emilsoftware-utilities 2.0.0-dev.78 → 2.0.0-dev.79

package/dist/accessi-module/Dtos/AuditDtos.js

@@ -0,0 +1,68 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditQueryRequest = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Filtri degli endpoint audit per amministratori. */
+class AuditQueryRequest {
+}
+exports.AuditQueryRequest = AuditQueryRequest;
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Nome esatto dell evento, es. login_succeeded.' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AuditQueryRequest.prototype, "event", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Inizio intervallo (ISO 8601).' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsISO8601)(),
+    __metadata("design:type", String)
+], AuditQueryRequest.prototype, "from", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Fine intervallo (ISO 8601).' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsISO8601)(),
+    __metadata("design:type", String)
+], AuditQueryRequest.prototype, "to", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Filtra per codice utente Accessi.' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Type)(() => Number),
+    (0, class_validator_1.IsInt)(),
+    __metadata("design:type", Number)
+], AuditQueryRequest.prototype, "codiceUtente", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Record per pagina. Default 100, massimo 1000.' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Type)(() => Number),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    (0, class_validator_1.Max)(1000),
+    __metadata("design:type", Number)
+], AuditQueryRequest.prototype, "limit", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Offset della pagina. Default 0.' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Type)(() => Number),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(0),
+    __metadata("design:type", Number)
+], AuditQueryRequest.prototype, "offset", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ enum: ['asc', 'desc'], description: 'Ordinamento per timestamp. Default desc.' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsIn)(['asc', 'desc']),
+    __metadata("design:type", String)
+], AuditQueryRequest.prototype, "order", void 0);
+//# sourceMappingURL=AuditDtos.js.map

package/dist/accessi-module/Dtos/AuditDtos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/AuditDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAsD;AACtD,yDAAyC;AACzC,qDAAyF;AAEzF,sDAAsD;AACtD,MAAa,iBAAiB;CAyC7B;AAzCD,8CAyCC;AArCC;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IACrF,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;gDACI;AAKf;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IACrE,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;;+CACE;AAKd;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IACnE,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;;6CACA;AAMZ;IAJC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;IACzE,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAClB,IAAA,uBAAK,GAAE;;uDACc;AAQtB;IANC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IACrF,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAClB,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;IACN,IAAA,qBAAG,EAAC,IAAI,CAAC;;gDACK;AAOf;IALC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;IACvE,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAClB,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;;iDACS;AAKhB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;IACvG,IAAA,4BAAU,GAAE;IACZ,IAAA,sBAAI,EAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;;gDACC","sourcesContent":["import { ApiPropertyOptional } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsIn, IsInt, IsISO8601, IsOptional, IsString, Max, Min } from 'class-validator';\n\n/** Filtri degli endpoint audit per amministratori. */\nexport class AuditQueryRequest {\n  @ApiPropertyOptional({ description: 'Nome esatto dell evento, es. login_succeeded.' })\n  @IsOptional()\n  @IsString()\n  event?: string;\n\n  @ApiPropertyOptional({ description: 'Inizio intervallo (ISO 8601).' })\n  @IsOptional()\n  @IsISO8601()\n  from?: string;\n\n  @ApiPropertyOptional({ description: 'Fine intervallo (ISO 8601).' })\n  @IsOptional()\n  @IsISO8601()\n  to?: string;\n\n  @ApiPropertyOptional({ description: 'Filtra per codice utente Accessi.' })\n  @IsOptional()\n  @Type(() => Number)\n  @IsInt()\n  codiceUtente?: number;\n\n  @ApiPropertyOptional({ description: 'Record per pagina. Default 100, massimo 1000.' })\n  @IsOptional()\n  @Type(() => Number)\n  @IsInt()\n  @Min(1)\n  @Max(1000)\n  limit?: number;\n\n  @ApiPropertyOptional({ description: 'Offset della pagina. Default 0.' })\n  @IsOptional()\n  @Type(() => Number)\n  @IsInt()\n  @Min(0)\n  offset?: number;\n\n  @ApiPropertyOptional({ enum: ['asc', 'desc'], description: 'Ordinamento per timestamp. Default desc.' })\n  @IsOptional()\n  @IsIn(['asc', 'desc'])\n  order?: 'asc' | 'desc';\n}\n"]}

package/dist/accessi-module/Dtos/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./Abilitazione";
 export * from "./AdminBootstrapDtos";
+export * from "./AuditDtos";
 export * from "./AbilitazioneMenu";
 export * from "./AssignPermissionsToUserRequest";
 export * from "./AssignRolesToUserRequest";

package/dist/accessi-module/Dtos/index.js

@@ -16,6 +16,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./Abilitazione"), exports);
 __exportStar(require("./AdminBootstrapDtos"), exports);
+__exportStar(require("./AuditDtos"), exports);
 __exportStar(require("./AbilitazioneMenu"), exports);
 __exportStar(require("./AssignPermissionsToUserRequest"), exports);
 __exportStar(require("./AssignRolesToUserRequest"), exports);

package/dist/accessi-module/Dtos/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,mEAAiD;AACjD,6DAA2C;AAC3C,gEAA8C;AAC9C,iDAA+B;AAC/B,gDAA8B;AAC9B,gEAA8C;AAC9C,+DAA4C;AAE5C,iDAA+B;AAC/B,0DAAwC;AACxC,0DAAwC;AACxC,0DAAwC;AACxC,2DAAyC;AACzC,sDAAoC;AACpC,gDAA8B;AAC9B,iDAA+B;AAC/B,kDAAgC;AAChC,+CAA6B;AAC7B,0DAAwC;AACxC,qDAAmC;AACnC,uDAAqC;AACrC,yCAAuB;AACvB,+CAA6B;AAC7B,8CAA4B;AAC5B,kEAAgD;AAChD,uDAAqC;AACrC,qDAAmC;AACnC,gDAA8B;AAC9B,4CAA0B;AAC1B,uDAAqC;AAErC,8CAA2B;AAE3B,iDAA+B;AAE/B,kDAAgC","sourcesContent":["export * from \"./Abilitazione\";\nexport * from \"./AdminBootstrapDtos\";\nexport * from \"./AbilitazioneMenu\";\nexport * from \"./AssignPermissionsToUserRequest\";\nexport * from \"./AssignRolesToUserRequest\";\nexport * from \"./AuthenticatedUserPayloadDto\";\nexport * from \"./BaseResponse\";\nexport * from \"./CatalogDtos\";\nexport * from \"./ConfirmResetPasswordRequest\";\nexport * from \"./UpdateEnabledStatusRequest\"\n\nexport * from \"./FiltriUtente\";\nexport * from \"./FederatedIdentityDtos\";\nexport * from \"./FederatedExchangeDtos\";\nexport * from \"./GetUserByTokenRequest\";\nexport * from \"./GetUserByTokenResponse\";\nexport * from \"./IntrospectionDtos\";\nexport * from \"./LoginAsDtos\";\nexport * from \"./LoginRequest\";\nexport * from \"./LoginResponse\";\nexport * from \"./Permission\";\nexport * from \"./PublicRegisterRequest\";\nexport * from \"./RefreshTokenDtos\";\nexport * from \"./RevokeTokenRequest\";\nexport * from \"./Role\";\nexport * from \"./SchemaDtos\";\nexport * from \"./ScopeDtos\";\nexport * from \"./SendResetPasswordEmailRequest\";\nexport * from \"./StatoRegistrazione\";\nexport * from \"./TipoAbilitazione\";\nexport * from \"./TokenResult\";\nexport * from \"./UserDto\";\nexport * from \"./UserGrantsResponse\";\n\nexport * from \"./RuoliMenu\"\n\nexport * from \"./ServiceToken\";\n\nexport * from './TwoFactorDtos';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,8CAA4B;AAC5B,qDAAmC;AACnC,mEAAiD;AACjD,6DAA2C;AAC3C,gEAA8C;AAC9C,iDAA+B;AAC/B,gDAA8B;AAC9B,gEAA8C;AAC9C,+DAA4C;AAE5C,iDAA+B;AAC/B,0DAAwC;AACxC,0DAAwC;AACxC,0DAAwC;AACxC,2DAAyC;AACzC,sDAAoC;AACpC,gDAA8B;AAC9B,iDAA+B;AAC/B,kDAAgC;AAChC,+CAA6B;AAC7B,0DAAwC;AACxC,qDAAmC;AACnC,uDAAqC;AACrC,yCAAuB;AACvB,+CAA6B;AAC7B,8CAA4B;AAC5B,kEAAgD;AAChD,uDAAqC;AACrC,qDAAmC;AACnC,gDAA8B;AAC9B,4CAA0B;AAC1B,uDAAqC;AAErC,8CAA2B;AAE3B,iDAA+B;AAE/B,kDAAgC","sourcesContent":["export * from \"./Abilitazione\";\nexport * from \"./AdminBootstrapDtos\";\nexport * from \"./AuditDtos\";\nexport * from \"./AbilitazioneMenu\";\nexport * from \"./AssignPermissionsToUserRequest\";\nexport * from \"./AssignRolesToUserRequest\";\nexport * from \"./AuthenticatedUserPayloadDto\";\nexport * from \"./BaseResponse\";\nexport * from \"./CatalogDtos\";\nexport * from \"./ConfirmResetPasswordRequest\";\nexport * from \"./UpdateEnabledStatusRequest\"\n\nexport * from \"./FiltriUtente\";\nexport * from \"./FederatedIdentityDtos\";\nexport * from \"./FederatedExchangeDtos\";\nexport * from \"./GetUserByTokenRequest\";\nexport * from \"./GetUserByTokenResponse\";\nexport * from \"./IntrospectionDtos\";\nexport * from \"./LoginAsDtos\";\nexport * from \"./LoginRequest\";\nexport * from \"./LoginResponse\";\nexport * from \"./Permission\";\nexport * from \"./PublicRegisterRequest\";\nexport * from \"./RefreshTokenDtos\";\nexport * from \"./RevokeTokenRequest\";\nexport * from \"./Role\";\nexport * from \"./SchemaDtos\";\nexport * from \"./ScopeDtos\";\nexport * from \"./SendResetPasswordEmailRequest\";\nexport * from \"./StatoRegistrazione\";\nexport * from \"./TipoAbilitazione\";\nexport * from \"./TokenResult\";\nexport * from \"./UserDto\";\nexport * from \"./UserGrantsResponse\";\n\nexport * from \"./RuoliMenu\"\n\nexport * from \"./ServiceToken\";\n\nexport * from './TwoFactorDtos';\n"]}

package/dist/accessi-module/index.d.ts

@@ -25,6 +25,7 @@ export interface AccessiModuleInitializationResult {
 export declare function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<AccessiModuleInitializationResult>;
 export { AccessiModule } from "./AccessiModule";
 export { AccessiIntrospectionController } from "./Controllers/AccessiIntrospectionController";
+export { AccessiAuditController } from "./Controllers/AccessiAuditController";
 export { FederatedAuthExchangeController } from "./federated-auth/FederatedAuthExchangeController";
 export type { AccessiTokenIntrospectionResult } from "./Services/AuthService/AuthService";
 export { AccessiDatabaseUpdater } from "./database-updates/AccessiDatabaseUpdater";
@@ -38,7 +39,10 @@ export type { MemoryRateLimitStore, RateLimitDecision, RateLimitRedisClient, Rat
 export { createAccessiEdgeRateLimitMiddleware } from './security/edgeRateLimit';
 export type { AccessiEdgeRateLimitMiddleware, AccessiEdgeRateLimitOptions } from './security/edgeRateLimit';
 export { assertValidAccessiOptions, validateAccessiOptions } from './security/validateOptions';
-export { auditAccessi } from './security/audit';
+export { auditAccessi, configureAccessiAudit, getAccessiAuditStore, redactAccessiAuditValue, resetAccessiAudit } from './security/audit';
+export type { AccessiAuditOptions, AccessiAuditPage, AccessiAuditQuery, AccessiAuditQueryableSink, AccessiAuditRecord, AccessiAuditSink } from './security/audit';
+export { createCallbackAccessiAuditSink, createHttpAccessiAuditSink, createMemoryAccessiAuditSink, createRedisAccessiAuditSink } from './security/auditSinks';
+export type { HttpAccessiAuditSinkOptions, MemoryAccessiAuditSink, MemoryAccessiAuditSinkOptions, RedisAccessiAuditSinkOptions } from './security/auditSinks';
 export { createMemorySessionRevocationStore, createRedisSessionRevocationStore, revokeAccessiUserSessions, revokeAccessiUserSessionsIfConfigured, isAccessiTokenRevoked, getSessionRevocationStore } from './security/sessionRevocation';
 export type { MemorySessionRevocationStore, RedisSessionRevocationStoreOptions, SessionRevocationOptions, SessionRevocationRedisClient, SessionRevocationStore } from './security/sessionRevocation';
 export { createMemoryRefreshTokenRotationStore, createRedisRefreshTokenRotationStore, consumeRefreshToken, getRefreshTokenRotationStore, isRefreshTokenFamilyRevoked, revokeRefreshTokenFamily } from './security/refreshTokenRotation';

