emilsoftware-utilities 2.0.0-dev.77 → 2.0.0-dev.79

package/dist/accessi-module/Controllers/AccessiAuditController.js

@@ -0,0 +1,155 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var AccessiAuditController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiAuditController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const Utilities_1 = require("../../Utilities");
+const Dtos_1 = require("../Dtos");
+const jwt_strategy_1 = require("../jwt/jwt.strategy");
+const accessControl_1 = require("../security/accessControl");
+const audit_1 = require("../security/audit");
+/** Dimensione massima della pagina usata dall'export NDJSON. */
+const EXPORT_PAGE_SIZE = 1000;
+/** Limite di sicurezza per un singolo export. */
+const EXPORT_MAX_RECORDS = 100000;
+/**
+ * Consultazione ed export dell'audit persistente.
+ *
+ * Richiede un utente super/admin Accessi. Se non e configurato uno store
+ * interrogabile (`audit.store` o un sink con `query`), risponde 501 con un
+ * codice stabile: l'host puo continuare a usare il solo log strutturato.
+ */
+let AccessiAuditController = AccessiAuditController_1 = class AccessiAuditController {
+    store() {
+        const store = (0, audit_1.getAccessiAuditStore)();
+        if (!store) {
+            throw new common_1.HttpException({
+                code: 'ACCESSI_AUDIT_STORE_DISABLED',
+                message: 'Audit persistente non configurato su questa istanza.',
+            }, common_1.HttpStatus.NOT_IMPLEMENTED);
+        }
+        return store;
+    }
+    static toQuery(request) {
+        var _a;
+        return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (((_a = request.event) === null || _a === void 0 ? void 0 : _a.trim()) ? { event: request.event.trim() } : {})), (request.from ? { from: request.from } : {})), (request.to ? { to: request.to } : {})), (request.codiceUtente !== undefined ? { codiceUtente: request.codiceUtente } : {})), (request.limit !== undefined ? { limit: request.limit } : {})), (request.offset !== undefined ? { offset: request.offset } : {})), (request.order ? { order: request.order } : {}));
+    }
+    authorize(request) {
+        const user = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+        (0, accessControl_1.ensureConsoleAccess)(user, 'La consultazione audit richiede un superutente o un admin Accessi.');
+    }
+    query(request, query, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                this.authorize(request);
+                const page = yield this.store().query(AccessiAuditController_1.toQuery(query));
+                return Utilities_1.RestUtilities.sendBaseResponse(res, page);
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AccessiAuditController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.INTERNAL_SERVER_ERROR);
+            }
+        });
+    }
+    export(request, query, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                this.authorize(request);
+                const store = this.store();
+                const filter = AccessiAuditController_1.toQuery(Object.assign(Object.assign({}, query), { limit: undefined, offset: undefined }));
+                const date = new Date().toISOString().slice(0, 10);
+                res.setHeader('Content-Type', 'application/x-ndjson; charset=utf-8');
+                res.setHeader('Cache-Control', 'no-store, max-age=0');
+                res.setHeader('Content-Disposition', `attachment; filename="accessi-audit-${date}.ndjson"`);
+                let offset = 0;
+                let written = 0;
+                for (;;) {
+                    const remaining = EXPORT_MAX_RECORDS - written;
+                    if (remaining <= 0)
+                        break;
+                    const page = yield store.query(Object.assign(Object.assign({}, filter), { limit: Math.min(EXPORT_PAGE_SIZE, remaining), offset }));
+                    for (const record of page.records) {
+                        res.write(`${JSON.stringify(record)}\n`);
+                        written += 1;
+                    }
+                    offset += page.records.length;
+                    if (page.records.length === 0 || offset >= page.total)
+                        break;
+                }
+                res.end();
+                return res;
+            }
+            catch (error) {
+                if (res.headersSent) {
+                    // L'export e gia iniziato: chiudere in modo esplicito invece di inviare JSON sopra l'NDJSON.
