAAQ,EAAE;YACpC,4DAA4D;YAC5D,6CAA6C;YAC7C,kCAAkC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,EAAE;YAC/E,2DAA2D;YAC3D,2CAA2C;YAC3C,4CAA4C,MAAM,CAAC,GAAG,EAAE;YACxD,iDAAiD,MAAM,CAAC,QAAQ,EAAE;YAClE,kDAAkD,MAAM,CAAC,SAAS,EAAE;YACpE,oEAAoE;YACpE,oDAAoD;YACpD,uCAAuC,QAAQ,EAAE;SAClD,CAAC;QACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAsB,oBAAoB;yDACxC,UAAiC,EAAE;;QAEnC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,cAAc,mCAAI,IAAA,mDAA2B,GAAE,CAAC;QAC/E,IAAA,2CAAyB,EAAC,cAAc,CAAC,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,IAAA,wCAAsB,EAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtE,MAAM,CAAC,OAAO,CAAC,2BAA2B,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAA,iBAAO,GAAE,CAAC;QACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,SAAS,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,EAAE,CAAC;QACtD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,OAAiE,CAAC;QACtE,IAAI,QAAmE,CAAC;QACxE,IAAI,MAA0B,CAAC;QAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,mCAAuB,GAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,QAAQ,EAAE,CAAO,IAAa,EAAE,GAAa,EAAE,EAAE;YACpE,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE;iBACzE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAqB,EAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,IAAA,+BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAA,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;gBAChE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAA,8BAAoB,GAAE,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAuB,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAClE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACzB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,WAAW,GAAG,IAAI,CAAC;QAEnB,MAAM,IAAI,GAAG,GAAwB,EAAE;;YACrC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,iBAAiB,mCAAI,KAAM,CAAC,CAAC;YACrE,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC5B,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,EAAE,CAAC;oBAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChC,CAAC,CAAC;gBACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,CAAA,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAG,CAAC,UAAU,EAAE,CAAC;YACzB,CAAC;QACH,CAAC,CAAA,CAAC;QAEF,MAAM,KAAK,GAAG,GAA0B,EAAE;;YACxC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,IAAI,mCAAI,IAAI,CAAC,CAAC;YAC9D,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI;oBAC3B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,wCAAwC,MAAA,OAAO,CAAC,IAAI,mCAAI,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC/F,OAAO,MAAM,CAAC;QAChB,CAAC,CAAA,CAAC;QAEF,OAAO;YACL,GAAG;YACH,IAAI,OAAO;gBACT,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACpE,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,QAAQ;gBACV,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACrE,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,KAAK;YACL,IAAI;SACL,CAAC;IACJ,CAAC;CAAA;AAED;;GAEG;AACH,SAAsB,mBAAmB;yDAAC,UAAiC,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QAEtB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAO,MAAc,EAAiB,EAAE;YACvD,IAAI,YAAY;gBAAE,OAAO;YACzB,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,MAAM,qBAAqB,CAAC,CAAC;YAC3E,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAA,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC;CAAA","sourcesContent":["import express from 'express';\nimport type { Application, Request, Response } from 'express';\nimport type { Server } from 'http';\nimport { Logger } from '../../Logger';\nimport { Orm } from '../../Orm';\nimport { initializeAccessiModule } from '../../accessi-module';\nimport type {\n AccessiModuleInitializationResult,\n} from '../../accessi-module';\nimport type { AccessiOptions } from '../../accessi-module/AccessiModule';\nimport { createAccessiOptionsFromEnv } from '../../accessi-module/database-updates/accessiOptionsFromEnv';\nimport {\n checkAccessiReadiness,\n createAccessiLiveReport,\n readinessHttpStatus,\n} from '../../accessi-module/health/readiness';\nimport type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';\nimport { assertValidAccessiOptions, validateAccessiOptions } from '../../accessi-module/security/validateOptions';\nimport { renderAccessiMetrics } from '../../accessi-module/observability/metrics';\n\nexport type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';\n\n\nexport interface AccessiServiceOptions {\n /** Applicazione Express gia esistente. Default: nuova app. /\n app?: Application;\n /* Configurazione completa. Default: `createAccessiOptionsFromEnv()`. /\n accessiOptions?: AccessiOptions;\n port?: number;\n host?: string;\n /* Path base degli endpoint health. Default: `/health`. /\n healthPath?: string;\n /* Espone `/health/metrics` in formato Prometheus. Default: true. /\n metrics?: boolean;\n /* Check aggiuntivi per la readiness. /\n readinessChecks?: AccessiReadinessCheck[];\n /* Timeout chiusura server. Default: 10000 ms. /\n shutdownTimeoutMs?: number;\n}\n\nexport interface AccessiService {\n app: Application;\n nestApp: AccessiModuleInitializationResult['nestApp'];\n document: AccessiModuleInitializationResult['document'];\n start(): Promise<Server>;\n stop(): Promise<void>;\n}\n\nfunction normalizePath(value: string): string {\n return `/${value.replace(/^\\/+\|\\/+$/g, '')}`;\n}\n\nfunction createMetrics() {\n const startedAt = Date.now();\n let requests = 0;\n let inFlight = 0;\n const statuses = new Map<string, number>();\n\n const middleware = (_req: Request, res: Response, next: () => void): void => {\n requests += 1;\n inFlight += 1;\n res.on('finish', () => {\n inFlight = Math.max(0, inFlight - 1);\n const status = String(res.statusCode);\n statuses.set(status, (statuses.get(status) ?? 0) + 1);\n });\n next();\n };\n\n const render = (): string => {\n const memory = process.memoryUsage();\n const lines = [\n '# HELP accessi_http_requests_total Richieste HTTP totali.',\n '# TYPE accessi_http_requests_total counter',\n ...[...statuses.entries()].map(\n ([status, count]) => `accessi_http_requests_total{status=\"${status}\"} ${count}`,\n ),\n '# HELP accessi_http_in_flight Richieste HTTP in corso.',\n '# TYPE accessi_http_in_flight gauge',\n `accessi_http_in_flight ${inFlight}`,\n '# HELP accessi_process_uptime_seconds Uptime del processo.',\n '# TYPE accessi_process_uptime_seconds gauge',\n `accessi_process_uptime_seconds ${Math.floor((Date.now() - startedAt) / 1000)}`,\n '# HELP accessi_process_memory_bytes Memoria del processo.',\n '# TYPE accessi_process_memory_bytes gauge',\n `accessi_process_memory_bytes{type=\"rss\"} ${memory.rss}`,\n `accessi_process_memory_bytes{type=\"heapUsed\"} ${memory.heapUsed}`,\n `accessi_process_memory_bytes{type=\"heapTotal\"} ${memory.heapTotal}`,\n '# HELP accessi_http_requests_started_total Richieste HTTP avviate.',\n '# TYPE accessi_http_requests_started_total counter',\n `accessi_http_requests_started_total ${requests}`,\n ];\n return `${lines.join('\\n')}\\n`;\n };\n\n return { middleware, render };\n}\n\n/\n Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.\n \n Non apre la porta finche non viene chiamato `start()`.\n /\nexport async function createAccessiService(\n options: AccessiServiceOptions = {},\n): Promise<AccessiService> {\n const logger = new Logger('AccessiService');\n const accessiOptions = options.accessiOptions ?? createAccessiOptionsFromEnv();\n assertValidAccessiOptions(accessiOptions);\n for (const warning of validateAccessiOptions(accessiOptions).warnings) {\n logger.warning(`Configurazione Accessi: ${warning.code} - ${warning.message}`);\n }\n\n const app = options.app ?? express();\n const healthPath = normalizePath(options.healthPath ?? '/health');\n const metrics = createMetrics();\n const readinessChecks = options.readinessChecks ?? [];\n let initialized = false;\n let nestApp: AccessiModuleInitializationResult['nestApp'] \| undefined;\n let document: AccessiModuleInitializationResult['document'] \| undefined;\n let server: Server \| undefined;\n let stopping = false;\n\n app.use(metrics.middleware);\n\n app.get(`${healthPath}/live`, (_req: Request, res: Response) => {\n res.status(200).json(createAccessiLiveReport());\n });\n\n app.get(`${healthPath}/ready`, async (_req: Request, res: Response) => {\n if (!initialized \|\| !nestApp) {\n res.status(503).json({\n status: 'error',\n checks: { bootstrap: { ok: false, detail: 'bootstrap non completato' } },\n });\n return;\n }\n\n const report = await checkAccessiReadiness(accessiOptions, readinessChecks);\n res.status(readinessHttpStatus(report)).json(report);\n });\n\n if (options.metrics !== false) {\n app.get(`${healthPath}/metrics`, (_req: Request, res: Response) => {\n res.setHeader('Content-Type', 'text/plain; version=0.0.4');\n res.status(200).send(`${metrics.render()}${renderAccessiMetrics()}`);\n });\n }\n\n const result = await initializeAccessiModule(app, accessiOptions);\n nestApp = result.nestApp;\n document = result.document;\n initialized = true;\n\n const stop = async (): Promise<void> => {\n if (stopping) return;\n stopping = true;\n const timeout = Math.max(1_000, options.shutdownTimeoutMs ?? 10_000);\n await Promise.race([\n new Promise<void>((resolve) => {\n if (!server) return resolve();\n server.close(() => resolve());\n }),\n new Promise<void>((resolve) => setTimeout(resolve, timeout)),\n ]);\n try {\n await nestApp?.close();\n } finally {\n await Orm.closePools();\n }\n };\n\n const start = async (): Promise<Server> => {\n if (server) return server;\n const port = options.port ?? Number(process.env.PORT ?? 3000);\n server = await new Promise<Server>((resolve, reject) => {\n const listener = options.host\n ? app.listen(port, options.host, () => resolve(listener))\n : app.listen(port, () => resolve(listener));\n listener.once('error', reject);\n });\n const address = server.address();\n const actualPort = typeof address === 'object' && address ? address.port : port;\n logger.info(`Accessi Service in ascolto su http://${options.host ?? '0.0.0.0'}:${actualPort}`);\n return server;\n };\n\n return {\n app,\n get nestApp() {\n if (!nestApp) throw new Error('Accessi Service non inizializzato.');\n return nestApp;\n },\n get document() {\n if (!document) throw new Error('Documento OpenAPI non disponibile.');\n return document;\n },\n start,\n stop,\n };\n}\n\n/\n Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.\n */\nexport async function startAccessiService(options: AccessiServiceOptions = {}): Promise<AccessiService> {\n const service = await createAccessiService(options);\n await service.start();\n\n let shuttingDown = false;\n const shutdown = async (signal: string): Promise<void> => {\n if (shuttingDown) return;\n shuttingDown = true;\n new Logger('AccessiService').info(`Ricevuto ${signal}: arresto in corso.`);\n await service.stop();\n };\n\n process.once('SIGTERM', () => { void shutdown('SIGTERM'); });\n process.once('SIGINT', () => { void shutdown('SIGINT'); });\n return service;\n}\n"]}

package/dist/accessi-module/AccessiModule.d.ts CHANGED Viewed

@@ -65,6 +65,8 @@ export interface ConsoleEntryOptions {
 }
 import type { AccessiSecurityHeadersSetting } from './security/securityHeaders';
 import type { AccessiAuthCookieOptions } from './security/authCookies';
+import type { AccessiMetricsOptions } from './observability/metrics';
+import type { AccessiAuditOptions } from './security/audit';
 /** Impostazioni HTTP del servizio Accessi. */
 export interface AccessiHttpOptions {
     /** Opzioni CORS Nest. `false` disabilita CORS. Default: exposedHeaders ['X-Total-Count']. */
@@ -244,6 +246,8 @@ export interface AccessiOptions {
     systemSeeds?: SystemSeedsOptions;
     /** Bootstrap del primo admin tramite token casuale stampato a ogni avvio. */
     adminBootstrap?: AdminBootstrapOptions;
+    /** Audit persistente: sink, retention ed endpoint amministrativi di query/export. */
+    audit?: AccessiAuditOptions;
     /** Base URL pubblica usata solo per loggare gli indirizzi (console, OpenAPI, API). */
     publicBaseUrl?: string;
     /** Base URL API per la console quando UI e API sono su domini diversi. */
@@ -268,6 +272,8 @@ export interface AccessiOptions {
      * la modalita si abilita passando questo oggetto (o `enabled: true`).