package/dist/accessi-module/index.js

@@ -26,9 +26,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.isValidAdminBootstrapToken = exports.clearAdminBootstrapToken = exports.getAdminBootstrapToken = exports.getOrCreateAdminBootstrapToken = exports.AdminBootstrapService = exports.SchemaExportService = exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.leadingStatementKeyword = exports.analyzeCatalogScript = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.revokeAccessiAccessTokenIfConfigured = exports.revokeAccessiAccessToken = exports.isAccessiAccessTokenRevoked = exports.getAccessTokenRevocationStore = exports.createRedisAccessTokenRevocationStore = exports.createMemoryAccessTokenRevocationStore = exports.revokeRefreshTokenFamily = exports.isRefreshTokenFamilyRevoked = exports.getRefreshTokenRotationStore = exports.consumeRefreshToken = exports.createRedisRefreshTokenRotationStore = exports.createMemoryRefreshTokenRotationStore = exports.getSessionRevocationStore = exports.isAccessiTokenRevoked = exports.revokeAccessiUserSessionsIfConfigured = exports.revokeAccessiUserSessions = exports.createRedisSessionRevocationStore = exports.createMemorySessionRevocationStore = exports.auditAccessi = exports.validateAccessiOptions = exports.assertValidAccessiOptions = exports.createAccessiEdgeRateLimitMiddleware = exports.getDefaultRateLimitStore = exports.createRedisRateLimitStore = exports.createMemoryRateLimitStore = exports.getDefaultConsoleEntryStore = exports.createRedisConsoleEntryStore = exports.createMemoryConsoleEntryStore = exports.AccessiDatabaseUpdater = exports.FederatedAuthExchangeController = exports.AccessiIntrospectionController = exports.AccessiModule = void 0;
-exports.checkAccessiDatabase = exports.checkAccessiReadiness = exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.verifyAccessiJwt = exports.resolveAccessiVerificationKeys = exports.getAccessiRefreshTokenVerificationConfig = exports.getAccessiRefreshTokenSigningConfig = exports.getAccessiAccessTokenVerificationConfig = exports.getAccessiAccessTokenSigningConfig = exports.instrumentAccessiRedisClient = exports.resetAccessiMetrics = exports.renderAccessiMetrics = exports.recordAccessiMetric = exports.recordAccessiDuration = exports.observeAccessiMetric = exports.getAccessiMetricsSink = exports.getAccessiMetricsRegistry = exports.createAccessiMetricsRegistry = exports.countAccessiMetric = exports.accessiMetricName = exports.isAccessiCsrfExemptPath = exports.parseAccessiCookieHeader = exports.applyAccessiAuthCookies = exports.clearAccessiAuthCookies = exports.setAccessiAuthCookies = exports.getAccessiRefreshTokenFromCookie = exports.getAccessiAccessTokenFromCookie = exports.resolveAccessiAuthCookieOptions = exports.createAccessiAuthCookieMiddleware = exports.resolveAccessiSecurityHeaders = exports.createAccessiSecurityHeadersMiddleware = exports.buildAccessiContentSecurityPolicy = exports.applyAccessiContentSecurityPolicy = exports.applyAccessiBaseSecurityHeaders = exports.setupAccessiJwks = exports.getAccessiJwksPath = exports.createAccessiJwksHandler = exports.buildAccessiJwks = exports.LOGIN_AS_QUERY_PARAM = exports.buildLoginAsUrl = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = void 0;
-exports.createAccessiHealthModule = exports.readinessHttpStatus = exports.createAccessiLiveReport = exports.collectAccessiHealthStores = void 0;
+exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.leadingStatementKeyword = exports.analyzeCatalogScript = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.revokeAccessiAccessTokenIfConfigured = exports.revokeAccessiAccessToken = exports.isAccessiAccessTokenRevoked = exports.getAccessTokenRevocationStore = exports.createRedisAccessTokenRevocationStore = exports.createMemoryAccessTokenRevocationStore = exports.revokeRefreshTokenFamily = exports.isRefreshTokenFamilyRevoked = exports.getRefreshTokenRotationStore = exports.consumeRefreshToken = exports.createRedisRefreshTokenRotationStore = exports.createMemoryRefreshTokenRotationStore = exports.getSessionRevocationStore = exports.isAccessiTokenRevoked = exports.revokeAccessiUserSessionsIfConfigured = exports.revokeAccessiUserSessions = exports.createRedisSessionRevocationStore = exports.createMemorySessionRevocationStore = exports.createRedisAccessiAuditSink = exports.createMemoryAccessiAuditSink = exports.createHttpAccessiAuditSink = exports.createCallbackAccessiAuditSink = exports.resetAccessiAudit = exports.redactAccessiAuditValue = exports.getAccessiAuditStore = exports.configureAccessiAudit = exports.auditAccessi = exports.validateAccessiOptions = exports.assertValidAccessiOptions = exports.createAccessiEdgeRateLimitMiddleware = exports.getDefaultRateLimitStore = exports.createRedisRateLimitStore = exports.createMemoryRateLimitStore = exports.getDefaultConsoleEntryStore = exports.createRedisConsoleEntryStore = exports.createMemoryConsoleEntryStore = exports.AccessiDatabaseUpdater = exports.FederatedAuthExchangeController = exports.AccessiAuditController = exports.AccessiIntrospectionController = exports.AccessiModule = void 0;
+exports.verifyAccessiJwt = exports.resolveAccessiVerificationKeys = exports.getAccessiRefreshTokenVerificationConfig = exports.getAccessiRefreshTokenSigningConfig = exports.getAccessiAccessTokenVerificationConfig = exports.getAccessiAccessTokenSigningConfig = exports.instrumentAccessiRedisClient = exports.resetAccessiMetrics = exports.renderAccessiMetrics = exports.recordAccessiMetric = exports.recordAccessiDuration = exports.observeAccessiMetric = exports.getAccessiMetricsSink = exports.getAccessiMetricsRegistry = exports.createAccessiMetricsRegistry = exports.countAccessiMetric = exports.accessiMetricName = exports.isAccessiCsrfExemptPath = exports.parseAccessiCookieHeader = exports.applyAccessiAuthCookies = exports.clearAccessiAuthCookies = exports.setAccessiAuthCookies = exports.getAccessiRefreshTokenFromCookie = exports.getAccessiAccessTokenFromCookie = exports.resolveAccessiAuthCookieOptions = exports.createAccessiAuthCookieMiddleware = exports.resolveAccessiSecurityHeaders = exports.createAccessiSecurityHeadersMiddleware = exports.buildAccessiContentSecurityPolicy = exports.applyAccessiContentSecurityPolicy = exports.applyAccessiBaseSecurityHeaders = exports.setupAccessiJwks = exports.getAccessiJwksPath = exports.createAccessiJwksHandler = exports.buildAccessiJwks = exports.LOGIN_AS_QUERY_PARAM = exports.buildLoginAsUrl = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.isValidAdminBootstrapToken = exports.clearAdminBootstrapToken = exports.getAdminBootstrapToken = exports.getOrCreateAdminBootstrapToken = exports.AdminBootstrapService = exports.SchemaExportService = void 0;
+exports.createAccessiHealthModule = exports.readinessHttpStatus = exports.createAccessiLiveReport = exports.collectAccessiHealthStores = exports.checkAccessiDatabase = exports.checkAccessiReadiness = exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = void 0;
 exports.initializeAccessiModule = initializeAccessiModule;
 const express_1 = __importDefault(require("express"));
 const core_1 = require("@nestjs/core");
@@ -156,6 +156,8 @@ var AccessiModule_2 = require("./AccessiModule");
 Object.defineProperty(exports, "AccessiModule", { enumerable: true, get: function () { return AccessiModule_2.AccessiModule; } });
 var AccessiIntrospectionController_1 = require("./Controllers/AccessiIntrospectionController");
 Object.defineProperty(exports, "AccessiIntrospectionController", { enumerable: true, get: function () { return AccessiIntrospectionController_1.AccessiIntrospectionController; } });
+var AccessiAuditController_1 = require("./Controllers/AccessiAuditController");
+Object.defineProperty(exports, "AccessiAuditController", { enumerable: true, get: function () { return AccessiAuditController_1.AccessiAuditController; } });
 var FederatedAuthExchangeController_1 = require("./federated-auth/FederatedAuthExchangeController");
 Object.defineProperty(exports, "FederatedAuthExchangeController", { enumerable: true, get: function () { return FederatedAuthExchangeController_1.FederatedAuthExchangeController; } });
 var AccessiDatabaseUpdater_1 = require("./database-updates/AccessiDatabaseUpdater");
@@ -175,6 +177,15 @@ Object.defineProperty(exports, "assertValidAccessiOptions", { enumerable: true,
 Object.defineProperty(exports, "validateAccessiOptions", { enumerable: true, get: function () { return validateOptions_1.validateAccessiOptions; } });
 var audit_1 = require("./security/audit");
 Object.defineProperty(exports, "auditAccessi", { enumerable: true, get: function () { return audit_1.auditAccessi; } });
+Object.defineProperty(exports, "configureAccessiAudit", { enumerable: true, get: function () { return audit_1.configureAccessiAudit; } });
+Object.defineProperty(exports, "getAccessiAuditStore", { enumerable: true, get: function () { return audit_1.getAccessiAuditStore; } });
+Object.defineProperty(exports, "redactAccessiAuditValue", { enumerable: true, get: function () { return audit_1.redactAccessiAuditValue; } });
+Object.defineProperty(exports, "resetAccessiAudit", { enumerable: true, get: function () { return audit_1.resetAccessiAudit; } });
+var auditSinks_1 = require("./security/auditSinks");
+Object.defineProperty(exports, "createCallbackAccessiAuditSink", { enumerable: true, get: function () { return auditSinks_1.createCallbackAccessiAuditSink; } });
+Object.defineProperty(exports, "createHttpAccessiAuditSink", { enumerable: true, get: function () { return auditSinks_1.createHttpAccessiAuditSink; } });
+Object.defineProperty(exports, "createMemoryAccessiAuditSink", { enumerable: true, get: function () { return auditSinks_1.createMemoryAccessiAuditSink; } });
+Object.defineProperty(exports, "createRedisAccessiAuditSink", { enumerable: true, get: function () { return auditSinks_1.createRedisAccessiAuditSink; } });
 var sessionRevocation_1 = require("./security/sessionRevocation");
 Object.defineProperty(exports, "createMemorySessionRevocationStore", { enumerable: true, get: function () { return sessionRevocation_1.createMemorySessionRevocationStore; } });
 Object.defineProperty(exports, "createRedisSessionRevocationStore", { enumerable: true, get: function () { return sessionRevocation_1.createRedisSessionRevocationStore; } });