+                    res.end();
+                    return res;
+                }
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AccessiAuditController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.INTERNAL_SERVER_ERROR);
+            }
+        });
+    }
+};
+exports.AccessiAuditController = AccessiAuditController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, swagger_1.ApiOperation)({
+        operationId: 'queryAudit',
+        summary: 'Elenca gli eventi di audit persistiti',
+        description: 'Richiede audit.store o un sink interrogabile. Supporta filtro per evento, intervallo, utente e paginazione.',
+    }),
+    (0, swagger_1.ApiOkResponse)({ description: 'Pagina di record di audit redatti.' }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse, description: 'Token Accessi mancante o non valido.' }),
+    (0, swagger_1.ApiResponse)({ status: 403, type: Dtos_1.ErrorResponse, description: 'Utente non abilitato alla console.' }),
+    (0, swagger_1.ApiResponse)({ status: 501, type: Dtos_1.ErrorResponse, description: 'Audit persistente non configurato.' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Query)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Dtos_1.AuditQueryRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AccessiAuditController.prototype, "query", null);
+__decorate([
+    (0, common_1.Get)('export'),
+    (0, swagger_1.ApiOperation)({
+        operationId: 'exportAudit',
+        summary: 'Esporta gli eventi di audit in NDJSON',
+        description: 'Stessi filtri della query, senza paginazione. Il file contiene record gia redatti; limite di sicurezza 100000 record.',
+    }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'NDJSON scaricabile.' }),
+    (0, swagger_1.ApiResponse)({ status: 501, type: Dtos_1.ErrorResponse, description: 'Audit persistente non configurato.' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Query)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Dtos_1.AuditQueryRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AccessiAuditController.prototype, "export", null);
+exports.AccessiAuditController = AccessiAuditController = AccessiAuditController_1 = __decorate([
+    (0, swagger_1.ApiTags)('Audit'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('accessi/audit'),
+    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard)
+], AccessiAuditController);
+//# sourceMappingURL=AccessiAuditController.js.map

package/dist/accessi-module/Controllers/AccessiAuditController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessiAuditController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AccessiAuditController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAMyB;AAEzB,+CAAgD;AAChD,kCAA2D;AAC3D,sDAAqD;AACrD,6DAA6F;AAC7F,6CAAyD;AAGzD,gEAAgE;AAChE,MAAM,gBAAgB,GAAG,IAAK,CAAC;AAC/B,iDAAiD;AACjD,MAAM,kBAAkB,GAAG,MAAO,CAAC;AAEnC;;;;;;GAMG;AAKI,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACzB,KAAK;QACX,MAAM,KAAK,GAAG,IAAA,4BAAoB,GAAE,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,sBAAa,CACrB;gBACE,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,sDAAsD;aAChE,EACD,mBAAU,CAAC,eAAe,CAC3B,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,OAAO,CAAC,OAA0B;;QAC/C,6GACK,CAAC,CAAA,MAAA,OAAO,CAAC,KAAK,0CAAE,IAAI,EAAE,EAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC9D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC5C,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACtC,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClF,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC7D,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAClD;IACJ,CAAC;IAEO,SAAS,CAAC,OAAgB;QAChC,MAAM,IAAI,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;QAClD,IAAA,mCAAmB,EAAC,IAAI,EAAE,oEAAoE,CAAC,CAAC;IAClG,CAAC;IAaK,KAAK,CACF,OAAgB,EACd,KAAwB,EAC1B,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,wBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAWK,MAAM,CACH,OAAgB,EACd,KAAwB,EAC1B,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,wBAAsB,CAAC,OAAO,iCAAM,KAAK,KAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,IAAG,CAAC;gBACjG,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;gBACrE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;gBACtD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,uCAAuC,IAAI,UAAU,CAAC,CAAC;gBAE5F,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,SAAS,CAAC;oBACR,MAAM,SAAS,GAAG,kBAAkB,GAAG,OAAO,CAAC;oBAC/C,IAAI,SAAS,IAAI,CAAC;wBAAE,MAAM;oBAC1B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,iCACzB,MAAM,KACT,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,EAC5C,MAAM,IACN,CAAC;oBACH,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;wBAClC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;wBACzC,OAAO,IAAI,CAAC,CAAC;oBACf,CAAC;oBACD,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,KAAK;wBAAE,MAAM;gBAC/D,CAAC;gBACD,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,6FAA6F;oBAC7F,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO,GAAG,CAAC;gBACb,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,wBAAsB,CAAC,IAAI,EAC3B,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAtHY,wDAAsB;AA2C3B;IAXL,IAAA,YAAG,GAAE;IACL,IAAA,sBAAY,EAAC;QACZ,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,6GAA6G;KAChH,CAAC;IACD,IAAA,uBAAa,EAAC,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IACpE,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IACpG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAElG,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADU,wBAAiB;;mDAelC;AAWK;IATL,IAAA,YAAG,EAAC,QAAQ,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,WAAW,EAAE,aAAa;QAC1B,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,uHAAuH;KAC1H,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IAChE,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAElG,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADU,wBAAiB;;oDA4ClC;iCArHU,sBAAsB;IAJlC,IAAA,iBAAO,EAAC,OAAO,CAAC;IAChB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,eAAe,CAAC;IAC3B,IAAA,kBAAS,EAAC,6BAAc,CAAC;GACb,sBAAsB,CAsHlC","sourcesContent":["import {\n  Controller,\n  Get,\n  HttpException,\n  HttpStatus,\n  Query,\n  Req,\n  Res,\n  UseGuards,\n} from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport { AuditQueryRequest, ErrorResponse } from '../Dtos';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureConsoleAccess, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { getAccessiAuditStore } from '../security/audit';\nimport type { AccessiAuditQuery, AccessiAuditQueryableSink } from '../security/audit';\n\n/** Dimensione massima della pagina usata dall'export NDJSON. */\nconst EXPORT_PAGE_SIZE = 1_000;\n/** Limite di sicurezza per un singolo export. */\nconst EXPORT_MAX_RECORDS = 100_000;\n\n/**\n * Consultazione ed export dell'audit persistente.\n *\n * Richiede un utente super/admin Accessi. Se non e configurato uno store\n * interrogabile (`audit.store` o un sink con `query`), risponde 501 con un\n * codice stabile: l'host puo continuare a usare il solo log strutturato.\n */\n@ApiTags('Audit')\n@ApiBearerAuth()\n@Controller('accessi/audit')\n@UseGuards(JwtSimpleGuard)\nexport class AccessiAuditController {\n  private store(): AccessiAuditQueryableSink {\n    const store = getAccessiAuditStore();\n    if (!store) {\n      throw new HttpException(\n        {\n          code: 'ACCESSI_AUDIT_STORE_DISABLED',\n          message: 'Audit persistente non configurato su questa istanza.',\n        },\n        HttpStatus.NOT_IMPLEMENTED,\n      );\n    }\n    return store;\n  }\n\n  private static toQuery(request: AuditQueryRequest): AccessiAuditQuery {\n    return {\n      ...(request.event?.trim() ? { event: request.event.trim() } : {}),\n      ...(request.from ? { from: request.from } : {}),\n      ...(request.to ? { to: request.to } : {}),\n      ...(request.codiceUtente !== undefined ? { codiceUtente: request.codiceUtente } : {}),\n      ...(request.limit !== undefined ? { limit: request.limit } : {}),\n      ...(request.offset !== undefined ? { offset: request.offset } : {}),\n      ...(request.order ? { order: request.order } : {}),\n    };\n  }\n\n  private authorize(request: Request): void {\n    const user = getAuthenticatedAccessiUser(request);\n    ensureConsoleAccess(user, 'La consultazione audit richiede un superutente o un admin Accessi.');\n  }\n\n  @Get()\n  @ApiOperation({\n    operationId: 'queryAudit',\n    summary: 'Elenca gli eventi di audit persistiti',\n    description:\n      'Richiede audit.store o un sink interrogabile. Supporta filtro per evento, intervallo, utente e paginazione.',\n  })\n  @ApiOkResponse({ description: 'Pagina di record di audit redatti.' })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Token Accessi mancante o non valido.' })\n  @ApiResponse({ status: 403, type: ErrorResponse, description: 'Utente non abilitato alla console.' })\n  @ApiResponse({ status: 501, type: ErrorResponse, description: 'Audit persistente non configurato.' })\n  async query(\n    @Req() request: Request,\n    @Query() query: AuditQueryRequest,\n    @Res() res: Response,\n  ): Promise<Response> {\n    try {\n      this.authorize(request);\n      const page = await this.store().query(AccessiAuditController.toQuery(query));\n      return RestUtilities.sendBaseResponse(res, page);\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        AccessiAuditController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.INTERNAL_SERVER_ERROR,\n      );\n    }\n  }\n\n  @Get('export')\n  @ApiOperation({\n    operationId: 'exportAudit',\n    summary: 'Esporta gli eventi di audit in NDJSON',\n    description:\n      'Stessi filtri della query, senza paginazione. Il file contiene record gia redatti; limite di sicurezza 100000 record.',\n  })\n  @ApiResponse({ status: 200, description: 'NDJSON scaricabile.' })\n  @ApiResponse({ status: 501, type: ErrorResponse, description: 'Audit persistente non configurato.' })\n  async export(\n    @Req() request: Request,\n    @Query() query: AuditQueryRequest,\n    @Res() res: Response,\n  ): Promise<Response | void> {\n    try {\n      this.authorize(request);\n      const store = this.store();\n      const filter = AccessiAuditController.toQuery({ ...query, limit: undefined, offset: undefined });\n      const date = new Date().toISOString().slice(0, 10);\n      res.setHeader('Content-Type', 'application/x-ndjson; charset=utf-8');\n      res.setHeader('Cache-Control', 'no-store, max-age=0');\n      res.setHeader('Content-Disposition', `attachment; filename=\"accessi-audit-${date}.ndjson\"`);\n\n      let offset = 0;\n      let written = 0;\n      for (;;) {\n        const remaining = EXPORT_MAX_RECORDS - written;\n        if (remaining <= 0) break;\n        const page = await store.query({\n          ...filter,\n          limit: Math.min(EXPORT_PAGE_SIZE, remaining),\n          offset,\n        });\n        for (const record of page.records) {\n          res.write(`${JSON.stringify(record)}\\n`);\n          written += 1;\n        }\n        offset += page.records.length;\n        if (page.records.length === 0 || offset >= page.total) break;\n      }\n      res.end();\n      return res;\n    } catch (error) {\n      if (res.headersSent) {\n        // L'export e gia iniziato: chiudere in modo esplicito invece di inviare JSON sopra l'NDJSON.\n        res.end();\n        return res;\n      }\n      return RestUtilities.sendErrorMessage(\n        res,\n        error,\n        AccessiAuditController.name,\n        error instanceof HttpException ? error.getStatus() : HttpStatus.INTERNAL_SERVER_ERROR,\n      );\n    }\n  }\n}\n"]}

package/dist/accessi-module/Controllers/AccessiIntrospectionController.js

@@ -30,6 +30,7 @@ const Dtos_1 = require("../Dtos");
 const PermissionService_1 = require("../Services/PermissionService/PermissionService");
 const AuthService_1 = require("../Services/AuthService/AuthService");
 const serviceTokenGuard_1 = require("../security/serviceTokenGuard");
+const metrics_1 = require("../observability/metrics");
 /**
  * Endpoint service-to-service per validare un access token Accessi.
  *
@@ -45,21 +46,29 @@ let AccessiIntrospectionController = AccessiIntrospectionController_1 = class Ac
     introspect(body, res) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
+            const startedAt = Date.now();
             try {
                 if (!(body === null || body === void 0 ? void 0 : body.token)) {
+                    (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'bad_request' });
                     return Utilities_1.RestUtilities.sendErrorMessage(res, 'Token non fornito.', AccessiIntrospectionController_1.name, common_1.HttpStatus.BAD_REQUEST);
                 }
                 const introspection = yield this.authService.introspectAccessToken(body.token);
                 if (!introspection.active || !introspection.codiceUtente) {
+                    (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'inactive' });
                     return Utilities_1.RestUtilities.sendBaseResponse(res, { active: false });
                 }
                 const user = (_a = introspection.payload) === null || _a === void 0 ? void 0 : _a.utente;
                 const grants = yield this.permissionService.getUserRolesAndGrants(introspection.codiceUtente);
+                (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'active' });
                 return Utilities_1.RestUtilities.sendBaseResponse(res, Object.assign(Object.assign({ active: true }, (user ? { user } : {})), { grants }));
             }
             catch (error) {
+                (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'error' });
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, AccessiIntrospectionController_1.name);
             }
+            finally {
+                (0, metrics_1.recordAccessiDuration)('accessi_introspection_duration_ms', Date.now() - startedAt);
+            }
         });
     }
 };

package/dist/accessi-module/Controllers/AccessiIntrospectionController.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessiIntrospectionController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AccessiIntrospectionController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoF;AACpF,6CAOyB;AAEzB,+CAAgD;AAChD,kCAIiB;AACjB,uFAAoF;AACpF,qEAAkE;AAClE,qEAA6F;AAE7F;;;;;;GAMG;AAKI,IAAM,8BAA8B,sCAApC,MAAM,8BAA8B;IACzC,YACmB,WAAwB,EACxB,iBAAoC;QADpC,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAcE,UAAU,CACN,IAAmC,EACpC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,EAAE,CAAC;oBACjB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,oBAAoB,EACpB,gCAA8B,CAAC,IAAI,EACnC,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/E,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;oBACzD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,GAAG,MAAC,aAAa,CAAC,OAA4C,0CAAE,MAAM,CAAC;gBACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC9F,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