      */
     authCookie?: AccessiAuthCookieOptions;
+    /** Metriche di dominio (login, 2FA, refresh, rate limit, store, ...). */
+    metrics?: AccessiMetricsOptions;
     /** Revoca sessioni per utente tramite store memory/Redis. */
     sessionRevocation?: SessionRevocationOptions;
     /** Revoca dei singoli access token tramite `jti`, memory/Redis. */

package/dist/accessi-module/AccessiModule.js CHANGED Viewed

@@ -39,6 +39,8 @@ const SchemaExportService_1 = require("./Services/SchemaExportService/SchemaExpo
 const AdminBootstrapService_1 = require("./Services/AdminBootstrapService/AdminBootstrapService");
 const jwksBootstrap_1 = require("./security/jwksBootstrap");
 const emailConfiguration_1 = require("./security/emailConfiguration");
+const audit_1 = require("./security/audit");
+const AccessiAuditController_1 = require("./Controllers/AccessiAuditController");
 let AccessiModule = AccessiModule_1 = class AccessiModule {
     /**
      * Registra Accessi nel contenitore Nest del backend ospitante.
@@ -50,6 +52,7 @@ let AccessiModule = AccessiModule_1 = class AccessiModule {
     static forRoot(options) {
         // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.
         (0, emailConfiguration_1.assertEmailConfigured)(options);
+        (0, audit_1.configureAccessiAudit)(options.audit);
         return {
             module: AccessiModule_1,
             providers: [
@@ -106,6 +109,7 @@ exports.AccessiModule = AccessiModule = AccessiModule_1 = __decorate([
             ServiceTokenController_1.ServiceTokenController,
             SchemaController_1.SchemaController,
             AccessiIntrospectionController_1.AccessiIntrospectionController,
+            AccessiAuditController_1.AccessiAuditController,
         ],
         providers: [AuthService_1.AuthService, TwoFactorService_1.TwoFactorService, UserService_1.UserService, EmailService_1.EmailService, PermissionService_1.PermissionService, FiltriService_1.FiltriService, ConfiguratorService_1.ConfiguratorService, jwt_strategy_1.JwtSimpleGuard, authenticateGen_1.AuthenticateGenService, AccessiDatabaseUpdater_1.AccessiDatabaseUpdater, FederatedAuthService_1.FederatedAuthService, ServiceTokenService_1.ServiceTokenService, serviceTokenGuard_1.ServiceTokenGuard, SchemaExportService_1.SchemaExportService, AdminBootstrapService_1.AdminBootstrapService, jwksBootstrap_1.AccessiJwksBootstrapService],
         exports: [AuthService_1.AuthService, UserService_1.UserService, EmailService_1.EmailService, PermissionService_1.PermissionService, FiltriService_1.FiltriService, ConfiguratorService_1.ConfiguratorService, jwt_strategy_1.JwtSimpleGuard, authenticateGen_1.AuthenticateGenService, FederatedAuthService_1.FederatedAuthService, ServiceTokenService_1.ServiceTokenService, serviceTokenGuard_1.ServiceTokenGuard, SchemaExportService_1.SchemaExportService, AdminBootstrapService_1.AdminBootstrapService],

package/dist/accessi-module/AccessiModule.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AccessiModule.js","sourceRoot":"","sources":["../../src/accessi-module/AccessiModule.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,mFAAgF;AAQhF,2CAA+D;AAU/D,oEAAiE;AACjE,uEAAoE;AACpE,sFAAmF;AACnF,oEAAiE;AACjE,mEAAgE;AAChE,iEAA8D;AAC9D,6EAA0E;AAC1E,iEAA8D;AAC9D,0EAAuE;AACvE,qEAAkE;AAClE,iFAA8E;AAC9E,4FAAyF;AACzF,qDAAoD;AACpD,kEAAsE;AACtE,sFAAmF;AACnF,gFAA6E;AAC7E,sFAAmF;AACnF,sGAAmG;AACnG,qFAAkF;AAClF,iFAA8E;AAC9E,iFAA8E;AAC9E,4FAAyF;AACzF,oEAAiE;AACjE,qEAAkE;AAClE,iGAA8F;AAC9F,4FAAyF;AACzF,kGAA+F;AAC/F,4DAAuE;AACvE,sEAAsE;AA0S/D,IAAM,aAAa,qBAAnB,MAAM,aAAa;IACxB;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,CAAC,OAAuB;QACpC,yFAAyF;QACzF,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,eAAa;YACrB,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,iBAAiB;oBAC1B,QAAQ,EAAE,OAAO;iBAClB;gBACD,yBAAW;gBACX,mCAAgB;gBAChB,yBAAW;gBACX,2BAAY;gBACZ,qCAAiB;gBACjB,6BAAa;gBACb,yCAAmB;gBACnB,6BAAc;gBACd,wCAAsB;gBACtB,+CAAsB;gBACtB,2CAAoB;gBACpB,yCAAmB;gBACnB,qCAAiB,EAAE,yCAAmB,EAAE,6CAAqB,EAAE,2CAA2B;aAAC;YAC7F,OAAO,EAAE;gBACP,iBAAiB;gBACjB,yBAAW;gBACX,yBAAW;gBACX,2BAAY;gBACZ,qCAAiB;gBACjB,6BAAa;gBACb,yCAAmB;gBACnB,6BAAc;gBACd,wCAAsB;gBACtB,2CAAoB;gBACpB,yCAAmB;gBACnB,qCAAiB,EAAE,yCAAmB,EAAE,6CAAqB;aAAC;SACjE,CAAC;IACJ,CAAC;CACF,CAAA;AA9CY,sCAAa;wBAAb,aAAa;IApBzB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,WAAW,EAAE;YACX,iCAAe;YACf,+BAAc;YACd,2CAAoB;YACpB,+BAAc;YACd,mCAAgB;YAChB,+CAAsB;YACtB,iDAAuB;YACvB,mDAAwB;YACxB,+CAAsB;YACtB,iEAA+B;YAC/B,+CAAsB;YACtB,mCAAgB;YAChB,+DAA8B;SAC/B;QACD,SAAS,EAAE,CAAC,yBAAW,EAAE,mCAAgB,EAAE,yBAAW,EAAE,2BAAY,EAAE,qCAAiB,EAAE,6BAAa,EAAE,yCAAmB,EAAE,6BAAc,EAAE,wCAAsB,EAAE,+CAAsB,EAAE,2CAAoB,EAAE,yCAAmB,EAAE,qCAAiB,EAAE,yCAAmB,EAAE,6CAAqB,EAAE,2CAA2B,CAAC;QACnU,OAAO,EAAE,CAAC,yBAAW,EAAE,yBAAW,EAAE,2BAAY,EAAE,qCAAiB,EAAE,6BAAa,EAAE,yCAAmB,EAAE,6BAAc,EAAE,wCAAsB,EAAE,2CAAoB,EAAE,yCAAmB,EAAE,qCAAiB,EAAE,yCAAmB,EAAE,6CAAqB,CAAC;KAC3P,CAAC;GACW,aAAa,CA8CzB","sourcesContent":["import { TwoFactorService } from './Services/TwoFactorService/TwoFactorService';\n/*\n Modulo che gestisce le operazioni di accesso degli utenti, incluse le rotte, il controller e il modello.\n \n @module AccessiModule\n * @author mttdev382\n /\nimport { Options } from 'node-firebird';\nimport { DynamicModule, Global, Module } from '@nestjs/common';\nimport type { INestApplication, LoggerService } from '@nestjs/common';\nimport type { OpenApiSetupOptions } from '../openapi/OpenApiConfig';\nimport type { AccessiAccessTokenAlgorithm, AccessiUnknownKeyIdEvent } from './security/jwtTokenOptions';\nimport type { ConsoleEntryStore } from './security/consoleEntry';\nimport type { RateLimitStore } from './security/rateLimitStore';\nimport type { AccessiEdgeRateLimitOptions } from './security/edgeRateLimit';\nimport type { SessionRevocationOptions } from './security/sessionRevocation';\nimport type { AccessTokenRevocationOptions } from './security/accessTokenRevocation';\nimport type { RefreshTokenRotationOptions } from './security/refreshTokenRotation';\nimport { AuthService } from './Services/AuthService/AuthService';\nimport { EmailService } from './Services/EmailService/EmailService';\nimport { PermissionService } from './Services/PermissionService/PermissionService';\nimport { UserService } from './Services/UserService/UserService';\nimport { EmailController } from './Controllers/EmailController';\nimport { AuthController } from './Controllers/AuthController';\nimport { PermissionController } from './Controllers/PermissionController';\nimport { UserController } from './Controllers/UserController';\nimport { FiltriService } from './Services/FiltriService/FiltriService';\nimport { FiltriController } from './Controllers/FiltriController';\nimport { ConfiguratorController } from './Controllers/ConfiguratorController';\nimport { ConfiguratorService } from './Services/ConfiguratorService/ConfiguratorService';\nimport { JwtSimpleGuard } from './jwt/jwt.strategy';\nimport { AuthenticateGenService } from './middleware/authenticateGen';\nimport { AccessiDatabaseUpdater } from './database-updates/AccessiDatabaseUpdater';\nimport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nimport { FederatedAuthController } from './federated-auth/FederatedAuthController';\nimport { FederatedAuthExchangeController } from './federated-auth/FederatedAuthExchangeController';\nimport { AccessiConsoleController } from './Controllers/AccessiConsoleController';\nimport { ConsoleEntryController } from './Controllers/ConsoleEntryController';\nimport { ServiceTokenController } from './Controllers/ServiceTokenController';\nimport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nimport { ServiceTokenGuard } from './security/serviceTokenGuard';\nimport { SchemaController } from './Controllers/SchemaController';\nimport { AccessiIntrospectionController } from './Controllers/AccessiIntrospectionController';\nimport { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';\nimport { AdminBootstrapService } from './Services/AdminBootstrapService/AdminBootstrapService';\nimport { AccessiJwksBootstrapService } from './security/jwksBootstrap';\nimport { assertEmailConfigured } from './security/emailConfiguration';\n\n/* JWT emesso da Accessi dopo un login locale o SSO. Non riutilizzare il segreto del provider SSO. /\nexport interface JwtOptions {\n /* Segreto simmetrico per firmare e verificare i JWT Accessi; deve essere unico per ambiente. /\n secret: string;\n /* Issuer (`iss`) opzionale degli access token. Consigliato in una topologia multi-servizio. /\n issuer?: string;\n /* Audience (`aud`) opzionale degli access token. /\n audience?: string \| string[];\n /* Algoritmo degli access token. Default `HS256` per retrocompatibilita. /\n algorithm?: AccessiAccessTokenAlgorithm;\n /* Chiave privata PEM per RS/ES. Obbligatoria quando `algorithm` non e HS. /\n privateKey?: string;\n /** Chiave pubblica PEM per la verifica RS/ES. /\n publicKey?: string;\n /* Key id pubblicato nella JWKS, per rotazione chiavi. /\n keyId?: string;\n /* Path pubblico della JWKS. Default `accessi/.well-known/jwks.json` con algoritmi asimmetrici. /\n jwksPath?: string;\n /\n Chiavi pubbliche precedenti, esposte in JWKS e accettate in verifica\n * durante la rotazione. Se `keyId` e assente si usa il fingerprint della\n * chiave, lo stesso calcolato dalla JWKS.