package/dist/accessi-module/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,0DAgHC;AA7KD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAG1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAKkC;AAClC,kEAIsC;AACtC,qDAAiE;AACjE,6CAAiD;AACjD,oEAA2E;AAC3E,sFAAmF;AACnF,sEAAsE;AACtE,0CAAuE;AACvE,4DAAgF;AAChF,gEAAoF;AACpF,wDAA2E;AAU3E,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAsB,uBAAuB,CACzC,GAAgB,EAChB,OAAuB;;;QAEvB,yFAAyF;QACzF,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,eAAe,GAAG,IAAA,4CAA4B,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEtE,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,IAAI,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,UAAU,MAAK,SAAS,EAAE,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChD,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CACpC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAA,oCAAoB,EAAC,IAAI,EAAE,eAAe,CAAC;gBAC3C,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa;gBACvC,CAAC,CAAC,IAAA,oDAAoC,kCAC/B,OAAO,CAAC,aAAa,KACxB,KAAK,EAAE,MAAA,OAAO,CAAC,aAAa,CAAC,KAAK,mCAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IACxE;gBACF,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,aAAa,EAAE,CAAC;gBAChB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,UAAU,GAAG,IAAA,+CAAiC,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC9E,IAAI,UAAU,EAAE,CAAC;gBACb,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,eAAe,MAAK,KAAK,EAAE,CAAC;gBAC1C,MAAM,eAAe,GAAG,IAAA,wDAAsC,EAC1D,MAAA,OAAO,CAAC,IAAI,0CAAE,eAAe,EAC7B,cAAc,EACd,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,oCAAoB,EAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CACzE,CAAC;gBACF,IAAI,eAAe,EAAE,CAAC;oBAClB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7B,CAAC;YACL,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,IAAA,uBAAgB,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,kBACxF,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,KAAK,IACrC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACvD,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,IAAI,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,IAAI,MAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO,CAAC,UAAU,CAAC,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,IAAI,mCAAI,EAAE,cAAc,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,IAAA,wCAAwB,EAAC,eAAe,CAAC;aACrD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAA,4BAAY,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,eAAe,GAAG,IAAA,8CAA6B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,eAAe,CAAC,sBAAsB,CAAC;YACvE,IAAA,uCAAqB,EAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;YAC9D,IAAA,8BAAiB,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAEvF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,+FAA8F;AAArF,gJAAA,8BAA8B,OAAA;AACvC,oGAAmG;AAA1F,kJAAA,+BAA+B,OAAA;AAExC,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAI/B,wDAIiC;AAH7B,6HAAA,6BAA6B,OAAA;AAC7B,4HAAA,4BAA4B,OAAA;AAC5B,2HAAA,2BAA2B,OAAA;AAU/B,4DAImC;AAH/B,4HAAA,0BAA0B,OAAA;AAC1B,2HAAA,yBAAyB,OAAA;AACzB,0HAAA,wBAAwB,OAAA;AAS5B,0DAAgF;AAAvE,qIAAA,oCAAoC,OAAA;AAK7C,8DAGoC;AAFhC,4HAAA,yBAAyB,OAAA;AACzB,yHAAA,sBAAsB,OAAA;AAE1B,0CAAgD;AAAvC,qGAAA,YAAY,OAAA;AACrB,kEAOsC;AANlC,uIAAA,kCAAkC,OAAA;AAClC,sIAAA,iCAAiC,OAAA;AACjC,8HAAA,yBAAyB,OAAA;AACzB,0IAAA,qCAAqC,OAAA;AACrC,0HAAA,qBAAqB,OAAA;AACrB,8HAAA,yBAAyB,OAAA;AAS7B,wEAOyC;AANrC,6IAAA,qCAAqC,OAAA;AACrC,4IAAA,oCAAoC,OAAA;AACpC,2HAAA,mBAAmB,OAAA;AACnB,oIAAA,4BAA4B,OAAA;AAC5B,mIAAA,2BAA2B,OAAA;AAC3B,gIAAA,wBAAwB,OAAA;AAU5B,0EAO0C;AANtC,+IAAA,sCAAsC,OAAA;AACtC,8IAAA,qCAAqC,OAAA;AACrC,sIAAA,6BAA6B,OAAA;AAC7B,oIAAA,2BAA2B,OAAA;AAC3B,iIAAA,wBAAwB,OAAA;AACxB,6IAAA,oCAAoC,OAAA;AAaxC,oFASmD;AAR/C,gIAAA,sBAAsB,OAAA;AACtB,6HAAA,mBAAmB,OAAA;AACnB,mIAAA,yBAAyB,OAAA;AACzB,4HAAA,kBAAkB,OAAA;AAClB,8HAAA,oBAAoB,OAAA;AACpB,iIAAA,uBAAuB,OAAA;AACvB,sIAAA,4BAA4B,OAAA;AAC5B,gIAAA,sBAAsB,OAAA;AAG1B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAO5B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAE5B,gGAA+F;AAAtF,8HAAA,qBAAqB,OAAA;AAE9B,4DAKmC;AAJ/B,gIAAA,8BAA8B,OAAA;AAC9B,wHAAA,sBAAsB,OAAA;AACtB,0HAAA,wBAAwB,OAAA;AACxB,4HAAA,0BAA0B,OAAA;AAE9B,kEAAoH;AAA3G,sHAAA,iBAAiB,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AAAE,2HAAA,sBAAsB,OAAA;AAC7E,oEAAuJ;AAA9I,2HAAA,qBAAqB,OAAA;AAAE,uHAAA,iBAAiB,OAAA;AAAE,oIAAA,8BAA8B,OAAA;AAAE,kIAAA,4BAA4B,OAAA;AAC/G,8CAA2E;AAAlE,0GAAA,eAAe,OAAA;AAAE,+GAAA,oBAAoB,OAAA;AAC9C,wCAKyB;AAJrB,wGAAA,gBAAgB,OAAA;AAChB,gHAAA,wBAAwB,OAAA;AACxB,0GAAA,kBAAkB,OAAA;AAClB,wGAAA,gBAAgB,OAAA;AAGpB,8DAMoC;AALhC,kIAAA,+BAA+B,OAAA;AAC/B,oIAAA,iCAAiC,OAAA;AACjC,oIAAA,iCAAiC,OAAA;AACjC,yIAAA,sCAAsC,OAAA;AACtC,gIAAA,6BAA6B,OAAA;AAWjC,sDAUgC;AAT5B,gIAAA,iCAAiC,OAAA;AACjC,8HAAA,+BAA+B,OAAA;AAC/B,8HAAA,+BAA+B,OAAA;AAC/B,+HAAA,gCAAgC,OAAA;AAChC,oHAAA,qBAAqB,OAAA;AACrB,sHAAA,uBAAuB,OAAA;AACvB,sHAAA,uBAAuB,OAAA;AACvB,uHAAA,wBAAwB,OAAA;AACxB,sHAAA,uBAAuB,OAAA;AAQ3B,mDAWiC;AAV7B,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,uHAAA,4BAA4B,OAAA;AAC5B,oHAAA,yBAAyB,OAAA;AACzB,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA;AACpB,gHAAA,qBAAqB,OAAA;AACrB,8GAAA,mBAAmB,OAAA;AACnB,+GAAA,oBAAoB,OAAA;AACpB,8GAAA,mBAAmB,OAAA;AAUvB,6DAA4E;AAAnE,4HAAA,4BAA4B,OAAA;AAErC,8DAOoC;AANhC,qIAAA,kCAAkC,OAAA;AAClC,0IAAA,uCAAuC,OAAA;AACvC,sIAAA,mCAAmC,OAAA;AACnC,2IAAA,wCAAwC,OAAA;AACxC,iIAAA,8BAA8B,OAAA;AAC9B,mHAAA,gBAAgB,OAAA;AAMpB,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA;AAC3B,mDAI0B;AAHtB,+HAAA,6BAA6B,OAAA;AAC7B,0HAAA,wBAAwB,OAAA;AACxB,oIAAA,kCAAkC,OAAA;AAUtC,gDAM4B;AALxB,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AACpB,uHAAA,0BAA0B,OAAA;AAC1B,oHAAA,uBAAuB,OAAA;AACvB,gHAAA,mBAAmB,OAAA;AAUvB,sCAA0D;AAAjD,iHAAA,yBAAyB,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport type { INestApplication } from \"@nestjs/common\";\nimport type { OpenAPIObject } from \"@nestjs/swagger\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport {\n    buildOpenApiExcludePaths,\n    isOpenApiRequestPath,\n    resolveAccessiOpenApiOptions,\n    setupOpenApi\n} from \"../openapi/OpenApiConfig\";\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { registerAccessiModuleServices } from \"./accessiRuntime\";\nimport { logAccessiStartup } from \"./startupLog\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\nimport { assertEmailConfigured } from './security/emailConfiguration';\nimport { getAccessiJwksPath, setupAccessiJwks } from './security/jwks';\nimport { createAccessiEdgeRateLimitMiddleware } from './security/edgeRateLimit';\nimport { createAccessiSecurityHeadersMiddleware } from './security/securityHeaders';\nimport { createAccessiAuthCookieMiddleware } from './security/authCookies';\n\n/** Esito del bootstrap Express di Accessi. */\nexport interface AccessiModuleInitializationResult {\n    /** Sotto-app Nest che serve `/api/accessi/*` e la documentazione. */\n    nestApp: INestApplication;\n    /** Documento OpenAPI generato, mergiabile nel documento unico dell'host. */\n    document: OpenAPIObject;\n}\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n    const dbOptions = options.databaseOptions as {\n        host?: string;\n        port?: number;\n        database?: string;\n        user?: string;\n    };\n\n    return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/**\n * Monta il modulo Accessi in un'applicazione Express gia esistente.\n *\n * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza la\n * documentazione OpenAPI, validazione ed error handler, quindi rende disponibile\n * `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n *\n * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n * @returns Il sotto-app Nest e il documento OpenAPI generato (utile per il merge nell'host).\n */\nexport async function initializeAccessiModule(\n    app: Application,\n    options: AccessiOptions\n): Promise<AccessiModuleInitializationResult> {\n    // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.\n    assertEmailConfigured(options);\n    const logger: Logger = new Logger(\"initializeAccessiModule\");\n    beginAccessiAuthInitialization();\n    const startedAt = performance.now();\n    const resolvedOpenApi = resolveAccessiOpenApiOptions(options.openapi);\n\n    try {\n        logger.info(\"Inizializzazione modulo accessi avviata.\");\n        logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n        logger.info(\n            `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n        );\n        const nestHostApp = express();\n        if (options.http?.trustProxy !== undefined) {\n            app.set('trust proxy', options.http.trustProxy);\n            nestHostApp.set('trust proxy', options.http.trustProxy);\n        }\n        const jwksPath = getAccessiJwksPath(options);\n        const isAccessiRoute = (path: string) =>\n            path === \"/api/accessi\" ||\n            path.startsWith(\"/api/accessi/\") ||\n            isOpenApiRequestPath(path, resolvedOpenApi) ||\n            (jwksPath !== undefined && path === jwksPath);\n        const edgeRateLimit = options.edgeRateLimit\n            ? createAccessiEdgeRateLimitMiddleware({\n                ...options.edgeRateLimit,\n                match: options.edgeRateLimit.match ?? ((path) => isAccessiRoute(path)),\n            })\n            : undefined;\n        if (edgeRateLimit) {\n            app.use(edgeRateLimit);\n        }\n        const authCookie = createAccessiAuthCookieMiddleware(options, isAccessiRoute);\n        if (authCookie) {\n            app.use(authCookie);\n        }\n        if (options.http?.securityHeaders !== false) {\n            const securityHeaders = createAccessiSecurityHeadersMiddleware(\n                options.http?.securityHeaders,\n                isAccessiRoute,\n                { isOpenApiUi: (path) => isOpenApiRequestPath(path, resolvedOpenApi) },\n            );\n            if (securityHeaders) {\n                app.use(securityHeaders);\n            }\n        }\n\n        app.use((req: Request, res, next) => {\n            if (!isAccessiRoute(req.path)) {\n                return next();\n            }\n\n            return nestHostApp(req, res, next);\n        });\n\n        setupAccessiJwks(app, options);\n        if (jwksPath) {\n            logger.info(`JWKS accessi disponibile su: ${jwksPath}`);\n        }\n\n        const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n        const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: options.bufferLogs !== false,\n            ...