,gCACvC,MAAM,EAAE,IAAI,IACT,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACzB,MAAM,IACN,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gCAA8B,CAAC,IAAI,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAhDY,wEAA8B;AAkBnC;IAZL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,6CAAyB,EAAC,oBAAoB,CAAC;IAC/C,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,wBAAwB;QACrC,WAAW,EACT,0IAA0I;KAC7I,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,oCAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,qCAA8B,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,mBAAU,CAAC,YAAY,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC1H,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAEnH,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADQ,oCAA6B;;gEA4B5C;yCA/CU,8BAA8B;IAJ1C,IAAA,iBAAO,EAAC,cAAc,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC1B,IAAA,kBAAS,EAAC,qCAAiB,CAAC;qCAGK,yBAAW;QACL,qCAAiB;GAH5C,8BAA8B,CAgD1C","sourcesContent":["import { Body, Controller, HttpStatus, Post, Res, UseGuards } from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport {\n  ErrorResponse,\n  IntrospectAccessiTokenRequest,\n  IntrospectAccessiTokenResponse,\n} from '../Dtos';\nimport { PermissionService } from '../Services/PermissionService/PermissionService';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { RequireServiceTokenScopes, ServiceTokenGuard } from '../security/serviceTokenGuard';\n\n/**\n * Endpoint service-to-service per validare un access token Accessi.\n *\n * Non e pensato per il browser: richiede un service token con scope\n * `accessi:introspect`. I backend fratelli lo usano per autorizzare richieste\n * senza accedere al database Accessi.\n */\n@ApiTags('ServiceToken')\n@ApiBearerAuth()\n@Controller('accessi/auth')\n@UseGuards(ServiceTokenGuard)\nexport class AccessiIntrospectionController {\n  constructor(\n    private readonly authService: AuthService,\n    private readonly permissionService: PermissionService,\n  ) {}\n\n  @Post('introspect')\n  @RequireServiceTokenScopes('accessi:introspect')\n  @ApiOperation({\n    summary: 'Verifica un access token Accessi',\n    operationId: 'introspectAccessiToken',\n    description:\n      'Restituisce active=false per token invalido, scaduto o utente non piu abilitato. Richiede un service token con scope accessi:introspect.',\n  })\n  @ApiBody({ type: IntrospectAccessiTokenRequest })\n  @ApiOkResponse({ description: 'Esito della verifica token.', type: IntrospectAccessiTokenResponse })\n  @ApiResponse({ status: HttpStatus.UNAUTHORIZED, description: 'Service token mancante o non valido.', type: ErrorResponse })\n  @ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Scope accessi:introspect mancante.', type: ErrorResponse })\n  async introspect(\n    @Body() body: IntrospectAccessiTokenRequest,\n    @Res() res: Response,\n  ): Promise<Response> {\n    try {\n      if (!body?.token) {\n        return RestUtilities.sendErrorMessage(\n          res,\n          'Token non fornito.',\n          AccessiIntrospectionController.name,\n          HttpStatus.BAD_REQUEST,\n        );\n      }\n\n      const introspection = await this.authService.introspectAccessToken(body.token);\n      if (!introspection.active || !introspection.codiceUtente) {\n        return RestUtilities.sendBaseResponse(res, { active: false });\n      }\n\n      const user = (introspection.payload as { utente?: unknown } | undefined)?.utente;\n      const grants = await this.permissionService.getUserRolesAndGrants(introspection.codiceUtente);\n      return RestUtilities.sendBaseResponse(res, {\n        active: true,\n        ...(user ? { user } : {}),\n        grants,\n      });\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AccessiIntrospectionController.name);\n    }\n  }\n}\n"]}
+{"version":3,"file":"AccessiIntrospectionController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AccessiIntrospectionController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoF;AACpF,6CAOyB;AAEzB,+CAAgD;AAChD,kCAIiB;AACjB,uFAAoF;AACpF,qEAAkE;AAClE,qEAA6F;AAC7F,sDAAsF;AAEtF;;;;;;GAMG;AAKI,IAAM,8BAA8B,sCAApC,MAAM,8BAA8B;IACzC,YACmB,WAAwB,EACxB,iBAAoC;QADpC,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAcE,UAAU,CACN,IAAmC,EACpC,GAAa;;;YAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,EAAE,CAAC;oBACjB,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;oBACjF,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,oBAAoB,EACpB,gCAA8B,CAAC,IAAI,EACnC,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/E,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;oBACzD,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,GAAG,MAAC,aAAa,CAAC,OAA4C,0CAAE,MAAM,CAAC;gBACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC9F,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,gCACvC,MAAM,EAAE,IAAI,IACT,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACzB,MAAM,IACN,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC3E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