\n /\n previousPublicKeys?: Array<{\n publicKey: string;\n keyId?: string;\n algorithm?: AccessiAccessTokenAlgorithm;\n }>;\n /\n Alert quando un token presenta un `kid` assente da chiave corrente e\n * chiavi precedenti (tipico di una rotazione non completata).\n /\n onUnknownKeyId?: (event: AccessiUnknownKeyIdEvent) => void;\n /* Durata compatibile con `jsonwebtoken`, per esempio `24h` o `3600s`. /\n expiresIn: string;\n /\n Durata del refresh token. Se assente il refresh token non viene emesso.\n * Consigliato: `30d`.\n /\n refreshExpiresIn?: string;\n}\n\n/* Configurazione dei ticket di ingresso alla console. /\nexport interface ConsoleEntryOptions {\n /* Durata del ticket in millisecondi. Default 60000. /\n ttlMs?: number;\n /* Store condiviso (es. Redis) per deployment multi-istanza. Default: memoria. /\n store?: ConsoleEntryStore;\n}\n\nimport type { AccessiSecurityHeadersSetting } from './security/securityHeaders';\nimport type { AccessiAuthCookieOptions } from './security/authCookies';\n\n/* Impostazioni HTTP del servizio Accessi. /\nexport interface AccessiHttpOptions {\n /* Opzioni CORS Nest. `false` disabilita CORS. Default: exposedHeaders ['X-Total-Count']. /\n cors?: Parameters<INestApplication['enableCors']>[0] \| false;\n /* Trust proxy per IP reali dietro load balancer/reverse proxy. /\n trustProxy?: boolean \| number \| string;\n /* Header di sicurezza di base su console/OpenAPI. Default: true. /\n securityHeaders?: AccessiSecurityHeadersSetting;\n}\n\n/* Parametri SMTP usati esclusivamente per impostazione e reset della password. /\nexport interface EmailOptions {\n host: string;\n port: number;\n secure: boolean;\n requireTLS : boolean;\n tls: {\n rejectUnauthorized: boolean,\n }\n from: string;\n auth: {\n user: string;\n pass: string;\n };\n}\n\n/* Configura campi applicativi aggiuntivi restituiti insieme al profilo Accessi. /\nexport interface ExtensionFieldsOptions {\n /* Connessione al database contenente la tabella estesa. /\n databaseOptions: Options;\n /* Chiave con cui i dati saranno esposti nella risposta. /\n objectKey: string;\n /* Tabella applicativa contenente i dati estesi. /\n tableName: string;\n /* Colonne consentite; non valorizzarle mai con input HTTP. /\n tableFields: string[];\n /* Colonna correlata a `UTENTI.CODUTE`. /\n tableJoinFieldName: string;\n}\n\n/* Limite per una singola categoria di endpoint pubblici. /\nexport interface PublicAuthRateLimitRuleOptions {\n windowMs: number;\n maxAttempts: number;\n}\n\n/* Protezione degli endpoint pubblici. Default in memoria; in cluster usare uno store condiviso. /\nexport interface PublicAuthRateLimitOptions {\n enabled?: boolean;\n /* Store condiviso (es. Redis). Default: memoria del processo. /\n store?: RateLimitStore;\n login?: PublicAuthRateLimitRuleOptions;\n register?: PublicAuthRateLimitRuleOptions;\n passwordResetEmail?: PublicAuthRateLimitRuleOptions;\n passwordResetConfirm?: PublicAuthRateLimitRuleOptions;\n refresh?: PublicAuthRateLimitRuleOptions;\n getUserByToken?: PublicAuthRateLimitRuleOptions;\n twoFactorVerify?: PublicAuthRateLimitRuleOptions;\n twoFactorResend?: PublicAuthRateLimitRuleOptions;\n adminBootstrap?: PublicAuthRateLimitRuleOptions;\n consoleEntry?: PublicAuthRateLimitRuleOptions;\n}\n\n/\n Bootstrap del primo admin. Se abilitato, Accessi genera un token casuale a ogni avvio del\n * processo, lo stampa nel log e lo accetta sull'endpoint pubblico `POST /accessi/auth/bootstrap-admin`.\n * Serve a creare il primo utente admin senza email di conferma e senza un admin gia esistente.\n /\nexport interface AdminBootstrapOptions {\n /* Abilita il bootstrap admin. Default `false`. /\n enabled?: boolean;\n /* Crea l'utente come superutente oltre che admin. Default `true`. /\n superUser?: boolean;\n}\n\n/* Controls the legacy public username/password registration endpoint. Disabled by default. /\nexport interface PublicRegistrationOptions {\n /* Enables POST /accessi/user/register. Applications that used it before must opt in explicitly. /\n enabled?: boolean;\n}\n\n/* Configurazione dei token di servizio (macchina-a-macchina, senza utente). /\nexport interface ServiceTokenOptions {\n /* Abilita gli endpoint amministrativi dei service token. Default `true`. /\n enabled?: boolean;\n /* Durata predefinita in giorni quando non e indicata una scadenza esplicita. Default: nessuna scadenza. /\n defaultTtlDays?: number;\n /* Store condiviso per il rate limit dei service token. Default: memoria. /\n rateLimitStore?: RateLimitStore;\n}\n\n/* Cosa fare quando uno script gia applicato presenta un checksum diverso (file modificato). /\nexport type CatalogScriptChecksumPolicy = 'error' \| 'warn' \| 'reapply';\n\n/\n Catalog migrations applicative (menu, ruoli, tipi, cataloghi). Gli script `.sql` vivono nel\n * backend ospitante (versionati in repository) e vengono eseguiti da Accessi dopo la\n * riconciliazione dello schema. Ogni script e tracciato nella tabella `ACCESSI_CATALOG_SCRIPT`,\n * quindi viene applicato una sola volta per database (idempotenza lato DB).\n /\nexport interface SystemSeedsOptions {\n /* `false` disabilita il seed automatico, ad esempio per ambienti gestiti manualmente. /\n enabled?: boolean;\n}\n\nexport interface CatalogScriptsOptions {\n /* Abilita l'esecuzione automatica al bootstrap. Default `false`. /\n enabled?: boolean;\n /* Cartella contenente gli script `.sql` (assoluta o relativa alla working directory). /\n folder: string;\n /* Cosa fare se il checksum di uno script applicato e cambiato. Default `error`. /\n onChecksumMismatch?: CatalogScriptChecksumPolicy;\n /* Se `true` (default) un errore interrompe l'esecuzione e non avanza allo script successivo. /\n stopOnError?: boolean;\n /* Globi/estensioni inclusi. Default: tutti i `.sql`. /\n include?: string[];\n /* Numero massimo di script eseguiti in un singolo run (protezione operativa). Default: illimitato. /\n maxScriptsPerRun?: number;\n /\n Permette statement DDL/schema negli script. Default `false`: le catalog migrations possono\n * modificare solo righe. Sconsigliato: lo schema e di competenza di `db:update:accessi`.\n /\n allowDdl?: boolean;\n}\n\n/\n Enables Accessi's provider-agnostic federated identity capability.\n \n Accessi never validates Azure, Google, Apple, SAML, or other provider tokens.\n * The hosting backend must validate its own SSO flow and pass only a verified\n * `{ provider, subject }` identity to FederatedAuthService.\n /\nexport interface FederatedAuthenticationOptions {\n /* Attiva le API SSO generiche; con `false` il comportamento password storico rimane invariato. /\n enabled?: boolean;\n /* @deprecated Schema management is centralized in autoUpdateDatabase. This legacy flag no longer starts separate SSO migrations. /\n autoUpdateSchema?: boolean;\n /* Allows a backend to create a user from a verified external identity without a master user. Default false. /\n allowSelfRegistration?: boolean;\n}\n\n/\n Configurazione completa del modulo Accessi, fornita esclusivamente dal backend ospitante.