(options.logger ? { logger: options.logger } : {})\n        });\n        logger.info(\"Applicazione Nest accessi creata.\");\n\n        if (options.http?.cors !== false) {\n            nestApp.enableCors(options.http?.cors ?? { exposedHeaders: ['X-Total-Count', 'X-CSRF-Token'] });\n        }\n        nestApp.useGlobalPipes(createAccessiValidationPipe());\n        nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\n        nestApp.setGlobalPrefix('api', {\n            exclude: buildOpenApiExcludePaths(resolvedOpenApi)\n        });\n\n        const document = setupOpenApi(nestApp, resolvedOpenApi);\n        logger.info(\"Avvio init del modulo accessi.\");\n        await nestApp.init();\n        logger.info(\"Init del modulo accessi completata.\");\n        if (options.legacyPasswordMigrationOnStartup !== false) {\n            logger.info(\"Avvio migrazione password legacy accessi.\");\n            const passwordMigrationService = nestApp.get(AuthService);\n            await passwordMigrationService.migrateLegacyEncryptedPasswords();\n            logger.info(\"Migrazione password legacy accessi completata.\");\n        }\n\n        const accessiServices = registerAccessiModuleServices(app, nestApp);\n        app.locals.accessiAuthService = accessiServices.authenticateGenService;\n        setAccessiAuthService(accessiServices.authenticateGenService);\n        logAccessiStartup(options, resolvedOpenApi);\n        const elapsedMs = performance.now() - startedAt;\n        logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n        return { nestApp, document };\n    } catch (error) {\n        failAccessiAuthInitialization(error);\n        logger.error(\n            \"Errore in initialize AccessiModule:\",\n            error instanceof Error\n                ? { name: error.name, message: error.message, stack: error.stack }\n                : { error: String(error) }\n        );\n        throw error;\n    }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiIntrospectionController } from \"./Controllers/AccessiIntrospectionController\";\nexport { FederatedAuthExchangeController } from \"./federated-auth/FederatedAuthExchangeController\";\nexport type { AccessiTokenIntrospectionResult } from \"./Services/AuthService/AuthService\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from \"./AccessiModule\";\nexport type { CatalogScriptsOptions, CatalogScriptChecksumPolicy, ConsoleEntryOptions } from \"./AccessiModule\";\nexport {\n    createMemoryConsoleEntryStore,\n    createRedisConsoleEntryStore,\n    getDefaultConsoleEntryStore\n} from './security/consoleEntry';\nexport type {\n    ConsoleEntryRedisClient,\n    ConsoleEntryRecord,\n    ConsoleEntryStore,\n    ConsoleEntryTicket,\n    MemoryConsoleEntryStore,\n    RedisConsoleEntryStoreOptions\n} from './security/consoleEntry';\nexport {\n    createMemoryRateLimitStore,\n    createRedisRateLimitStore,\n    getDefaultRateLimitStore\n} from './security/rateLimitStore';\nexport type {\n    MemoryRateLimitStore,\n    RateLimitDecision,\n    RateLimitRedisClient,\n    RateLimitStore,\n    RedisRateLimitStoreOptions\n} from './security/rateLimitStore';\nexport { createAccessiEdgeRateLimitMiddleware } from './security/edgeRateLimit';\nexport type {\n    AccessiEdgeRateLimitMiddleware,\n    AccessiEdgeRateLimitOptions\n} from './security/edgeRateLimit';\nexport {\n    assertValidAccessiOptions,\n    validateAccessiOptions\n} from './security/validateOptions';\nexport { auditAccessi } from './security/audit';\nexport {\n    createMemorySessionRevocationStore,\n    createRedisSessionRevocationStore,\n    revokeAccessiUserSessions,\n    revokeAccessiUserSessionsIfConfigured,\n    isAccessiTokenRevoked,\n    getSessionRevocationStore\n} from './security/sessionRevocation';\nexport type {\n    MemorySessionRevocationStore,\n    RedisSessionRevocationStoreOptions,\n    SessionRevocationOptions,\n    SessionRevocationRedisClient,\n    SessionRevocationStore\n} from './security/sessionRevocation';\nexport {\n    createMemoryRefreshTokenRotationStore,\n    createRedisRefreshTokenRotationStore,\n    consumeRefreshToken,\n    getRefreshTokenRotationStore,\n    isRefreshTokenFamilyRevoked,\n    revokeRefreshTokenFamily\n} from './security/refreshTokenRotation';\nexport type {\n    MemoryRefreshTokenRotationStore,\n    RedisRefreshTokenRotationStoreOptions,\n    RefreshTokenConsumeResult,\n    RefreshTokenRotationOptions,\n    RefreshTokenRotationRedisClient,\n    RefreshTokenRotationStore\n} from './security/refreshTokenRotation';\nexport {\n    createMemoryAccessTokenRevocationStore,\n    createRedisAccessTokenRevocationStore,\n    getAccessTokenRevocationStore,\n    isAccessiAccessTokenRevoked,\n    revokeAccessiAccessToken,\n    revokeAccessiAccessTokenIfConfigured\n} from './security/accessTokenRevocation';\nexport type {\n    AccessTokenRevocationOptions,\n    AccessTokenRevocationRedisClient,\n    AccessTokenRevocationStore,\n    MemoryAccessTokenRevocationStore,\n    RedisAccessTokenRevocationStoreOptions\n} from './security/accessTokenRevocation';\nexport type {\n    AccessiOptionsValidationIssue,\n    AccessiOptionsValidationResult\n} from './security/validateOptions';\nexport {\n    AccessiCatalogMigrator,\n    applyCatalogScripts,\n    listPendingCatalogScripts,\n    splitSqlStatements,\n    analyzeCatalogScript,\n    leadingStatementKeyword,\n    computeCatalogScriptChecksum,\n    discoverCatalogScripts\n} from \"./database-updates/AccessiCatalogMigrator\";\nexport type { CatalogMigrationReport, CatalogScriptMigration } from \"./database-updates/AccessiCatalogMigrator\";\nexport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nexport type {\n    ServiceTokenMetadata,\n    IssuedServiceToken,\n    VerifiedServiceToken,\n    IssueServiceTokenInput\n} from './Services/ServiceTokenService/ServiceTokenService';\nexport { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';\nexport type { SchemaDdlResult, SchemaDdlSection, SchemaEntitiesResult } from './Services/SchemaExportService/SchemaExportService';\nexport { AdminBootstrapService } from './Services/AdminBootstrapService/AdminBootstrapService';\nexport type { BootstrapAdminResult } from './Services/AdminBootstrapService/AdminBootstrapService';\nexport {\n    getOrCreateAdminBootstrapToken,\n    getAdminBootstrapToken,\n    clearAdminBootstrapToken,\n    isValidAdminBootstrapToken\n} from './security/adminBootstrap';\nexport { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';\nexport { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';\nexport { buildLoginAsUrl, LOGIN_AS_QUERY_PARAM } from './security/loginAs';\nexport {\n    buildAccessiJwks,\n    createAccessiJwksHandler,\n    getAccessiJwksPath,\n    setupAccessiJwks\n} from './security/jwks';\nexport type { AccessiJwksDocument, AccessiJwksKey } from './security/jwks';\nexport {\n    applyAccessiBaseSecurityHeaders,\n    applyAccessiContentSecurityPolicy,\n    buildAccessiContentSecurityPolicy,\n    createAccessiSecurityHeadersMiddleware,\n    resolveAccessiSecurityHeaders\n} from './security/securityHeaders';\nexport type {\n    AccessiCspDirectives,\n    AccessiCspOptions,\n    AccessiCspSurface,\n    AccessiSecurityHeadersOptions,\n    AccessiSecurityHeadersSetting,\n    ResolvedAccessiCsp,\n    ResolvedAccessiSecurityHeaders\n} from './security/securityHeaders';\nexport {\n    createAccessiAuthCookieMiddleware,\n    resolveAccessiAuthCookieOptions,\n    getAccessiAccessTokenFromCookie,\n    getAccessiRefreshTokenFromCookie,\n    setAccessiAuthCookies,\n    clearAccessiAuthCookies,\n    applyAccessiAuthCookies,\n    parseAccessiCookieHeader,\n    isAccessiCsrfExemptPath\n} from './security/authCookies';\nexport type {\n    AccessiAuthCookieOptions,\n    AccessiAuthCookieSetting,\n    AccessiAuthTokenPair,\n    ResolvedAccessiAuthCookieOptions\n} from './security/authCookies';\nexport {\n    accessiMetricName,\n    countAccessiMetric,\n    createAccessiMetricsRegistry,\n    getAccessiMetricsRegistry,\n    getAccessiMetricsSink,\n    observeAccessiMetric,\n    recordAccessiDuration,\n    recordAccessiMetric,\n    renderAccessiMetrics,\n    resetAccessiMetrics\n} from './observability/metrics';\nexport type {\n    AccessiMetricLabelValue,\n    AccessiMetricLabels,\n    AccessiMetricsOptions,\n    AccessiMetricsRegistry,\n    AccessiMetricsSink,\n    AccessiMetricsSnapshot\n} from './observability/metrics';\nexport { instrumentAccessiRedisClient } from './observability/redisMetrics';\nexport type { AccessiRedisEvalClient } from './observability/redisMetrics';\nexport {\n    getAccessiAccessTokenSigningConfig,\n    getAccessiAccessTokenVerificationConfig,\n    getAccessiRefreshTokenSigningConfig,\n    getAccessiRefreshTokenVerificationConfig,\n    resolveAccessiVerificationKeys,\n    verifyAccessiJwt\n} from './security/jwtTokenOptions';\nexport type {\n    AccessiJwtVerificationConfig,\n    AccessiUnknownKeyIdEvent\n} from './security/jwtTokenOptions';\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\n    authorizeAccessi,\n    authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport {\n    registerAccessiModuleServices,\n    getAccessiModuleServices,\n    ACCESSI_MODULE_SERVICES_LOCALS_KEY\n} from \"./accessiRuntime\";\nexport type { AccessiModuleServices } from \"./accessiRuntime\";\nexport type {\n    AccessiAuthorizationOptions,\n    AccessiRequirementNode,\n    AccessiCustomRequirementContext,\n    AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n\nexport {\n    checkAccessiReadiness,\n    checkAccessiDatabase,\n    collectAccessiHealthStores,\n    createAccessiLiveReport,\n    readinessHttpStatus\n} from './health/readiness';\nexport type {\n    AccessiHealthCheckResult,\n    AccessiHealthStore,\n    AccessiLiveReport,\n    AccessiReadinessCheck,\n    AccessiReadinessDependencies,\n    AccessiReadinessReport\n} from './health/readiness';\nexport { createAccessiHealthModule } from './health/nest';\nexport type { AccessiHealthModuleOptions } from './health/nest';\n\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,0DAgHC;AA7KD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAG1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAKkC;AAClC,kEAIsC;AACtC,qDAAiE;AACjE,6CAAiD;AACjD,oEAA2E;AAC3E,sFAAmF;AACnF,sEAAsE;AACtE,0CAAuE;AACvE,4DAAgF;AAChF,gEAAoF;AACpF,wDAA2E;AAU3E,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAsB,uBAAuB,CACzC,GAAgB,EAChB,OAAuB;;;QAEvB,yFAAyF;QACzF,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,eAAe,GAAG,IAAA,4CAA4B,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEtE,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,IAAI,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,UAAU,MAAK,SAAS,EAAE,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChD,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CACpC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAA,oCAAoB,EAAC,IAAI,EAAE,eAAe,CAAC;gBAC3C,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa;gBACvC,CAAC,CAAC,IAAA,oDAAoC,kCAC/B,OAAO,CAAC,aAAa,KACxB,KAAK,EAAE,MAAA,OAAO,CAAC,aAAa,CAAC,KAAK,mCAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IACxE;gBACF,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,aAAa,EAAE,CAAC;gBAChB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,UAAU,GAAG,IAAA,+CAAiC,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC9E,IAAI,UAAU,EAAE,CAAC;gBACb,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,eAAe,MAAK,KAAK,EAAE,CAAC;gBAC1C,MAAM,eAAe,GAAG,IAAA,wDAAsC,EAC1D,MAAA,OAAO,CAAC,IAAI,0CAAE,eAAe,EAC7B,cAAc,EACd,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,oCAAoB,EAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CACzE,CAAC;gBACF,IAAI,eAAe,EAAE,CAAC;oBAClB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7B,CAAC;YACL,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,IAAA,uBAAgB,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,kBACxF,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,KAAK,IACrC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACvD,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,IAAI,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,IAAI,MAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO,CAAC,UAAU,CAAC,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,IAAI,mCAAI,EAAE,cAAc,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,IAAA,wCAAwB,EAAC,eAAe,CAAC;aACrD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAA,4BAAY,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,eAAe,GAAG,IAAA,8CAA6B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,eAAe,CAAC,sBAAsB,CAAC;YACvE,IAAA,uCAAqB,EAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;YAC9D,IAAA,8BAAiB,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAEvF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,+FAA8F;AAArF,gJAAA,8BAA8B,OAAA;AACvC,+EAA8E;AAArE,gIAAA,sBAAsB,OAAA;AAC/B,oGAAmG;AAA1F,kJAAA,+BAA+B,OAAA;AAExC,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAI/B,wDAIiC;AAH7B,6HAAA,6BAA6B,OAAA;AAC7B,4HAAA,4BAA4B,OAAA;AAC5B,2HAAA,2BAA2B,OAAA;AAU/B,4DAImC;AAH/B,4HAAA,0BAA0B,OAAA;AAC1B,2HAAA,yBAAyB,OAAA;AACzB,0HAAA,wBAAwB,OAAA;AAS5B,0DAAgF;AAAvE,qIAAA,oCAAoC,OAAA;AAK7C,8DAGoC;AAFhC,4HAAA,yBAAyB,OAAA;AACzB,yHAAA,sBAAsB,OAAA;AAE1B,0CAM0B;AALtB,qGAAA,YAAY,OAAA;AACZ,8GAAA,qBAAqB,OAAA;AACrB,6GAAA,oBAAoB,OAAA;AACpB,gHAAA,uBAAuB,OAAA;AACvB,0GAAA,iBAAiB,OAAA;AAUrB,oDAK+B;AAJ3B,4HAAA,8BAA8B,OAAA;AAC9B,wHAAA,0BAA0B,OAAA;AAC1B,0HAAA,4BAA4B,OAAA;AAC5B,yHAAA,2BAA2B,OAAA;AAQ/B,kEAOsC;AANlC,uIAAA,kCAAkC,OAAA;AAClC,sIAAA,iCAAiC,OAAA;AACjC,8HAAA,yBAAyB,OAAA;AACzB,0IAAA,qCAAqC,OAAA;AACrC,0HAAA,qBAAqB,OAAA;AACrB,8HAAA,yBAAyB,OAAA;AAS7B,wEAOyC;AANrC,6IAAA,qCAAqC,OAAA;AACrC,4IAAA,oCAAoC,OAAA;AACpC,2HAAA,mBAAmB,OAAA;AACnB,oIAAA,4BAA4B,OAAA;AAC5B,mIAAA,2BAA2B,OAAA;AAC3B,gIAAA,wBAAwB,OAAA;AAU5B,0EAO0C;AANtC,+IAAA,sCAAsC,OAAA;AACtC,8IAAA,qCAAqC,OAAA;AACrC,sIAAA,6BAA6B,OAAA;AAC7B,oIAAA,2BAA2B,OAAA;AAC3B,iIAAA,wBAAwB,OAAA;AACxB,6IAAA,oCAAoC,OAAA;AAaxC,oFASmD;AAR/C,gIAAA,sBAAsB,OAAA;AACtB,6HAAA,mBAAmB,OAAA;AACnB,mIAAA,yBAAyB,OAAA;AACzB,4HAAA,kBAAkB,OAAA;AAClB,8HAAA,oBAAoB,OAAA;AACpB,iIAAA,uBAAuB,OAAA;AACvB,sIAAA,4BAA4B,OAAA;AAC5B,gIAAA,sBAAsB,OAAA;AAG1B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAO5B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAE5B,gGAA+F;AAAtF,8HAAA,qBAAqB,OAAA;AAE9B,4DAKmC;AAJ/B,gIAAA,8BAA8B,OAAA;AAC9B,wHAAA,sBAAsB,OAAA;AACtB,0HAAA,wBAAwB,OAAA;AACxB,4HAAA,0BAA0B,OAAA;AAE9B,kEAAoH;AAA3G,sHAAA,iBAAiB,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AAAE,2HAAA,sBAAsB,OAAA;AAC7E,oEAAuJ;AAA9I,2HAAA,qBAAqB,OAAA;AAAE,uHAAA,iBAAiB,OAAA;AAAE,oIAAA,8BAA8B,OAAA;AAAE,kIAAA,4BAA4B,OAAA;AAC/G,8CAA2E;AAAlE,0GAAA,eAAe,OAAA;AAAE,+GAAA,oBAAoB,OAAA;AAC9C,wCAKyB;AAJrB,wGAAA,gBAAgB,OAAA;AAChB,gHAAA,wBAAwB,OAAA;AACxB,0GAAA,kBAAkB,OAAA;AAClB,wGAAA,gBAAgB,OAAA;AAGpB,8DAMoC;AALhC,kIAAA,+BAA+B,OAAA;AAC/B,oIAAA,iCAAiC,OAAA;AACjC,oIAAA,iCAAiC,OAAA;AACjC,yIAAA,sCAAsC,OAAA;AACtC,gIAAA,6BAA6B,OAAA;AAWjC,sDAUgC;AAT5B,gIAAA,iCAAiC,OAAA;AACjC,8HAAA,+BAA+B,OAAA;AAC/B,8HAAA,+BAA+B,OAAA;AAC/B,+HAAA,gCAAgC,OAAA;AAChC,oHAAA,qBAAqB,OAAA;AACrB,sHAAA,uBAAuB,OAAA;AACvB,sHAAA,uBAAuB,OAAA;AACvB,uHAAA,wBAAwB,OAAA;AACxB,sHAAA,uBAAuB,OAAA;AAQ3B,mDAWiC;AAV7B,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,uHAAA,4BAA4B,OAAA;AAC5B,oHAAA,yBAAyB,OAAA;AACzB,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA;AACpB,gHAAA,qBAAqB,OAAA;AACrB,8GAAA,mBAAmB,OAAA;AACnB,+GAAA,oBAAoB,OAAA;AACpB,8GAAA,mBAAmB,OAAA;AAUvB,6DAA4E;AAAnE,4HAAA,4BAA4B,OAAA;AAErC,8DAOoC;AANhC,qIAAA,kCAAkC,OAAA;AAClC,0IAAA,uCAAuC,OAAA;AACvC,sIAAA,mCAAmC,OAAA;AACnC,2IAAA,wCAAwC,OAAA;AACxC,iIAAA,8BAA8B,OAAA;AAC9B,mHAAA,gBAAgB,OAAA;AAMpB,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA;AAC3B,mDAI0B;AAHtB,+HAAA,6BAA6B,OAAA;AAC7B,0HAAA,wBAAwB,OAAA;AACxB,oIAAA,kCAAkC,OAAA;AAUtC,gDAM4B;AALxB,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AACpB,uHAAA,0BAA0B,OAAA;AAC1B,oHAAA,uBAAuB,OAAA;AACvB,gHAAA,mBAAmB,OAAA;AAUvB,sCAA0D;AAAjD,iHAAA,yBAAyB,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport type { INestApplication } from \"@nestjs/common\";\nimport type { OpenAPIObject } from \"@nestjs/swagger\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport {\n    buildOpenApiExcludePaths,\n    isOpenApiRequestPath,\n    resolveAccessiOpenApiOptions,\n    setupOpenApi\n} from \"../openapi/OpenApiConfig\";\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { registerAccessiModuleServices } from \"./accessiRuntime\";\nimport { logAccessiStartup } from \"./startupLog\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\nimport { assertEmailConfigured } from './security/emailConfiguration';\nimport { getAccessiJwksPath, setupAccessiJwks } from './security/jwks';\nimport { createAccessiEdgeRateLimitMiddleware } from './security/edgeRateLimit';\nimport { createAccessiSecurityHeadersMiddleware } from './security/securityHeaders';\nimport { createAccessiAuthCookieMiddleware } from './security/authCookies';\n\n/** Esito del bootstrap Express di Accessi. */\nexport interface AccessiModuleInitializationResult {\n    /** Sotto-app Nest che serve `/api/accessi/*` e la documentazione. */\n    nestApp: INestApplication;\n    /** Documento OpenAPI generato, mergiabile nel documento unico dell'host. */\n    document: OpenAPIObject;\n}\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n    const dbOptions = options.databaseOptions as {\n        host?: string;\n        port?: number;\n        database?: string;\n        user?: string;\n    };\n\n    return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/**\n * Monta il modulo Accessi in un'applicazione Express gia esistente.\n *\n * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza la\n * documentazione OpenAPI, validazione ed error handler, quindi rende disponibile\n * `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n *\n * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n * @returns Il sotto-app Nest e il documento OpenAPI generato (utile per il merge nell'host).\n */\nexport async function initializeAccessiModule(\n    app: Application,\n    options: AccessiOptions\n): Promise<AccessiModuleInitializationResult> {\n    // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.\n    assertEmailConfigured(options);\n    const logger: Logger = new Logger(\"initializeAccessiModule\");\n    beginAccessiAuthInitialization();\n    const startedAt = performance.now();\n    const resolvedOpenApi = resolveAccessiOpenApiOptions(options.openapi);\n\n    try {\n        logger.info(\"Inizializzazione modulo accessi avviata.\");\n        logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n        logger.info(\n            `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n        );\n        const nestHostApp = express();\n        if (options.http?.trustProxy !== undefined) {\n            app.set('trust proxy', options.http.trustProxy);\n            nestHostApp.set('trust proxy', options.http.trustProxy);\n        }\n        const jwksPath = getAccessiJwksPath(options);\n        const isAccessiRoute = (path: string) =>\n            path === \"/api/accessi\" ||\n            path.startsWith(\"/api/accessi/\") ||\n            isOpenApiRequestPath(path, resolvedOpenApi) ||\n            (jwksPath !== undefined && path === jwksPath);\n        const edgeRateLimit = options.edgeRateLimit\n            ? createAccessiEdgeRateLimitMiddleware({\n                ...options.edgeRateLimit,\n                match: options.edgeRateLimit.match ?? ((path) => isAccessiRoute(path)),\n            })\n            : undefined;\n        if (edgeRateLimit) {\n            app.use(edgeRateLimit);\n        }\n        const authCookie = createAccessiAuthCookieMiddleware(options, isAccessiRoute);\n        if (authCookie) {\n            app.use(authCookie);\n        }\n        if (options.http?.securityHeaders !== false) {\n            const securityHeaders = createAccessiSecurityHeadersMiddleware(\n                options.http?.securityHeaders,\n                isAccessiRoute,\n                { isOpenApiUi: (path) => isOpenApiRequestPath(path, resolvedOpenApi) },\n            );\n            if (securityHeaders) {\n                app.use(securityHeaders);\n            }\n        }\n\n        app.use((req: Request, res, next) => {\n            if (!isAccessiRoute(req.path)) {\n                return next();\n            }\n\n            return nestHostApp(req, res, next);\n        });\n\n        setupAccessiJwks(app, options);\n        if (jwksPath) {\n            logger.info(`JWKS accessi disponibile su: ${jwksPath}`);\n        }\n\n        const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n        const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: options.bufferLogs !== false,\n            ...(options.logger ? { logger: options.logger } : {})\n        });\n        logger.info(\"Applicazione Nest accessi creata.\");\n\n        if (options.http?.cors !