gCAA8B,CAAC,IAAI,CAAC,CAAC;YACzF,CAAC;oBAAS,CAAC;gBACT,IAAA,+BAAqB,EAAC,mCAAmC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAvDY,wEAA8B;AAkBnC;IAZL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,6CAAyB,EAAC,oBAAoB,CAAC;IAC/C,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,wBAAwB;QACrC,WAAW,EACT,0IAA0I;KAC7I,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,oCAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,qCAA8B,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,mBAAU,CAAC,YAAY,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC1H,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAEnH,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADQ,oCAA6B;;gEAmC5C;yCAtDU,8BAA8B;IAJ1C,IAAA,iBAAO,EAAC,cAAc,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC1B,IAAA,kBAAS,EAAC,qCAAiB,CAAC;qCAGK,yBAAW;QACL,qCAAiB;GAH5C,8BAA8B,CAuD1C","sourcesContent":["import { Body, Controller, HttpStatus, Post, Res, UseGuards } from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport {\n  ErrorResponse,\n  IntrospectAccessiTokenRequest,\n  IntrospectAccessiTokenResponse,\n} from '../Dtos';\nimport { PermissionService } from '../Services/PermissionService/PermissionService';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { RequireServiceTokenScopes, ServiceTokenGuard } from '../security/serviceTokenGuard';\nimport { recordAccessiDuration, recordAccessiMetric } from '../observability/metrics';\n\n/**\n * Endpoint service-to-service per validare un access token Accessi.\n *\n * Non e pensato per il browser: richiede un service token con scope\n * `accessi:introspect`. I backend fratelli lo usano per autorizzare richieste\n * senza accedere al database Accessi.\n */\n@ApiTags('ServiceToken')\n@ApiBearerAuth()\n@Controller('accessi/auth')\n@UseGuards(ServiceTokenGuard)\nexport class AccessiIntrospectionController {\n  constructor(\n    private readonly authService: AuthService,\n    private readonly permissionService: PermissionService,\n  ) {}\n\n  @Post('introspect')\n  @RequireServiceTokenScopes('accessi:introspect')\n  @ApiOperation({\n    summary: 'Verifica un access token Accessi',\n    operationId: 'introspectAccessiToken',\n    description:\n      'Restituisce active=false per token invalido, scaduto o utente non piu abilitato. Richiede un service token con scope accessi:introspect.',\n  })\n  @ApiBody({ type: IntrospectAccessiTokenRequest })\n  @ApiOkResponse({ description: 'Esito della verifica token.', type: IntrospectAccessiTokenResponse })\n  @ApiResponse({ status: HttpStatus.UNAUTHORIZED, description: 'Service token mancante o non valido.', type: ErrorResponse })\n  @ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Scope accessi:introspect mancante.', type: ErrorResponse })\n  async introspect(\n    @Body() body: IntrospectAccessiTokenRequest,\n    @Res() res: Response,\n  ): Promise<Response> {\n    const startedAt = Date.now();\n    try {\n      if (!body?.token) {\n        recordAccessiMetric('accessi_introspection_total', 1, { result: 'bad_request' });\n        return RestUtilities.sendErrorMessage(\n          res,\n          'Token non fornito.',\n          AccessiIntrospectionController.name,\n          HttpStatus.BAD_REQUEST,\n        );\n      }\n\n      const introspection = await this.authService.introspectAccessToken(body.token);\n      if (!introspection.active || !introspection.codiceUtente) {\n        recordAccessiMetric('accessi_introspection_total', 1, { result: 'inactive' });\n        return RestUtilities.sendBaseResponse(res, { active: false });\n      }\n\n      const user = (introspection.payload as { utente?: unknown } | undefined)?.utente;\n      const grants = await this.permissionService.getUserRolesAndGrants(introspection.codiceUtente);\n      recordAccessiMetric('accessi_introspection_total', 1, { result: 'active' });\n      return RestUtilities.sendBaseResponse(res, {\n        active: true,\n        ...(user ? { user } : {}),\n        grants,\n      });\n    } catch (error) {\n      recordAccessiMetric('accessi_introspection_total', 1, { result: 'error' });\n      return RestUtilities.sendErrorMessage(res, error, AccessiIntrospectionController.name);\n    } finally {\n      recordAccessiDuration('accessi_introspection_duration_ms', Date.now() - startedAt);\n    }\n  }\n}\n"]}

package/dist/accessi-module/Controllers/AuthController.js

@@ -36,10 +36,24 @@ const jwt_strategy_1 = require("../jwt/jwt.strategy");
 const accessControl_1 = require("../security/accessControl");
 const authenticatedToken_1 = require("../security/authenticatedToken");
 const authCookies_1 = require("../security/authCookies");
+const metrics_1 = require("../observability/metrics");
 const sessionRevocation_1 = require("../security/sessionRevocation");
 const accessTokenRevocation_1 = require("../security/accessTokenRevocation");
 const audit_1 = require("../security/audit");
 const publicAuthRateLimit_1 = require("../security/publicAuthRateLimit");