\n * Segreti JWT, SMTP, database e le configurazioni tecniche dei provider SSO non devono mai raggiungere il browser.\n /\nexport interface AccessiOptions {\n /* Connessione Firebird alla base dati Accessi. /\n databaseOptions: Options;\n /\n Basepath del sito es: 'http://www.il-mio-sito.it/nome-progetto(se c'è)'\n /\n confirmationEmailUrl: string;\n /\n Percorso della pagina di reset personalizzata es. http://localhost:4200/#/admin/reset-password\n * N.B si sostituisce al confirmationMailURl\n /\n customResetPage?: string;\n /* URL di ritorno della pagina standard di reset dopo il completamento. /\n confirmationEmailReturnUrl: string;\n /* Prefisso applicativo facoltativo trasmesso alla pagina standard di reset. /\n confirmationEmailPrefix?: string;\n /* Chiave riservata alla compatibilita e alla migrazione delle password legacy cifrate. /\n encryptionKey: string;\n /* Abilita gli utenti fittizi `admin` e `demo` solo fuori produzione. /\n mockDemoUser: boolean;\n /* Attiva il controllo della scadenza password durante il login locale. /\n passwordExpiration?: boolean;\n /* Giorni di validita della password; quando assente Accessi usa 90 giorni. /\n passwordExpirationDays?: number;\n /* Esegue al bootstrap la conversione non distruttiva delle password legacy. Default `true`. /\n legacyPasswordMigrationOnStartup?: boolean;\n /* Riconcilia lo schema al bootstrap (default `true`). Con `false` verifica comunque la compatibilita in sola lettura e blocca avvii incompatibili. /\n autoUpdateDatabase?: boolean;\n /* Parametri JWT dei token emessi da Accessi. /\n jwtOptions: JwtOptions;\n /* Parametri SMTP per reset e attivazione password. /\n emailOptions: EmailOptions;\n publicAuthRateLimit?: PublicAuthRateLimitOptions;\n /* Public local registration is deliberately opt-in. Existing applications must set enabled: true to retain it. /\n publicRegistration?: PublicRegistrationOptions;\n /* Optional provider-agnostic SSO support. Provider-specific configuration remains in the hosting backend. /\n federatedAuthentication?: FederatedAuthenticationOptions;\n extensionFieldsOptions?: ExtensionFieldsOptions[];\n /* Token di servizio per chiamate tecniche macchina-a-macchina. Abilitati di default. /\n serviceTokens?: ServiceTokenOptions;\n /* Catalog migrations applicative eseguite dopo la riconciliazione dello schema. /\n catalogScripts?: CatalogScriptsOptions;\n /* Seed di sistema eseguiti dopo la riconciliazione dello schema. Default: abilitati. /\n systemSeeds?: SystemSeedsOptions;\n /* Bootstrap del primo admin tramite token casuale stampato a ogni avvio. /\n adminBootstrap?: AdminBootstrapOptions;\n /* Base URL pubblica usata solo per loggare gli indirizzi (console, OpenAPI, API). /\n publicBaseUrl?: string;\n /* Base URL API per la console quando UI e API sono su domini diversi. /\n consoleApiBaseUrl?: string;\n /\n Documentazione OpenAPI del modulo. Default invariati:\n * UI `accessi/openapi`, JSON `accessi/openapi.json`.\n /\n openapi?: OpenApiSetupOptions;\n /* Logger Nest usato dal sotto-app Accessi. Se assente Nest usa il proprio logger. /\n logger?: LoggerService;\n /* Buffer dei log di bootstrap del sotto-app. Default `true` (comportamento storico). /\n bufferLogs?: boolean;\n /* Ticket di ingresso console: TTL e store condiviso per deployment multi-istanza. /\n consoleEntry?: ConsoleEntryOptions;\n /* Limite grossolano per IP davanti alle rotte Accessi. Opzionale. /\n edgeRateLimit?: AccessiEdgeRateLimitOptions;\n /* CORS, trust proxy e header di sicurezza del servizio. /\n http?: AccessiHttpOptions;\n /\n Autenticazione opzionale via cookie httpOnly. Bearer resta il default:\n * la modalita si abilita passando questo oggetto (o `enabled: true`).\n /\n authCookie?: AccessiAuthCookieOptions;\n /* Revoca sessioni per utente tramite store memory/Redis. /\n sessionRevocation?: SessionRevocationOptions;\n /* Revoca dei singoli access token tramite `jti`, memory/Redis. /\n accessTokenRevocation?: AccessTokenRevocationOptions;\n /* Refresh token monouso tramite rotazione memory/Redis; rileva il riuso e revoca la famiglia. /\n refreshTokenRotation?: RefreshTokenRotationOptions;\n}\n\n@Global()\n@Module({\n controllers: [\n EmailController,\n AuthController,\n PermissionController,\n UserController,\n FiltriController,\n ConfiguratorController,\n FederatedAuthController,\n AccessiConsoleController,\n ConsoleEntryController,\n FederatedAuthExchangeController,\n ServiceTokenController,\n SchemaController,\n AccessiIntrospectionController,\n ],\n providers: [AuthService, TwoFactorService, UserService, EmailService, PermissionService, FiltriService, ConfiguratorService, JwtSimpleGuard, AuthenticateGenService, AccessiDatabaseUpdater, FederatedAuthService, ServiceTokenService, ServiceTokenGuard, SchemaExportService, AdminBootstrapService, AccessiJwksBootstrapService],\n exports: [AuthService, UserService, EmailService, PermissionService, FiltriService, ConfiguratorService, JwtSimpleGuard, AuthenticateGenService, FederatedAuthService, ServiceTokenService, ServiceTokenGuard, SchemaExportService, AdminBootstrapService],\n})\nexport class AccessiModule {\n /\n Registra Accessi nel contenitore Nest del backend ospitante.\n \n Usare questo metodo una sola volta nella composizione dell'applicazione. Per un backend\n * Express esistente usare invece `initializeAccessiModule`, che crea e monta l'host Nest interno.\n * La configurazione viene registrata con il token DI `ACCESSI_OPTIONS` ed e condivisa dai servizi.\n */\n static forRoot(options: AccessiOptions): DynamicModule {\n // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.\n assertEmailConfigured(options);\n return {\n module: AccessiModule,\n providers: [\n {\n provide: 'ACCESSI_OPTIONS',\n useValue: options,\n },\n AuthService,\n TwoFactorService,\n UserService,\n EmailService,\n PermissionService,\n FiltriService,\n ConfiguratorService,\n JwtSimpleGuard,\n AuthenticateGenService,\n AccessiDatabaseUpdater,\n FederatedAuthService,\n ServiceTokenService,\n ServiceTokenGuard, SchemaExportService, AdminBootstrapService, AccessiJwksBootstrapService],\n exports: [\n 'ACCESSI_OPTIONS',\n AuthService,\n UserService,\n EmailService,\n PermissionService,\n FiltriService,\n ConfiguratorService,\n JwtSimpleGuard,\n AuthenticateGenService,\n FederatedAuthService,\n ServiceTokenService,\n ServiceTokenGuard, SchemaExportService, AdminBootstrapService],\n };\n }\n}\n"]}
1	+ {"version":3,"file":"AccessiModule.js","sourceRoot":"","sources":["../../src/accessi-module/AccessiModule.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,mFAAgF;AAQhF,2CAA+D;AAU/D,oEAAiE;AACjE,uEAAoE;AACpE,sFAAmF;AACnF,oEAAiE;AACjE,mEAAgE;AAChE,iEAA8D;AAC9D,6EAA0E;AAC1E,iEAA8D;AAC9D,0EAAuE;AACvE,qEAAkE;AAClE,iFAA8E;AAC9E,4FAAyF;AACzF,qDAAoD;AACpD,kEAAsE;AACtE,sFAAmF;AACnF,gFAA6E;AAC7E,sFAAmF;AACnF,sGAAmG;AACnG,qFAAkF;AAClF,iFAA8E;AAC9E,iFAA8E;AAC9E,4FAAyF;AACzF,oEAAiE;AACjE,qEAAkE;AAClE,iGAA8F;AAC9F,4FAAyF;AACzF,kGAA+F;AAC/F,4DAAuE;AACvE,sEAAsE;AACtE,4CAAyD;AACzD,iFAA8E;AAiTvE,IAAM,aAAa,qBAAnB,MAAM,aAAa;IACxB;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,CAAC,OAAuB;QACpC,yFAAyF;QACzF,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,IAAA,6BAAqB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO;YACL,MAAM,EAAE,eAAa;YACrB,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,iBAAiB;oBAC1B,QAAQ,EAAE,OAAO;iBAClB;gBACD,yBAAW;gBACX,mCAAgB;gBAChB,yBAAW;gBACX,2BAAY;gBACZ,qCAAiB;gBACjB,6BAAa;gBACb,yCAAmB;gBACnB,6BAAc;gBACd,wCAAsB;gBACtB,+CAAsB;gBACtB,2CAAoB;gBACpB,yCAAmB;gBACnB,qCAAiB,EAAE,yCAAmB,EAAE,6CAAqB,EAAE,2CAA2B;aAAC;YAC7F,OAAO,EAAE;gBACP,iBAAiB;gBACjB,yBAAW;gBACX,yBAAW;gBACX,2BAAY;gBACZ,qCAAiB;gBACjB,6BAAa;gBACb,yCAAmB;gBACnB,6BAAc;gBACd,wCAAsB;gBACtB,2CAAoB;gBACpB,yCAAmB;gBACnB,qCAAiB,EAAE,yCAAmB,EAAE,6CAAqB;aAAC;SACjE,CAAC;IACJ,CAAC;CACF,CAAA;AA/CY,sCAAa;wBAAb,aAAa;IArBzB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,WAAW,EAAE;YACX,iCAAe;YACf,+BAAc;YACd,2CAAoB;YACpB,+BAAc;YACd,mCAAgB;YAChB,+CAAsB;YACtB,iDAAuB;YACvB,mDAAwB;YACxB,+CAAsB;YACtB,iEAA+B;YAC/B,+CAAsB;YACtB,mCAAgB;YAChB,+DAA8B;YAC9B,+CAAsB;SACvB;QACD,SAAS,EAAE,CAAC,yBAAW,EAAE,mCAAgB,EAAE,yBAAW,EAAE,2BAAY,EAAE,qCAAiB,EAAE,6BAAa,EAAE,yCAAmB,EAAE,6BAAc,EAAE,wCAAsB,EAAE,+CAAsB,EAAE,2CAAoB,EAAE,yCAAmB,EAAE,qCAAiB,EAAE,yCAAmB,EAAE,6CAAqB,EAAE,2CAA2B,CAAC;QACnU,OAAO,EAAE,CAAC,yBAAW,EAAE,yBAAW,EAAE,2BAAY,EAAE,qCAAiB,EAAE,6BAAa,EAAE,yCAAmB,EAAE,6BAAc,EAAE,wCAAsB,EAAE,2CAAoB,EAAE,yCAAmB,EAAE,qCAAiB,EAAE,yCAAmB,EAAE,6CAAqB,CAAC;KAC3P,CAAC;GACW,aAAa,CA+CzB","sourcesContent":["import { TwoFactorService } from './Services/TwoFactorService/TwoFactorService';\n/*\n Modulo che gestisce le operazioni di accesso degli utenti, incluse le rotte, il controller e il modello.