== false) {\n            nestApp.enableCors(options.http?.cors ?? { exposedHeaders: ['X-Total-Count', 'X-CSRF-Token'] });\n        }\n        nestApp.useGlobalPipes(createAccessiValidationPipe());\n        nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\n        nestApp.setGlobalPrefix('api', {\n            exclude: buildOpenApiExcludePaths(resolvedOpenApi)\n        });\n\n        const document = setupOpenApi(nestApp, resolvedOpenApi);\n        logger.info(\"Avvio init del modulo accessi.\");\n        await nestApp.init();\n        logger.info(\"Init del modulo accessi completata.\");\n        if (options.legacyPasswordMigrationOnStartup !== false) {\n            logger.info(\"Avvio migrazione password legacy accessi.\");\n            const passwordMigrationService = nestApp.get(AuthService);\n            await passwordMigrationService.migrateLegacyEncryptedPasswords();\n            logger.info(\"Migrazione password legacy accessi completata.\");\n        }\n\n        const accessiServices = registerAccessiModuleServices(app, nestApp);\n        app.locals.accessiAuthService = accessiServices.authenticateGenService;\n        setAccessiAuthService(accessiServices.authenticateGenService);\n        logAccessiStartup(options, resolvedOpenApi);\n        const elapsedMs = performance.now() - startedAt;\n        logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n        return { nestApp, document };\n    } catch (error) {\n        failAccessiAuthInitialization(error);\n        logger.error(\n            \"Errore in initialize AccessiModule:\",\n            error instanceof Error\n                ? { name: error.name, message: error.message, stack: error.stack }\n                : { error: String(error) }\n        );\n        throw error;\n    }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiIntrospectionController } from \"./Controllers/AccessiIntrospectionController\";\nexport { AccessiAuditController } from \"./Controllers/AccessiAuditController\";\nexport { FederatedAuthExchangeController } from \"./federated-auth/FederatedAuthExchangeController\";\nexport type { AccessiTokenIntrospectionResult } from \"./Services/AuthService/AuthService\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from \"./AccessiModule\";\nexport type { CatalogScriptsOptions, CatalogScriptChecksumPolicy, ConsoleEntryOptions } from \"./AccessiModule\";\nexport {\n    createMemoryConsoleEntryStore,\n    createRedisConsoleEntryStore,\n    getDefaultConsoleEntryStore\n} from './security/consoleEntry';\nexport type {\n    ConsoleEntryRedisClient,\n    ConsoleEntryRecord,\n    ConsoleEntryStore,\n    ConsoleEntryTicket,\n    MemoryConsoleEntryStore,\n    RedisConsoleEntryStoreOptions\n} from './security/consoleEntry';\nexport {\n    createMemoryRateLimitStore,\n    createRedisRateLimitStore,\n    getDefaultRateLimitStore\n} from './security/rateLimitStore';\nexport type {\n    MemoryRateLimitStore,\n    RateLimitDecision,\n    RateLimitRedisClient,\n    RateLimitStore,\n    RedisRateLimitStoreOptions\n} from './security/rateLimitStore';\nexport { createAccessiEdgeRateLimitMiddleware } from './security/edgeRateLimit';\nexport type {\n    AccessiEdgeRateLimitMiddleware,\n    AccessiEdgeRateLimitOptions\n} from './security/edgeRateLimit';\nexport {\n    assertValidAccessiOptions,\n    validateAccessiOptions\n} from './security/validateOptions';\nexport {\n    auditAccessi,\n    configureAccessiAudit,\n    getAccessiAuditStore,\n    redactAccessiAuditValue,\n    resetAccessiAudit\n} from './security/audit';\nexport type {\n    AccessiAuditOptions,\n    AccessiAuditPage,\n    AccessiAuditQuery,\n    AccessiAuditQueryableSink,\n    AccessiAuditRecord,\n    AccessiAuditSink\n} from './security/audit';\nexport {\n    createCallbackAccessiAuditSink,\n    createHttpAccessiAuditSink,\n    createMemoryAccessiAuditSink,\n    createRedisAccessiAuditSink\n} from './security/auditSinks';\nexport type {\n    HttpAccessiAuditSinkOptions,\n    MemoryAccessiAuditSink,\n    MemoryAccessiAuditSinkOptions,\n    RedisAccessiAuditSinkOptions\n} from './security/auditSinks';\nexport {\n    createMemorySessionRevocationStore,\n    createRedisSessionRevocationStore,\n    revokeAccessiUserSessions,\n    revokeAccessiUserSessionsIfConfigured,\n    isAccessiTokenRevoked,\n    getSessionRevocationStore\n} from './security/sessionRevocation';\nexport type {\n    MemorySessionRevocationStore,\n    RedisSessionRevocationStoreOptions,\n    SessionRevocationOptions,\n    SessionRevocationRedisClient,\n    SessionRevocationStore\n} from './security/sessionRevocation';\nexport {\n    createMemoryRefreshTokenRotationStore,\n    createRedisRefreshTokenRotationStore,\n    consumeRefreshToken,\n    getRefreshTokenRotationStore,\n    isRefreshTokenFamilyRevoked,\n    revokeRefreshTokenFamily\n} from './security/refreshTokenRotation';\nexport type {\n    MemoryRefreshTokenRotationStore,\n    RedisRefreshTokenRotationStoreOptions,\n    RefreshTokenConsumeResult,\n    RefreshTokenRotationOptions,\n    RefreshTokenRotationRedisClient,\n    RefreshTokenRotationStore\n} from './security/refreshTokenRotation';\nexport {\n    createMemoryAccessTokenRevocationStore,\n    createRedisAccessTokenRevocationStore,\n    getAccessTokenRevocationStore,\n    isAccessiAccessTokenRevoked,\n    revokeAccessiAccessToken,\n    revokeAccessiAccessTokenIfConfigured\n} from './security/accessTokenRevocation';\nexport type {\n    AccessTokenRevocationOptions,\n    AccessTokenRevocationRedisClient,\n    AccessTokenRevocationStore,\n    MemoryAccessTokenRevocationStore,\n    RedisAccessTokenRevocationStoreOptions\n} from './security/accessTokenRevocation';\nexport type {\n    AccessiOptionsValidationIssue,\n    AccessiOptionsValidationResult\n} from './security/validateOptions';\nexport {\n    AccessiCatalogMigrator,\n    applyCatalogScripts,\n    listPendingCatalogScripts,\n    splitSqlStatements,\n    analyzeCatalogScript,\n    leadingStatementKeyword,\n    computeCatalogScriptChecksum,\n    discoverCatalogScripts\n} from \"./database-updates/AccessiCatalogMigrator\";\nexport type { CatalogMigrationReport, CatalogScriptMigration } from \"./database-updates/AccessiCatalogMigrator\";\nexport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nexport type {\n    ServiceTokenMetadata,\n    IssuedServiceToken,\n    VerifiedServiceToken,\n    IssueServiceTokenInput\n} from './Services/ServiceTokenService/ServiceTokenService';\nexport { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';\nexport type { SchemaDdlResult, SchemaDdlSection, SchemaEntitiesResult } from './Services/SchemaExportService/SchemaExportService';\nexport { AdminBootstrapService } from './Services/AdminBootstrapService/AdminBootstrapService';\nexport type { BootstrapAdminResult } from './Services/AdminBootstrapService/AdminBootstrapService';\nexport {\n    getOrCreateAdminBootstrapToken,\n    getAdminBootstrapToken,\n    clearAdminBootstrapToken,\n    isValidAdminBootstrapToken\n} from './security/adminBootstrap';\nexport { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';\nexport { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';\nexport { buildLoginAsUrl, LOGIN_AS_QUERY_PARAM } from './security/loginAs';\nexport {\n    buildAccessiJwks,\n    createAccessiJwksHandler,\n    getAccessiJwksPath,\n    setupAccessiJwks\n} from './security/jwks';\nexport type { AccessiJwksDocument, AccessiJwksKey } from './security/jwks';\nexport {\n    applyAccessiBaseSecurityHeaders,\n    applyAccessiContentSecurityPolicy,\n    buildAccessiContentSecurityPolicy,\n    createAccessiSecurityHeadersMiddleware,\n    resolveAccessiSecurityHeaders\n} from './security/securityHeaders';\nexport type {\n    AccessiCspDirectives,\n    AccessiCspOptions,\n    AccessiCspSurface,\n    AccessiSecurityHeadersOptions,\n    AccessiSecurityHeadersSetting,\n    ResolvedAccessiCsp,\n    ResolvedAccessiSecurityHeaders\n} from './security/securityHeaders';\nexport {\n    createAccessiAuthCookieMiddleware,\n    resolveAccessiAuthCookieOptions,\n    getAccessiAccessTokenFromCookie,\n    getAccessiRefreshTokenFromCookie,\n    setAccessiAuthCookies,\n    clearAccessiAuthCookies,\n    applyAccessiAuthCookies,\n    parseAccessiCookieHeader,\n    isAccessiCsrfExemptPath\n} from './security/authCookies';\nexport type {\n    AccessiAuthCookieOptions,\n    AccessiAuthCookieSetting,\n    AccessiAuthTokenPair,\n    ResolvedAccessiAuthCookieOptions\n} from './security/authCookies';\nexport {\n    accessiMetricName,\n    countAccessiMetric,\n    createAccessiMetricsRegistry,\n    getAccessiMetricsRegistry,\n    getAccessiMetricsSink,\n    observeAccessiMetric,\n    recordAccessiDuration,\n    recordAccessiMetric,\n    renderAccessiMetrics,\n    resetAccessiMetrics\n} from './observability/metrics';\nexport type {\n    AccessiMetricLabelValue,\n    AccessiMetricLabels,\n    AccessiMetricsOptions,\n    AccessiMetricsRegistry,\n    AccessiMetricsSink,\n    AccessiMetricsSnapshot\n} from './observability/metrics';\nexport { instrumentAccessiRedisClient } from './observability/redisMetrics';\nexport type { AccessiRedisEvalClient } from './observability/redisMetrics';\nexport {\n    getAccessiAccessTokenSigningConfig,\n    getAccessiAccessTokenVerificationConfig,\n    getAccessiRefreshTokenSigningConfig,\n    getAccessiRefreshTokenVerificationConfig,\n    resolveAccessiVerificationKeys,\n    verifyAccessiJwt\n} from './security/jwtTokenOptions';\nexport type {\n    AccessiJwtVerificationConfig,\n    AccessiUnknownKeyIdEvent\n} from './security/jwtTokenOptions';\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\n    authorizeAccessi,\n    authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport {\n    registerAccessiModuleServices,\n    getAccessiModuleServices,\n    ACCESSI_MODULE_SERVICES_LOCALS_KEY\n} from \"./accessiRuntime\";\nexport type { AccessiModuleServices } from \"./accessiRuntime\";\nexport type {\n    AccessiAuthorizationOptions,\n    AccessiRequirementNode,\n    AccessiCustomRequirementContext,\n    AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n\nexport {\n    checkAccessiReadiness,\n    checkAccessiDatabase,\n    collectAccessiHealthStores,\n    createAccessiLiveReport,\n    readinessHttpStatus\n} from './health/readiness';\nexport type {\n    AccessiHealthCheckResult,\n    AccessiHealthStore,\n    AccessiLiveReport,\n    AccessiReadinessCheck,\n    AccessiReadinessDependencies,\n    AccessiReadinessReport\n} from './health/readiness';\nexport { createAccessiHealthModule } from './health/nest';\nexport type { AccessiHealthModuleOptions } from './health/nest';\n\n"]}