+/** Estrae il codice stabile di un errore Nest `{ code, message }`. */
+function authErrorCode(error) {
+    if (!error || typeof error !== 'object')
+        return undefined;
+    const response = typeof error.getResponse === 'function'
+        ? error.getResponse()
+        : error.response;
+    if (response && typeof response === 'object') {
+        const code = response.code;
+        return typeof code === 'string' ? code : undefined;
+    }
+    return undefined;
+}
 let AuthController = AuthController_1 = class AuthController {
     constructor(authService, adminBootstrapService, options) {
         this.authService = authService;
@@ -157,13 +171,18 @@ let AuthController = AuthController_1 = class AuthController {
     }
     login(request, loginRequest, res) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const startedAt = Date.now();
             try {
                 const rateLimitDecision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'login', request, [loginRequest === null || loginRequest === void 0 ? void 0 : loginRequest.email]);
                 if (!rateLimitDecision.allowed) {
+                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result: 'rate_limited' });
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
                 }
                 const userData = yield this.authService.login(loginRequest);
                 if (!userData) {
+                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result: 'failure' });
+                    (0, audit_1.auditAccessi)('login_failed', { result: 'failure', ip: request.ip, emailProvided: Boolean(loginRequest === null || loginRequest === void 0 ? void 0 : loginRequest.email) });
                     return Utilities_1.RestUtilities.sendInvalidCredentials(res);
                 }
                 if (!userData.challenge && !userData.passwordRequired) {
@@ -173,10 +192,30 @@ let AuthController = AuthController_1 = class AuthController {
                         userData.refreshToken = tokens.refresh;
                     (0, authCookies_1.applyAccessiAuthCookies)(res, (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options), userData);
                 }
+                const result = userData.challenge
+                    ? 'challenge'
+                    : userData.passwordRequired
+                        ? 'password_required'
+                        : 'success';
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result });
+                if (result === 'success') {
+                    (0, audit_1.auditAccessi)('login_succeeded', {
+                        codiceUtente: (_a = userData.utente) === null || _a === void 0 ? void 0 : _a.codiceUtente,
+                        ip: request.ip,
+                    });
+                }
                 return Utilities_1.RestUtilities.sendBaseResponse(res, userData);
             }
             catch (error) {
-                if ((error === null || error === void 0 ? void 0 : error.message) === 'PASSWORD_EXPIRED') {
+                const message = error === null || error === void 0 ? void 0 : error.message;
+                const result = message === 'PASSWORD_EXPIRED'
+                    ? 'password_expired'
+                    : message === AuthService_1.PASSWORD_LOGIN_DISABLED
+                        ? 'sso_only'
+                        : 'error';
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result });
+                (0, audit_1.auditAccessi)('login_failed', { result, ip: request.ip, emailProvided: Boolean(loginRequest === null || loginRequest === void 0 ? void 0 : loginRequest.email) });
+                if (message === 'PASSWORD_EXPIRED') {
                     this.logger.warning('Password scaduta, cambiare password ', error);
                     return Utilities_1.RestUtilities.sendPasswordExpired(res);
                 }
@@ -197,10 +236,14 @@ let AuthController = AuthController_1 = class AuthController {
                 }
                 return Utilities_1.RestUtilities.sendInvalidCredentials(res);
             }
+            finally {
+                (0, metrics_1.observeAccessiMetric)(this.options, 'auth_login_duration_ms', Date.now() - startedAt);
+            }
         });
     }
     refresh(request, body, res) {
         return __awaiter(this, void 0, void 0, function* () {
+            const startedAt = Date.now();
             try {
                 const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
                 const cookieRefreshToken = (cookieConfig === null || cookieConfig === void 0 ? void 0 : cookieConfig.refreshFromCookie)
@@ -214,6 +257,7 @@ let AuthController = AuthController_1 = class AuthController {
                     : undefined;
                 const decision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'refresh', request, tokenKey ? [tokenKey] : []);
                 if (!decision.allowed) {
+                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_refresh_total', { result: 'rate_limited' });