\n \n @module AccessiModule\n * @author mttdev382\n /\nimport { Options } from 'node-firebird';\nimport { DynamicModule, Global, Module } from '@nestjs/common';\nimport type { INestApplication, LoggerService } from '@nestjs/common';\nimport type { OpenApiSetupOptions } from '../openapi/OpenApiConfig';\nimport type { AccessiAccessTokenAlgorithm, AccessiUnknownKeyIdEvent } from './security/jwtTokenOptions';\nimport type { ConsoleEntryStore } from './security/consoleEntry';\nimport type { RateLimitStore } from './security/rateLimitStore';\nimport type { AccessiEdgeRateLimitOptions } from './security/edgeRateLimit';\nimport type { SessionRevocationOptions } from './security/sessionRevocation';\nimport type { AccessTokenRevocationOptions } from './security/accessTokenRevocation';\nimport type { RefreshTokenRotationOptions } from './security/refreshTokenRotation';\nimport { AuthService } from './Services/AuthService/AuthService';\nimport { EmailService } from './Services/EmailService/EmailService';\nimport { PermissionService } from './Services/PermissionService/PermissionService';\nimport { UserService } from './Services/UserService/UserService';\nimport { EmailController } from './Controllers/EmailController';\nimport { AuthController } from './Controllers/AuthController';\nimport { PermissionController } from './Controllers/PermissionController';\nimport { UserController } from './Controllers/UserController';\nimport { FiltriService } from './Services/FiltriService/FiltriService';\nimport { FiltriController } from './Controllers/FiltriController';\nimport { ConfiguratorController } from './Controllers/ConfiguratorController';\nimport { ConfiguratorService } from './Services/ConfiguratorService/ConfiguratorService';\nimport { JwtSimpleGuard } from './jwt/jwt.strategy';\nimport { AuthenticateGenService } from './middleware/authenticateGen';\nimport { AccessiDatabaseUpdater } from './database-updates/AccessiDatabaseUpdater';\nimport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nimport { FederatedAuthController } from './federated-auth/FederatedAuthController';\nimport { FederatedAuthExchangeController } from './federated-auth/FederatedAuthExchangeController';\nimport { AccessiConsoleController } from './Controllers/AccessiConsoleController';\nimport { ConsoleEntryController } from './Controllers/ConsoleEntryController';\nimport { ServiceTokenController } from './Controllers/ServiceTokenController';\nimport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nimport { ServiceTokenGuard } from './security/serviceTokenGuard';\nimport { SchemaController } from './Controllers/SchemaController';\nimport { AccessiIntrospectionController } from './Controllers/AccessiIntrospectionController';\nimport { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';\nimport { AdminBootstrapService } from './Services/AdminBootstrapService/AdminBootstrapService';\nimport { AccessiJwksBootstrapService } from './security/jwksBootstrap';\nimport { assertEmailConfigured } from './security/emailConfiguration';\nimport { configureAccessiAudit } from './security/audit';\nimport { AccessiAuditController } from './Controllers/AccessiAuditController';\n\n/* JWT emesso da Accessi dopo un login locale o SSO. Non riutilizzare il segreto del provider SSO. /\nexport interface JwtOptions {\n /* Segreto simmetrico per firmare e verificare i JWT Accessi; deve essere unico per ambiente. /\n secret: string;\n /* Issuer (`iss`) opzionale degli access token. Consigliato in una topologia multi-servizio. /\n issuer?: string;\n /* Audience (`aud`) opzionale degli access token. /\n audience?: string \| string[];\n /* Algoritmo degli access token. Default `HS256` per retrocompatibilita. /\n algorithm?: AccessiAccessTokenAlgorithm;\n /* Chiave privata PEM per RS/ES. Obbligatoria quando `algorithm` non e HS. /\n privateKey?: string;\n /** Chiave pubblica PEM per la verifica RS/ES. /\n publicKey?: string;\n /* Key id pubblicato nella JWKS, per rotazione chiavi. /\n keyId?: string;\n /* Path pubblico della JWKS. Default `accessi/.well-known/jwks.json` con algoritmi asimmetrici. /\n jwksPath?: string;\n /\n Chiavi pubbliche precedenti, esposte in JWKS e accettate in verifica\n * durante la rotazione. Se `keyId` e assente si usa il fingerprint della\n * chiave, lo stesso calcolato dalla JWKS.\n /\n previousPublicKeys?: Array<{\n publicKey: string;\n keyId?: string;\n algorithm?: AccessiAccessTokenAlgorithm;\n }>;\n /\n Alert quando un token presenta un `kid` assente da chiave corrente e\n * chiavi precedenti (tipico di una rotazione non completata).\n /\n onUnknownKeyId?: (event: AccessiUnknownKeyIdEvent) => void;\n /* Durata compatibile con `jsonwebtoken`, per esempio `24h` o `3600s`. /\n expiresIn: string;\n /\n Durata del refresh token. Se assente il refresh token non viene emesso.\n * Consigliato: `30d`.\n /\n refreshExpiresIn?: string;\n}\n\n/* Configurazione dei ticket di ingresso alla console. /\nexport interface ConsoleEntryOptions {\n /* Durata del ticket in millisecondi. Default 60000. /\n ttlMs?: number;\n /* Store condiviso (es. Redis) per deployment multi-istanza. Default: memoria. /\n store?: ConsoleEntryStore;\n}\n\nimport type { AccessiSecurityHeadersSetting } from './security/securityHeaders';\nimport type { AccessiAuthCookieOptions } from './security/authCookies';\nimport type { AccessiMetricsOptions } from './observability/metrics';\nimport type { AccessiAuditOptions } from './security/audit';\n\n/* Impostazioni HTTP del servizio Accessi. /\nexport interface AccessiHttpOptions {\n /* Opzioni CORS Nest. `false` disabilita CORS. Default: exposedHeaders ['X-Total-Count']. /\n cors?: Parameters<INestApplication['enableCors']>[0] \| false;\n /* Trust proxy per IP reali dietro load balancer/reverse proxy. /\n trustProxy?: boolean \| number \| string;\n /* Header di sicurezza di base su console/OpenAPI. Default: true. /\n securityHeaders?: AccessiSecurityHeadersSetting;\n}\n\n/* Parametri SMTP usati esclusivamente per impostazione e reset della password. /\nexport interface EmailOptions {\n host: string;\n port: number;\n secure: boolean;\n requireTLS : boolean;\n tls: {\n rejectUnauthorized: boolean,\n }\n from: string;\n auth: {\n user: string;\n pass: string;\n };\n}\n\n/* Configura campi applicativi aggiuntivi restituiti insieme al profilo Accessi. /\nexport interface ExtensionFieldsOptions {\n /* Connessione al database contenente la tabella estesa. /\n databaseOptions: Options;\n /* Chiave con cui i dati saranno esposti nella risposta. /\n objectKey: string;\n /* Tabella applicativa contenente i dati estesi. /\n tableName: string;\n /* Colonne consentite; non valorizzarle mai con input HTTP. /\n tableFields: string[];\n /* Colonna correlata a `UTENTI.CODUTE`. /\n tableJoinFieldName: string;\n}\n\n/* Limite per una singola categoria di endpoint pubblici. /\nexport interface PublicAuthRateLimitRuleOptions {\n windowMs: number;\n maxAttempts: number;\n}\n\n/* Protezione degli endpoint pubblici. Default in memoria; in cluster usare uno store condiviso. /\nexport interface PublicAuthRateLimitOptions {\n enabled?: boolean;\n /* Store condiviso (es. Redis). Default: memoria del processo. /\n store?: RateLimitStore;\n login?: PublicAuthRateLimitRuleOptions;\n register?: PublicAuthRateLimitRuleOptions;\n passwordResetEmail?: PublicAuthRateLimitRuleOptions;\n passwordResetConfirm?: PublicAuthRateLimitRuleOptions;\n refresh?: PublicAuthRateLimitRuleOptions;\n getUserByToken?: PublicAuthRateLimitRuleOptions;\n twoFactorVerify?: PublicAuthRateLimitRuleOptions;\n twoFactorResend?: PublicAuthRateLimitRuleOptions;\n adminBootstrap?: PublicAuthRateLimitRuleOptions;\n consoleEntry?: PublicAuthRateLimitRuleOptions;\n}\n\n/\n Bootstrap del primo admin. Se abilitato, Accessi genera un token casuale a ogni avvio del\n * processo, lo stampa nel log e lo accetta sull'endpoint pubblico `POST /accessi/auth/bootstrap-admin`.