package/dist/accessi-module/security/audit.d.ts

@@ -1,7 +1,72 @@
+/** Record di audit normalizzato e gia redatto. */
+export interface AccessiAuditRecord {
+    event: string;
+    timestamp: string;
+    [key: string]: unknown;
+}
+/** Destinazione di un record di audit. */
+export interface AccessiAuditSink {
+    /** Nome usato nelle metriche di errore del sink. */
+    name?: string;
+    write(record: AccessiAuditRecord): void | Promise<void>;
+}
+export interface AccessiAuditQuery {
+    event?: string;
+    from?: string;
+    to?: string;
+    codiceUtente?: number;
+    limit?: number;
+    offset?: number;
+    order?: 'asc' | 'desc';
+}
+export interface AccessiAuditPage {
+    records: AccessiAuditRecord[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+/** Sink interrogabile dagli endpoint amministrativi e dalla retention. */
+export interface AccessiAuditQueryableSink extends AccessiAuditSink {
+    query(filter?: AccessiAuditQuery): Promise<AccessiAuditPage>;
+    purge(before: Date): Promise<number>;
+}
+/** Opzioni di audit del modulo. */
+export interface AccessiAuditOptions {
+    /** `false` disattiva i sink ma lascia il log strutturato. Default: abilitati. */
+    enabled?: boolean;
+    /** Sink aggiuntivi (HTTP, DB, OpenTelemetry). */
+    sinks?: AccessiAuditSink[];
+    /** Sink interrogabile usato da `/api/accessi/audit`. Default: primo sink queryable. */
+    store?: AccessiAuditQueryableSink;
+    /** Giorni di retention applicati ai sink queryable. Default: nessuna scadenza automatica. */
+    retentionDays?: number;
+    /** Chiavi aggiuntive da redigere, oltre a quelle predefinite. */
+    redact?: string[];
+    /** Scrivi anche sul Logger strutturato. Default: true. */
+    logger?: boolean;
+}
 /**
- * Audit strutturato degli eventi di sicurezza Accessi.
+ * Redige ricorsivamente token, segreti, cookie e header sensibili.
  *
- * Il Logger redige gia campi come token, password, secret e authorization.
- * Non inserire mai payload completi o segreti nei dettagli.
+ * Limita profondita, lunghezza delle stringhe e numero di elementi per evitare
+ * che un payload applicativo finisca per intero nell'audit.
+ */
+export declare function redactAccessiAuditValue(value: unknown, depth?: number): unknown;
+/**
+ * Configura i sink di audit del processo.
+ *
+ * Chiamato da `AccessiModule.forRoot`. Le opzioni sono globali: un solo modulo
+ * Accessi per processo e la configurazione consigliata.
+ */
+export declare function configureAccessiAudit(options: AccessiAuditOptions | undefined): void;
+/** Ripristina la configurazione iniziale (logger attivo, nessun sink). */
+export declare function resetAccessiAudit(): void;
+/** Sink interrogabile configurato, usato dagli endpoint amministrativi. */
+export declare function getAccessiAuditStore(): AccessiAuditQueryableSink | undefined;
+/**
+ * Registra un evento di sicurezza.
+ *
+ * Il record viene redatto prima di raggiungere logger e sink. Un sink guasto
+ * non interrompe mai il flusso applicativo.
  */
 export declare function auditAccessi(event: string, details?: Record<string, unknown>): void;

package/dist/accessi-module/security/audit.js

@@ -1,14 +1,187 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactAccessiAuditValue = redactAccessiAuditValue;
+exports.configureAccessiAudit = configureAccessiAudit;
+exports.resetAccessiAudit = resetAccessiAudit;
+exports.getAccessiAuditStore = getAccessiAuditStore;
 exports.auditAccessi = auditAccessi;
 const Logger_1 = require("../../Logger");
+const metrics_1 = require("../observability/metrics");
+const REDACTED = '[REDACTED]';
+const TRUNCATED = '[TRUNCATED]';
+const DEFAULT_REDACTED_KEYS = new Set([
+    'token',
+    'accesstoken',
+    'refreshtoken',
+    'idtoken',
+    'bearer',
+    'jwt',
+    'authorization',
+    'cookie',
+    'setcookie',
+    'password',
+    'passwordhash',
+    'hashedpassword',
+    'resettoken',
+    'secret',
+    'clientsecret',
+    'privatekey',
+    'apikey',
+    'csrf',
+    'csrftoken',
+]);
+const MAX_STRING_LENGTH = 512;
+const MAX_ARRAY_LENGTH = 50;
+const MAX_OBJECT_KEYS = 100;
+const MAX_DEPTH = 4;
+const PURGE_INTERVAL_MS = 60 * 60 * 1000;
+let sinks = [];
+let redactedKeys = new Set(DEFAULT_REDACTED_KEYS);
+let retentionDays;
+let loggerEnabled = true;
+let lastPurgeAt = 0;
+function normalizedKey(key) {
+    return key.toLowerCase().replace(/[-_\s]/g, '');
+}
+/**
+ * Redige ricorsivamente token, segreti, cookie e header sensibili.
+ *
+ * Limita profondita, lunghezza delle stringhe e numero di elementi per evitare
+ * che un payload applicativo finisca per intero nell'audit.
+ */
+function redactAccessiAuditValue(value, depth = 0) {
+    if (depth > MAX_DEPTH)
+        return TRUNCATED;
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === 'string') {
+        return value.length > MAX_STRING_LENGTH ? `${value.slice(0, MAX_STRING_LENGTH - 3)}...` : value;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'bigint')
+        return value.toString();
+    if (value instanceof Date)
+        return value.toISOString();
+    if (value instanceof Error) {
+        return { name: value.name, message: redactAccessiAuditValue(value.message, depth + 1) };
+    }
+    if (Array.isArray(value)) {
+        return value.slice(0, MAX_ARRAY_LENGTH).map((item) => redactAccessiAuditValue(item, depth + 1));
+    }
+    if (typeof value === 'object') {
+        const result = {};
+        for (const [key, entry] of Object.entries(value).slice(0, MAX_OBJECT_KEYS)) {
+            result[key] = redactedKeys.has(normalizedKey(key))
+                ? REDACTED
+                : redactAccessiAuditValue(entry, depth + 1);
+        }
+        return result;
+    }
+    return String(value);
+}
+function redactDetails(details) {
+    return redactAccessiAuditValue(details);
+}
+function reportSinkError(sink, error) {
+    var _a;
+    (0, metrics_1.recordAccessiMetric)('accessi_audit_sink_errors_total', 1, { sink: (_a = sink.name) !== null && _a !== void 0 ? _a : 'unknown' });
+    try {
+        new Logger_1.Logger('AccessiAudit').error(`Audit sink non disponibile${sink.name ? ` (${sink.name})` : ''}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    catch (_b) {
+        // Il logging non deve mai interrompere l'operazione applicativa.
+    }
+}
+function writeToSink(sink, record) {
+    try {
+        const result = sink.write(record);
+        if (result && typeof result.catch === 'function') {
+            result.catch((error) => reportSinkError(sink, error));
+        }
+    }
+    catch (error) {
+        reportSinkError(sink, error);
+    }
+}
+function maybePurge() {
+    if (!retentionDays || retentionDays <= 0)
+        return;
+    const now = Date.now();
+    if (now - lastPurgeAt < PURGE_INTERVAL_MS)
+        return;
+    lastPurgeAt = now;
+    const before = new Date(now - retentionDays * 24 * 60 * 60 * 1000);
+    for (const sink of sinks) {
+        if (typeof sink.purge !== 'function')
+            continue;
+        try {
+            const result = sink.purge(before);
+            if (result && typeof result.catch === 'function') {
+                result.catch((error) => reportSinkError(sink, error));
+            }
+        }
+        catch (error) {
+            reportSinkError(sink, error);
+        }
+    }
+}
+/**
+ * Configura i sink di audit del processo.
+ *
+ * Chiamato da `AccessiModule.forRoot`. Le opzioni sono globali: un solo modulo
+ * Accessi per processo e la configurazione consigliata.
+ */
+function configureAccessiAudit(options) {
+    var _a, _b;
+    sinks = [];
+    redactedKeys = new Set(DEFAULT_REDACTED_KEYS);
+    retentionDays = undefined;
+    loggerEnabled = true;
+    lastPurgeAt = 0;
+    for (const key of (_a = options === null || options === void 0 ? void 0 : options.redact) !== null && _a !== void 0 ? _a : [])
+        redactedKeys.add(normalizedKey(key));
+    loggerEnabled = (options === null || options === void 0 ? void 0 : options.logger) !== false;
+    if ((options === null || options === void 0 ? void 0 : options.enabled) === false)
+        return;
+    if (options === null || options === void 0 ? void 0 : options.store)
+        sinks.push(options.store);
+    for (const sink of (_b = options === null || options === void 0 ? void 0 : options.sinks) !== null && _b !== void 0 ? _b : []) {
+        if (!sinks.includes(sink))
+            sinks.push(sink);
+    }
+    const days = Number(options === null || options === void 0 ? void 0 : options.retentionDays);
+    if (Number.isFinite(days) && days > 0)
+        retentionDays = days;
+}
+/** Ripristina la configurazione iniziale (logger attivo, nessun sink). */
+function resetAccessiAudit() {
+    configureAccessiAudit(undefined);
+}
+/** Sink interrogabile configurato, usato dagli endpoint amministrativi. */
+function getAccessiAuditStore() {
+    const configured = sinks.find((sink) => typeof sink.query === 'function'
+        && typeof sink.purge === 'function');
+    return configured;
+}
 /**
- * Audit strutturato degli eventi di sicurezza Accessi.
+ * Registra un evento di sicurezza.
  *
- * Il Logger redige gia campi come token, password, secret e authorization.
- * Non inserire mai payload completi o segreti nei dettagli.
+ * Il record viene redatto prima di raggiungere logger e sink. Un sink guasto
+ * non interrompe mai il flusso applicativo.
  */
 function auditAccessi(event, details = {}) {
-    new Logger_1.Logger('AccessiAudit').warning(JSON.stringify(Object.assign({ event, timestamp: new Date().toISOString() }, details)));
+    const record = Object.assign({ event, timestamp: new Date().toISOString() }, redactDetails(details !== null && details !== void 0 ? details : {}));
+    if (loggerEnabled) {
+        try {
+            new Logger_1.Logger('AccessiAudit').warning(JSON.stringify(record));
+        }
+        catch (_a) {
+            // Il logging non deve mai interrompere l'operazione applicativa.
+        }
+    }
+    for (const sink of sinks)
+        writeToSink(sink, record);
+    maybePurge();
 }
 //# sourceMappingURL=audit.js.map