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, decision.retryAfterSeconds);
                 }
                 if (!refreshToken) {
@@ -225,37 +269,69 @@ let AuthController = AuthController_1 = class AuthController {
                 }
                 const response = Object.assign({ token: result.token }, (result.refreshToken ? { refreshToken: result.refreshToken } : {}));
                 (0, authCookies_1.applyAccessiAuthCookies)(res, cookieConfig, response);
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_refresh_total', { result: 'success' });
+                (0, audit_1.auditAccessi)('refresh_succeeded', { ip: request.ip });
                 return Utilities_1.RestUtilities.sendBaseResponse(res, response);
             }
             catch (error) {
+                const code = authErrorCode(error);
+                const result = code === 'ACCESSI_REFRESH_TOKEN_REUSE'
+                    ? 'reuse'
+                    : code === 'ACCESSI_REFRESH_FAMILY_REVOKED'
+                        ? 'family_revoked'
+                        : code === 'ACCESSI_REFRESH_ROTATION_UNAVAILABLE'
+                            ? 'store_unavailable'
+                            : 'invalid';
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_refresh_total', { result });
+                if (result !== 'reuse')
+                    (0, audit_1.auditAccessi)('refresh_failed', { result, ip: request.ip });
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.UNAUTHORIZED);
             }
+            finally {
+                (0, metrics_1.observeAccessiMetric)(this.options, 'auth_refresh_duration_ms', Date.now() - startedAt);
+            }
         });
     }
     verifyTwoFactor(request, body, res) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const startedAt = Date.now();
             try {
                 const limit = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'twoFactorVerify', request, [body.challengeId]);
-                if (!limit.allowed)
+                if (!limit.allowed) {
+                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'verify', result: 'rate_limited' });
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
+                }
                 const result = yield this.authService.verifyTwoFactor(body.challengeId, body.code, body.scope);
                 (0, authCookies_1.applyAccessiAuthCookies)(res, (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options), result);
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'verify', result: 'success' });
+                (0, audit_1.auditAccessi)('two_factor_succeeded', { codiceUtente: (_a = result.utente) === null || _a === void 0 ? void 0 : _a.codiceUtente, ip: request.ip });
                 return Utilities_1.RestUtilities.sendBaseResponse(res, result);
             }
             catch (error) {
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'verify', result: 'failure' });
+                (0, audit_1.auditAccessi)('two_factor_failed', { ip: request.ip });
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
             }
+            finally {
+                (0, metrics_1.observeAccessiMetric)(this.options, 'auth_two_factor_duration_ms', Date.now() - startedAt, { action: 'verify' });
+            }
         });
     }
     resendTwoFactor(request, body, res) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
                 const limit = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'twoFactorResend', request, [body.challengeId]);
-                if (!limit.allowed)
+                if (!limit.allowed) {
+                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'resend', result: 'rate_limited' });
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
-                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.authService.resendTwoFactor(body.challengeId));
+                }
+                const result = yield this.authService.resendTwoFactor(body.challengeId);
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'resend', result: 'success' });
+                return Utilities_1.RestUtilities.sendBaseResponse(res, result);
             }
             catch (error) {
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'resend', result: 'failure' });
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
             }
         });
@@ -477,12 +553,10 @@ __decorate([
 ], AuthController.prototype, "adminBootstrapStatus", null);
 exports.AuthController = AuthController = AuthController_1 = __decorate([
     (0, swagger_1.ApiTags)('Auth'),
-    (0, common_1.Controller)('accessi/auth')
-    /**
+    (0, common_1.Controller)('accessi/auth') /**
      * Endpoint pubblici di autenticazione locale e verifica sessione.
      * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.
-     */
-    ,
+     */,
     __param(2, (0, common_1.Inject)('ACCESSI_OPTIONS')),
     __metadata("design:paramtypes", [AuthService_1.AuthService,
         AdminBootstrapService_1.AdminBootstrapService, Object])