\n * Serve a creare il primo utente admin senza email di conferma e senza un admin gia esistente.\n /\nexport interface AdminBootstrapOptions {\n /* Abilita il bootstrap admin. Default `false`. /\n enabled?: boolean;\n /* Crea l'utente come superutente oltre che admin. Default `true`. /\n superUser?: boolean;\n}\n\n/* Controls the legacy public username/password registration endpoint. Disabled by default. /\nexport interface PublicRegistrationOptions {\n /* Enables POST /accessi/user/register. Applications that used it before must opt in explicitly. /\n enabled?: boolean;\n}\n\n/* Configurazione dei token di servizio (macchina-a-macchina, senza utente). /\nexport interface ServiceTokenOptions {\n /* Abilita gli endpoint amministrativi dei service token. Default `true`. /\n enabled?: boolean;\n /* Durata predefinita in giorni quando non e indicata una scadenza esplicita. Default: nessuna scadenza. /\n defaultTtlDays?: number;\n /* Store condiviso per il rate limit dei service token. Default: memoria. /\n rateLimitStore?: RateLimitStore;\n}\n\n/* Cosa fare quando uno script gia applicato presenta un checksum diverso (file modificato). /\nexport type CatalogScriptChecksumPolicy = 'error' \| 'warn' \| 'reapply';\n\n/\n Catalog migrations applicative (menu, ruoli, tipi, cataloghi). Gli script `.sql` vivono nel\n * backend ospitante (versionati in repository) e vengono eseguiti da Accessi dopo la\n * riconciliazione dello schema. Ogni script e tracciato nella tabella `ACCESSI_CATALOG_SCRIPT`,\n * quindi viene applicato una sola volta per database (idempotenza lato DB).\n /\nexport interface SystemSeedsOptions {\n /* `false` disabilita il seed automatico, ad esempio per ambienti gestiti manualmente. /\n enabled?: boolean;\n}\n\nexport interface CatalogScriptsOptions {\n /* Abilita l'esecuzione automatica al bootstrap. Default `false`. /\n enabled?: boolean;\n /* Cartella contenente gli script `.sql` (assoluta o relativa alla working directory). /\n folder: string;\n /* Cosa fare se il checksum di uno script applicato e cambiato. Default `error`. /\n onChecksumMismatch?: CatalogScriptChecksumPolicy;\n /* Se `true` (default) un errore interrompe l'esecuzione e non avanza allo script successivo. /\n stopOnError?: boolean;\n /* Globi/estensioni inclusi. Default: tutti i `.sql`. /\n include?: string[];\n /* Numero massimo di script eseguiti in un singolo run (protezione operativa). Default: illimitato. /\n maxScriptsPerRun?: number;\n /\n Permette statement DDL/schema negli script. Default `false`: le catalog migrations possono\n * modificare solo righe. Sconsigliato: lo schema e di competenza di `db:update:accessi`.\n /\n allowDdl?: boolean;\n}\n\n/\n Enables Accessi's provider-agnostic federated identity capability.\n \n Accessi never validates Azure, Google, Apple, SAML, or other provider tokens.\n * The hosting backend must validate its own SSO flow and pass only a verified\n * `{ provider, subject }` identity to FederatedAuthService.\n /\nexport interface FederatedAuthenticationOptions {\n /* Attiva le API SSO generiche; con `false` il comportamento password storico rimane invariato. /\n enabled?: boolean;\n /* @deprecated Schema management is centralized in autoUpdateDatabase. This legacy flag no longer starts separate SSO migrations. /\n autoUpdateSchema?: boolean;\n /* Allows a backend to create a user from a verified external identity without a master user. Default false. /\n allowSelfRegistration?: boolean;\n}\n\n/\n Configurazione completa del modulo Accessi, fornita esclusivamente dal backend ospitante.\n * Segreti JWT, SMTP, database e le configurazioni tecniche dei provider SSO non devono mai raggiungere il browser.\n /\nexport interface AccessiOptions {\n /* Connessione Firebird alla base dati Accessi. /\n databaseOptions: Options;\n /\n Basepath del sito es: 'http://www.il-mio-sito.it/nome-progetto(se c'è)'\n /\n confirmationEmailUrl: string;\n /\n Percorso della pagina di reset personalizzata es. http://localhost:4200/#/admin/reset-password\n * N.B si sostituisce al confirmationMailURl\n /\n customResetPage?: string;\n /* URL di ritorno della pagina standard di reset dopo il completamento. /\n confirmationEmailReturnUrl: string;\n /* Prefisso applicativo facoltativo trasmesso alla pagina standard di reset. /\n confirmationEmailPrefix?: string;\n /* Chiave riservata alla compatibilita e alla migrazione delle password legacy cifrate. /\n encryptionKey: string;\n /* Abilita gli utenti fittizi `admin` e `demo` solo fuori produzione. /\n mockDemoUser: boolean;\n /* Attiva il controllo della scadenza password durante il login locale. /\n passwordExpiration?: boolean;\n /* Giorni di validita della password; quando assente Accessi usa 90 giorni. /\n passwordExpirationDays?: number;\n /* Esegue al bootstrap la conversione non distruttiva delle password legacy. Default `true`. /\n legacyPasswordMigrationOnStartup?: boolean;\n /* Riconcilia lo schema al bootstrap (default `true`). Con `false` verifica comunque la compatibilita in sola lettura e blocca avvii incompatibili. /\n autoUpdateDatabase?: boolean;\n /* Parametri JWT dei token emessi da Accessi. /\n jwtOptions: JwtOptions;\n /* Parametri SMTP per reset e attivazione password. /\n emailOptions: EmailOptions;\n publicAuthRateLimit?: PublicAuthRateLimitOptions;\n /* Public local registration is deliberately opt-in. Existing applications must set enabled: true to retain it. /\n publicRegistration?: PublicRegistrationOptions;\n /* Optional provider-agnostic SSO support. Provider-specific configuration remains in the hosting backend. /\n federatedAuthentication?: FederatedAuthenticationOptions;\n extensionFieldsOptions?: ExtensionFieldsOptions[];\n /* Token di servizio per chiamate tecniche macchina-a-macchina. Abilitati di default. /\n serviceTokens?: ServiceTokenOptions;\n /* Catalog migrations applicative eseguite dopo la riconciliazione dello schema. /\n catalogScripts?: CatalogScriptsOptions;\n /* Seed di sistema eseguiti dopo la riconciliazione dello schema. Default: abilitati. /\n systemSeeds?: SystemSeedsOptions;\n /* Bootstrap del primo admin tramite token casuale stampato a ogni avvio. /\n adminBootstrap?: AdminBootstrapOptions;\n /* Audit persistente: sink, retention ed endpoint amministrativi di query/export. /\n audit?: AccessiAuditOptions;\n /* Base URL pubblica usata solo per loggare gli indirizzi (console, OpenAPI, API). /\n publicBaseUrl?: string;\n /* Base URL API per la console quando UI e API sono su domini diversi. /\n consoleApiBaseUrl?: string;\n /\n Documentazione OpenAPI del modulo. Default invariati:\n * UI `accessi/openapi`, JSON `accessi/openapi.json`.\n /\n openapi?: OpenApiSetupOptions;\n /* Logger Nest usato dal sotto-app Accessi. Se assente Nest usa il proprio logger. /\n logger?: LoggerService;\n /* Buffer dei log di bootstrap del sotto-app. Default `true` (comportamento storico). /\n bufferLogs?: boolean;\n /* Ticket di ingresso console: TTL e store condiviso per deployment multi-istanza. /\n consoleEntry?: ConsoleEntryOptions;\n /* Limite grossolano per IP davanti alle rotte Accessi. Opzionale. /\n edgeRateLimit?: AccessiEdgeRateLimitOptions;\n /* CORS, trust proxy e header di sicurezza del servizio. /\n http?: AccessiHttpOptions;\n /\n Autenticazione opzionale via cookie httpOnly. Bearer resta il default:\n * la modalita si abilita passando questo oggetto (o `enabled: true`).