package/dist/accessi-module/security/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/audit.ts"],"names":[],"mappings":";;AAQA,oCAQC;AAhBD,yCAAsC;AAEtC;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAa,EAAE,UAAmC,EAAE;IAC/E,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAChC,IAAI,CAAC,SAAS,iBACZ,KAAK,EACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAChC,OAAO,EACV,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { Logger } from '../../Logger';\n\n/**\n * Audit strutturato degli eventi di sicurezza Accessi.\n *\n * Il Logger redige gia campi come token, password, secret e authorization.\n * Non inserire mai payload completi o segreti nei dettagli.\n */\nexport function auditAccessi(event: string, details: Record<string, unknown> = {}): void {\n  new Logger('AccessiAudit').warning(\n    JSON.stringify({\n      event,\n      timestamp: new Date().toISOString(),\n      ...details,\n    }),\n  );\n}\n"]}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/audit.ts"],"names":[],"mappings":";;AAuGA,0DAyBC;AAqDD,sDAiBC;AAGD,8CAEC;AAGD,oDAMC;AAQD,oCAiBC;AA7OD,yCAAsC;AACtC,sDAA+D;AAuD/D,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO;IACP,aAAa;IACb,cAAc;IACd,SAAS;IACT,QAAQ;IACR,KAAK;IACL,eAAe;IACf,QAAQ;IACR,WAAW;IACX,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,MAAM;IACN,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,IAAI,KAAK,GAAuB,EAAE,CAAC;AACnC,IAAI,YAAY,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;AAClD,IAAI,aAAiC,CAAC;AACtC,IAAI,aAAa,GAAG,IAAI,CAAC;AACzB,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC/D,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;YACtG,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBAChD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,uBAAuB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC;IACrD,OAAO,uBAAuB,CAAC,OAAO,CAA4B,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,IAAsB,EAAE,KAAc;;IAC7D,IAAA,6BAAmB,EAAC,iCAAiC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAA,IAAI,CAAC,IAAI,mCAAI,SAAS,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC;QACH,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAC9B,6BAA6B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7H,CAAC;IACJ,CAAC;IAAC,WAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB,EAAE,MAA0B;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,IAAI,OAAQ,MAAwB,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACnE,MAAwB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC,aAAa,IAAI,aAAa,IAAI,CAAC;QAAE,OAAO;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,WAAW,GAAG,iBAAiB;QAAE,OAAO;IAClD,WAAW,GAAG,GAAG,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU;YAAE,SAAS;QAC9E,IAAI,CAAC;YACH,MAAM,MAAM,GAAI,IAAkC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,MAAM,IAAI,OAAQ,MAA0B,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACrE,MAA0B,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,OAAwC;;IAC5E,KAAK,GAAG,EAAE,CAAC;IACX,YAAY,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC9C,aAAa,GAAG,SAAS,CAAC;IAC1B,aAAa,GAAG,IAAI,CAAC;IACrB,WAAW,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,GAAG,IAAI,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,EAAE;QAAE,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,aAAa,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,MAAK,KAAK,CAAC;IAC1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,MAAK,KAAK;QAAE,OAAO;IAEvC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,mCAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;QAAE,aAAa,GAAG,IAAI,CAAC;AAC9D,CAAC;AAED,0EAA0E;AAC1E,SAAgB,iBAAiB;IAC/B,qBAAqB,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,2EAA2E;AAC3E,SAAgB,oBAAoB;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAqC,EAAE,CACxE,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU;WAC5D,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU,CACnE,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAa,EAAE,UAAmC,EAAE;IAC/E,MAAM,MAAM,mBACV,KAAK,EACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAChC,aAAa,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAChC,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,WAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,UAAU,EAAE,CAAC;AACf,CAAC","sourcesContent":["import { Logger } from '../../Logger';\nimport { recordAccessiMetric } from '../observability/metrics';\n\n/** Record di audit normalizzato e gia redatto. */\nexport interface AccessiAuditRecord {\n  event: string;\n  timestamp: string;\n  [key: string]: unknown;\n}\n\n/** Destinazione di un record di audit. */\nexport interface AccessiAuditSink {\n  /** Nome usato nelle metriche di errore del sink. */\n  name?: string;\n  write(record: AccessiAuditRecord): void | Promise<void>;\n}\n\nexport interface AccessiAuditQuery {\n  event?: string;\n  from?: string;\n  to?: string;\n  codiceUtente?: number;\n  limit?: number;\n  offset?: number;\n  order?: 'asc' | 'desc';\n}\n\nexport interface AccessiAuditPage {\n  records: AccessiAuditRecord[];\n  total: number;\n  limit: number;\n  offset: number;\n}\n\n/** Sink interrogabile dagli endpoint amministrativi e dalla retention. */\nexport interface AccessiAuditQueryableSink extends AccessiAuditSink {\n  query(filter?: AccessiAuditQuery): Promise<AccessiAuditPage>;\n  purge(before: Date): Promise<number>;\n}\n\n/** Opzioni di audit del modulo. */\nexport interface AccessiAuditOptions {\n  /** `false` disattiva i sink ma lascia il log strutturato. Default: abilitati. */\n  enabled?: boolean;\n  /** Sink aggiuntivi (HTTP, DB, OpenTelemetry). */\n  sinks?: AccessiAuditSink[];\n  /** Sink interrogabile usato da `/api/accessi/audit`. Default: primo sink queryable. */\n  store?: AccessiAuditQueryableSink;\n  /** Giorni di retention applicati ai sink queryable. Default: nessuna scadenza automatica. */\n  retentionDays?: number;\n  /** Chiavi aggiuntive da redigere, oltre a quelle predefinite. */\n  redact?: string[];\n  /** Scrivi anche sul Logger strutturato. Default: true. */\n  logger?: boolean;\n}\n\nconst REDACTED = '[REDACTED]';\nconst TRUNCATED = '[TRUNCATED]';\n\nconst DEFAULT_REDACTED_KEYS = new Set([\n  'token',\n  'accesstoken',\n  'refreshtoken',\n  'idtoken',\n  'bearer',\n  'jwt',\n  'authorization',\n  'cookie',\n  'setcookie',\n  'password',\n  'passwordhash',\n  'hashedpassword',\n  'resettoken',\n  'secret',\n  'clientsecret',\n  'privatekey',\n  'apikey',\n  'csrf',\n  'csrftoken',\n]);\n\nconst MAX_STRING_LENGTH = 512;\nconst MAX_ARRAY_LENGTH = 50;\nconst MAX_OBJECT_KEYS = 100;\nconst MAX_DEPTH = 4;\nconst PURGE_INTERVAL_MS = 60 * 60 * 1000;\n\nlet sinks: AccessiAuditSink[] = [];\nlet redactedKeys = new Set(DEFAULT_REDACTED_KEYS);\nlet retentionDays: number | undefined;\nlet loggerEnabled = true;\nlet lastPurgeAt = 0;\n\nfunction normalizedKey(key: string): string {\n  return key.toLowerCase().replace(/[-_\\s]/g, '');\n}\n\n/**\n * Redige ricorsivamente token, segreti, cookie e header sensibili.\n *\n * Limita profondita, lunghezza delle stringhe e numero di elementi per evitare\n * che un payload applicativo finisca per intero nell'audit.\n */\nexport function redactAccessiAuditValue(value: unknown, depth = 0): unknown {\n  if (depth > MAX_DEPTH) return TRUNCATED;\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return value.length > MAX_STRING_LENGTH ? `${value.slice(0, MAX_STRING_LENGTH - 3)}...` : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'bigint') return value.toString();\n  if (value instanceof Date) return value.toISOString();\n  if (value instanceof Error) {\n    return { name: value.name, message: redactAccessiAuditValue(value.message, depth + 1) };\n  }\n  if (Array.isArray(value)) {\n    return value.slice(0, MAX_ARRAY_LENGTH).map((item) => redactAccessiAuditValue(item, depth + 1));\n  }\n  if (typeof value === 'object') {\n    const result: Record<string, unknown> = {};\n    for (const [key, entry] of Object.entries(value as Record<string, unknown>).slice(0, MAX_OBJECT_KEYS)) {\n      result[key] = redactedKeys.has(normalizedKey(key))\n        ? REDACTED\n        : redactAccessiAuditValue(entry, depth + 1);\n    }\n    return result;\n  }\n  return String(value);\n}\n\nfunction redactDetails(details: Record<string, unknown>): Record<string, unknown> {\n  return redactAccessiAuditValue(details) as Record<string, unknown>;\n}\n\nfunction reportSinkError(sink: AccessiAuditSink, error: unknown): void {\n  recordAccessiMetric('accessi_audit_sink_errors_total', 1, { sink: sink.name ?? 'unknown' });\n  try {\n    new Logger('AccessiAudit').error(\n      `Audit sink non disponibile${sink.name ? ` (${sink.name})` : ''}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  } catch {\n    // Il logging non deve mai interrompere l'operazione applicativa.\n  }\n}\n\nfunction writeToSink(sink: AccessiAuditSink, record: AccessiAuditRecord): void {\n  try {\n    const result = sink.write(record);\n    if (result && typeof (result as Promise<void>).catch === 'function') {\n      (result as Promise<void>).catch((error) => reportSinkError(sink, error));\n    }\n  } catch (error) {\n    reportSinkError(sink, error);\n  }\n}\n\nfunction maybePurge(): void {\n  if (!retentionDays || retentionDays <= 0) return;\n  const now = Date.now();\n  if (now - lastPurgeAt < PURGE_INTERVAL_MS) return;\n  lastPurgeAt = now;\n  const before = new Date(now - retentionDays * 24 * 60 * 60 * 1000);\n  for (const sink of sinks) {\n    if (typeof (sink as AccessiAuditQueryableSink).purge !== 'function') continue;\n    try {\n      const result = (sink as AccessiAuditQueryableSink).purge(before);\n      if (result && typeof (result as Promise<number>).catch === 'function') {\n        (result as Promise<number>).catch((error) => reportSinkError(sink, error));\n      }\n    } catch (error) {\n      reportSinkError(sink, error);\n    }\n  }\n}\n\n/**\n * Configura i sink di audit del processo.\n *\n * Chiamato da `AccessiModule.forRoot`. Le opzioni sono globali: un solo modulo\n * Accessi per processo e la configurazione consigliata.\n */\nexport function configureAccessiAudit(options: AccessiAuditOptions | undefined): void {\n  sinks = [];\n  redactedKeys = new Set(DEFAULT_REDACTED_KEYS);\n  retentionDays = undefined;\n  loggerEnabled = true;\n  lastPurgeAt = 0;\n\n  for (const key of options?.redact ?? []) redactedKeys.add(normalizedKey(key));\n  loggerEnabled = options?.logger !== false;\n  if (options?.enabled === false) return;\n\n  if (options?.store) sinks.push(options.store);\n  for (const sink of options?.sinks ?? []) {\n    if (!sinks.includes(sink)) sinks.push(sink);\n  }\n  const days = Number(options?.retentionDays);\n  if (Number.isFinite(days) && days > 0) retentionDays = days;\n}\n\n/** Ripristina la configurazione iniziale (logger attivo, nessun sink). */\nexport function resetAccessiAudit(): void {\n  configureAccessiAudit(undefined);\n}\n\n/** Sink interrogabile configurato, usato dagli endpoint amministrativi. */\nexport function getAccessiAuditStore(): AccessiAuditQueryableSink | undefined {\n  const configured = sinks.find((sink): sink is AccessiAuditQueryableSink =>\n    typeof (sink as AccessiAuditQueryableSink).query === 'function'\n    && typeof (sink as AccessiAuditQueryableSink).purge === 'function',\n  );\n  return configured;\n}\n\n/**\n * Registra un evento di sicurezza.\n *\n * Il record viene redatto prima di raggiungere logger e sink. Un sink guasto\n * non interrompe mai il flusso applicativo.\n */\nexport function auditAccessi(event: string, details: Record<string, unknown> = {}): void {\n  const record: AccessiAuditRecord = {\n    event,\n    timestamp: new Date().toISOString(),\n    ...redactDetails(details ?? {}),\n  };\n\n  if (loggerEnabled) {\n    try {\n      new Logger('AccessiAudit').warning(JSON.stringify(record));\n    } catch {\n      // Il logging non deve mai interrompere l'operazione applicativa.\n    }\n  }\n\n  for (const sink of sinks) writeToSink(sink, record);\n  maybePurge();\n}\n"]}