\n /\n authCookie?: AccessiAuthCookieOptions;\n /* Metriche di dominio (login, 2FA, refresh, rate limit, store, ...). /\n metrics?: AccessiMetricsOptions;\n /* Revoca sessioni per utente tramite store memory/Redis. /\n sessionRevocation?: SessionRevocationOptions;\n /* Revoca dei singoli access token tramite `jti`, memory/Redis. /\n accessTokenRevocation?: AccessTokenRevocationOptions;\n /* Refresh token monouso tramite rotazione memory/Redis; rileva il riuso e revoca la famiglia. /\n refreshTokenRotation?: RefreshTokenRotationOptions;\n}\n\n@Global()\n@Module({\n controllers: [\n EmailController,\n AuthController,\n PermissionController,\n UserController,\n FiltriController,\n ConfiguratorController,\n FederatedAuthController,\n AccessiConsoleController,\n ConsoleEntryController,\n FederatedAuthExchangeController,\n ServiceTokenController,\n SchemaController,\n AccessiIntrospectionController,\n AccessiAuditController,\n ],\n providers: [AuthService, TwoFactorService, UserService, EmailService, PermissionService, FiltriService, ConfiguratorService, JwtSimpleGuard, AuthenticateGenService, AccessiDatabaseUpdater, FederatedAuthService, ServiceTokenService, ServiceTokenGuard, SchemaExportService, AdminBootstrapService, AccessiJwksBootstrapService],\n exports: [AuthService, UserService, EmailService, PermissionService, FiltriService, ConfiguratorService, JwtSimpleGuard, AuthenticateGenService, FederatedAuthService, ServiceTokenService, ServiceTokenGuard, SchemaExportService, AdminBootstrapService],\n})\nexport class AccessiModule {\n /\n Registra Accessi nel contenitore Nest del backend ospitante.\n \n Usare questo metodo una sola volta nella composizione dell'applicazione. Per un backend\n * Express esistente usare invece `initializeAccessiModule`, che crea e monta l'host Nest interno.\n * La configurazione viene registrata con il token DI `ACCESSI_OPTIONS` ed e condivisa dai servizi.\n */\n static forRoot(options: AccessiOptions): DynamicModule {\n // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.\n assertEmailConfigured(options);\n configureAccessiAudit(options.audit);\n return {\n module: AccessiModule,\n providers: [\n {\n provide: 'ACCESSI_OPTIONS',\n useValue: options,\n },\n AuthService,\n TwoFactorService,\n UserService,\n EmailService,\n PermissionService,\n FiltriService,\n ConfiguratorService,\n JwtSimpleGuard,\n AuthenticateGenService,\n AccessiDatabaseUpdater,\n FederatedAuthService,\n ServiceTokenService,\n ServiceTokenGuard, SchemaExportService, AdminBootstrapService, AccessiJwksBootstrapService],\n exports: [\n 'ACCESSI_OPTIONS',\n AuthService,\n UserService,\n EmailService,\n PermissionService,\n FiltriService,\n ConfiguratorService,\n JwtSimpleGuard,\n AuthenticateGenService,\n FederatedAuthService,\n ServiceTokenService,\n ServiceTokenGuard, SchemaExportService, AdminBootstrapService],\n };\n }\n}\n"]}

package/dist/accessi-module/Console/console.js CHANGED Viewed

@@ -1110,6 +1110,8 @@ var WIKI_SECTIONS = [
           ["edgeRateLimit", "AccessiEdgeRateLimitOptions", "no", "Limite grossolano per IP davanti alle rotte Accessi; opzionale, store condiviso supportato."],
           ["http", "{ cors, trustProxy, securityHeaders }", "no", "CORS, IP reali dietro proxy e header di sicurezza con CSP a nonce per la console e direttive configurabili."],
           ["authCookie", "{ enabled, secure, sameSite, csrf, ... }", "no", "Cookie HttpOnly e CSRF double-submit al posto del Bearer. Default disattivato."],
+          ["metrics", "{ enabled, sink, prefix }", "no", "Metriche Prometheus di dominio (login, 2FA, refresh, rate limit, store) e sink esterno opzionale."],
+          ["audit", "{ enabled, sinks, store, retentionDays, redact }", "no", "Audit persistente redatto, retention e query/export admin. Default: solo log strutturato."],
           ["publicRegistration", "{ enabled }", "no", "Registrazione pubblica: disattivata per impostazione predefinita."],
           ["federatedAuthentication", "FederatedAuthenticationOptions", "no", `Abilita l'SSO generico.`],
           ["extensionFieldsOptions", "ExtensionFieldsOptions[]", "no", "Tabelle esterne allegate al profilo."],

package/dist/accessi-module/Console/generated/emilsoftware-utilities.d.ts CHANGED Viewed

@@ -4,7 +4,7 @@
  * Accessi API
  * OpenAPI spec version: 1.0
  */
-import type { ActionResponse, AdminBootstrapStatusResponse, AssignPermissionsToUserRequest, AssignRolesToUserRequest, BootstrapAdminRequest, BootstrapAdminResponse, ConfirmResetPasswordRequest, ConsoleEntryExchangeRequest, ConsoleEntrySessionResponse, ConsoleEntryTicketResponse, CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, CreateFilterTypeRequest, CreateMenuGroupRequest, CreateMenuRequest, CreateMenuTypeRequest, CreateScopeRequest, CreateServiceTokenRequest, CreateServiceTokenResponse, ErrorResponse, ExchangeFederatedIdentityRequest, FederatedExchangeResponse, FederatedIdentityListResponse, FederatedIdentityResponse, FederatedProviderListResponse, FederatedProviderResponse, FiltriUtente, GetFiltriResponse, GetFiltriUtenteParams, GetFiltriUtenteResponse, GetGroupsWithMenusParams, GetGroupsWithMenusResponse, GetMenuScopesResponse, GetMenuTypesResponse, GetMenusParams, GetMenusResponse, GetRolesResponse, GetSchemaResponse, GetScopesResponse, GetServiceTokensParams, GetServiceTokensResponse, GetUserByTokenRequest, GetUserByTokenResponse, GetUserRolesAndGrantsParams, GetUsersParams, GetUsersResponse, IntrospectAccessiTokenRequest, IntrospectAccessiTokenResponse, LoginAsRequest, LoginAsResponse, LoginRequest, LoginResponse, PublicRegisterRequest, RefreshTokenRequest, RefreshTokenResponse, RegisterRequest, RegisterResponse, ResendTwoFactorRequest, RevokeTokenRequest, Role, SendResetPasswordEmailRequest, ServeResetPasswordPageParams, SetMenuScopesRequest, SetPasswordLoginPolicyRequest, SetScopeMenusRequest, SetStatoRegistrazioneDto, SetUserPasswordRequest, UpdateEnabledStatusRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest, UpdateFilterTypeRequest, UpdateMenuGroupRequest, UpdateMenuRequest, UpdateMenuTypeRequest, UpdateScopeRequest, UserDto, UserGrantsResponse, VerifyTwoFactorRequest } from './model';
+import type { ActionResponse, AdminBootstrapStatusResponse, AssignPermissionsToUserRequest, AssignRolesToUserRequest, BootstrapAdminRequest, BootstrapAdminResponse, ConfirmResetPasswordRequest, ConsoleEntryExchangeRequest, ConsoleEntrySessionResponse, ConsoleEntryTicketResponse, CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, CreateFilterTypeRequest, CreateMenuGroupRequest, CreateMenuRequest, CreateMenuTypeRequest, CreateScopeRequest, CreateServiceTokenRequest, CreateServiceTokenResponse, ErrorResponse, ExchangeFederatedIdentityRequest, ExportAuditParams, FederatedExchangeResponse, FederatedIdentityListResponse, FederatedIdentityResponse, FederatedProviderListResponse, FederatedProviderResponse, FiltriUtente, GetFiltriResponse, GetFiltriUtenteParams, GetFiltriUtenteResponse, GetGroupsWithMenusParams, GetGroupsWithMenusResponse, GetMenuScopesResponse, GetMenuTypesResponse, GetMenusParams, GetMenusResponse, GetRolesResponse, GetSchemaResponse, GetScopesResponse, GetServiceTokensParams, GetServiceTokensResponse, GetUserByTokenRequest, GetUserByTokenResponse, GetUserRolesAndGrantsParams, GetUsersParams, GetUsersResponse, IntrospectAccessiTokenRequest, IntrospectAccessiTokenResponse, LoginAsRequest, LoginAsResponse, LoginRequest, LoginResponse, PublicRegisterRequest, QueryAuditParams, RefreshTokenRequest, RefreshTokenResponse, RegisterRequest, RegisterResponse, ResendTwoFactorRequest, RevokeTokenRequest, Role, SendResetPasswordEmailRequest, ServeResetPasswordPageParams, SetMenuScopesRequest, SetPasswordLoginPolicyRequest, SetScopeMenusRequest, SetStatoRegistrazioneDto, SetUserPasswordRequest, UpdateEnabledStatusRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest, UpdateFilterTypeRequest, UpdateMenuGroupRequest, UpdateMenuRequest, UpdateMenuTypeRequest, UpdateScopeRequest, UserDto, UserGrantsResponse, VerifyTwoFactorRequest } from './model';
 /**
  * @summary Serve una pagina per il reset della password
  */
@@ -759,3 +759,23 @@ export type introspectAccessiTokenResponse = {
 };
 export declare const getIntrospectAccessiTokenUrl: () => string;
 export declare const introspectAccessiToken: (introspectAccessiTokenRequest: IntrospectAccessiTokenRequest, options?: RequestInit) => Promise<introspectAccessiTokenResponse>;
+/**
+ * Richiede audit.store o un sink interrogabile. Supporta filtro per evento, intervallo, utente e paginazione.
+ * @summary Elenca gli eventi di audit persistiti
+ */
+export type queryAuditResponse = {
+    data: void;
+    status: number;
+};
+export declare const getQueryAuditUrl: (params?: QueryAuditParams) => string;
+export declare const queryAudit: (params?: QueryAuditParams, options?: RequestInit) => Promise<queryAuditResponse>;
+/**
+ * Stessi filtri della query, senza paginazione. Il file contiene record gia redatti; limite di sicurezza 100000 record.
+ * @summary Esporta gli eventi di audit in NDJSON
+ */
+export type exportAuditResponse = {
+    data: void;
+    status: number;
+};
+export declare const getExportAuditUrl: (params?: ExportAuditParams) => string;
+export declare const exportAudit: (params?: ExportAuditParams, options?: RequestInit) => Promise<exportAuditResponse>;

package/dist/accessi-module/Console/generated/emilsoftware-utilities.js CHANGED Viewed

@@ -12,7 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.deleteMenu = exports.getDeleteMenuUrl = exports.updateMenu = exports.getUpdateMenuUrl = exports.createMenuType = exports.getCreateMenuTypeUrl = exports.getMenuTypes = exports.getGetMenuTypesUrl = exports.getGroupsWithMenus = exports.getGetGroupsWithMenusUrl = exports.createMenu = exports.getCreateMenuUrl = exports.getMenus = exports.getGetMenusUrl = exports.deleteRole = exports.getDeleteRoleUrl = exports.assignPermissionsToUser = exports.getAssignPermissionsToUserUrl = exports.assignRolesToUser = exports.getAssignRolesToUserUrl = exports.createRole = exports.getCreateRoleUrl = exports.updateRole = exports.getUpdateRoleUrl = exports.getRoles = exports.getGetRolesUrl = exports.getAdminBootstrapStatus = exports.getGetAdminBootstrapStatusUrl = exports.bootstrapAdmin = exports.getBootstrapAdminUrl = exports.resendTwoFactor = exports.getResendTwoFactorUrl = exports.verifyTwoFactor = exports.getVerifyTwoFactorUrl = exports.refreshAccessToken = exports.getRefreshAccessTokenUrl = exports.login = exports.getLoginUrl = exports.revokeToken = exports.getRevokeTokenUrl = exports.revokeSessions = exports.getRevokeSessionsUrl = exports.getUserByToken = exports.getGetUserByTokenUrl = exports.resetPassword = exports.getResetPasswordUrl = exports.sendPasswordResetEmail = exports.getSendPasswordResetEmailUrl = exports.serveResetPasswordPage = exports.getServeResetPasswordPageUrl = void 0;
 exports.updateUtente = exports.getUpdateUtenteUrl = exports.createManagedUser = exports.getCreateManagedUserUrl = exports.register = exports.getRegisterUrl = exports.setStatoRegistrazione = exports.getSetStatoRegistrazioneUrl = exports.setUserPassword = exports.getSetUserPasswordUrl = exports.createLoginAsUrl = exports.getCreateLoginAsUrlUrl = exports.forcePasswordResetLegacy = exports.getForcePasswordResetLegacyUrl = exports.forcePasswordReset = exports.getForcePasswordResetUrl = exports.deleteUserPermanently = exports.getDeleteUserPermanentlyUrl = exports.deleteUser = exports.getDeleteUserUrl = exports.getUsers = exports.getGetUsersUrl = exports.serveResetPasswordPageUser = exports.getServeResetPasswordPageUserUrl = exports.setScopeMenus = exports.getSetScopeMenusUrl = exports.setMenuScopes = exports.getSetMenuScopesUrl = exports.getMenuScopes = exports.getGetMenuScopesUrl = exports.deleteScope = exports.getDeleteScopeUrl = exports.updateScope = exports.getUpdateScopeUrl = exports.createScope = exports.getCreateScopeUrl = exports.getScopes = exports.getGetScopesUrl = exports.getUserRolesAndGrants = exports.getGetUserRolesAndGrantsUrl = exports.deleteMenuType = exports.getDeleteMenuTypeUrl = exports.updateMenuType = exports.getUpdateMenuTypeUrl = exports.deleteMenuGroup = exports.getDeleteMenuGroupUrl = exports.updateMenuGroup = exports.getUpdateMenuGroupUrl = exports.createMenuGroup = exports.getCreateMenuGroupUrl = void 0;
 exports.getServiceTokens = exports.getGetServiceTokensUrl = exports.createServiceToken = exports.getCreateServiceTokenUrl = exports.exchangeFederatedIdentity = exports.getExchangeFederatedIdentityUrl = exports.exchangeConsoleEntryTicket = exports.getExchangeConsoleEntryTicketUrl = exports.createConsoleEntryTicket = exports.getCreateConsoleEntryTicketUrl = exports.deleteFederatedIdentityPermanently = exports.getDeleteFederatedIdentityPermanentlyUrl = exports.updateFederatedIdentity = exports.getUpdateFederatedIdentityUrl = exports.disableFederatedIdentity = exports.getDisableFederatedIdentityUrl = exports.setPasswordLoginPolicy = exports.getSetPasswordLoginPolicyUrl = exports.createFederatedUser = exports.getCreateFederatedUserUrl = exports.linkFederatedIdentity = exports.getLinkFederatedIdentityUrl = exports.getFederatedIdentities = exports.getGetFederatedIdentitiesUrl = exports.deleteFederatedProvider = exports.getDeleteFederatedProviderUrl = exports.updateFederatedProvider = exports.getUpdateFederatedProviderUrl = exports.createFederatedProvider = exports.getCreateFederatedProviderUrl = exports.getFederatedProviders = exports.getGetFederatedProvidersUrl = exports.setGroupEnabled = exports.getSetGroupEnabledUrl = exports.setMenuEnabled = exports.getSetMenuEnabledUrl = exports.saveFiltriUtente = exports.getSaveFiltriUtenteUrl = exports.getFiltriUtente = exports.getGetFiltriUtenteUrl = exports.deleteTipoFiltro = exports.getDeleteTipoFiltroUrl = exports.updateTipoFiltro = exports.getUpdateTipoFiltroUrl = exports.createTipoFiltro = exports.getCreateTipoFiltroUrl = exports.getTipiFiltro = exports.getGetTipiFiltroUrl = exports.setGdpr = exports.getSetGdprUrl = void 0;
-exports.introspectAccessiToken = exports.getIntrospectAccessiTokenUrl = exports.getSchema = exports.getGetSchemaUrl = exports.rotateServiceToken = exports.getRotateServiceTokenUrl = exports.revokeServiceToken = exports.getRevokeServiceTokenUrl = void 0;
+exports.exportAudit = exports.getExportAuditUrl = exports.queryAudit = exports.getQueryAuditUrl = exports.introspectAccessiToken = exports.getIntrospectAccessiTokenUrl = exports.getSchema = exports.getGetSchemaUrl = exports.rotateServiceToken = exports.getRotateServiceTokenUrl = exports.revokeServiceToken = exports.getRevokeServiceTokenUrl = void 0;
 const accessiFetch_1 = require("../accessiFetch");
 const getServeResetPasswordPageUrl = (token, params) => {
     const normalizedParams = new URLSearchParams();
@@ -709,4 +709,38 @@ const introspectAccessiToken = (introspectAccessiTokenRequest, options) => __awa
     return (0, accessiFetch_1.accessiFetch)((0, exports.getIntrospectAccessiTokenUrl)(), Object.assign(Object.assign({}, options), { method: 'POST', body: JSON.stringify(introspectAccessiTokenRequest) }));
 });
 exports.introspectAccessiToken = introspectAccessiToken;
+const getQueryAuditUrl = (params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+        }
+        else if (value !== undefined) {
+            normalizedParams.append(key, value.toString());
+        }
+    });
+    return `/api/accessi/audit?${normalizedParams.toString()}`;
+};
+exports.getQueryAuditUrl = getQueryAuditUrl;
+const queryAudit = (params, options) => __awaiter(void 0, void 0, void 0, function* () {
+    return (0, accessiFetch_1.accessiFetch)((0, exports.getQueryAuditUrl)(params), Object.assign(Object.assign({}, options), { method: 'GET' }));
+});
+exports.queryAudit = queryAudit;
+const getExportAuditUrl = (params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+        }
+        else if (value !== undefined) {
+            normalizedParams.append(key, value.toString());
+        }
+    });
+    return `/api/accessi/audit/export?${normalizedParams.toString()}`;
+};
+exports.getExportAuditUrl = getExportAuditUrl;
+const exportAudit = (params, options) => __awaiter(void 0, void 0, void 0, function* () {
+    return (0, accessiFetch_1.accessiFetch)((0, exports.getExportAuditUrl)(params), Object.assign(Object.assign({}, options), { method: 'GET' }));
+});
+exports.exportAudit = exportAudit;
 //# sourceMappingURL=emilsoftware-utilities.js.map