emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.80

package/dist/accessi-module/Controllers/AccessiConsoleController.js

@@ -0,0 +1,169 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AccessiConsoleController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiConsoleController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const securityHeaders_1 = require("../security/securityHeaders");
+const authCookies_1 = require("../security/authCookies");
+/** Serves the framework-free administrative console bundled with Accessi. API authorization remains on each API endpoint. */
+let AccessiConsoleController = AccessiConsoleController_1 = class AccessiConsoleController {
+    constructor(options) {
+        this.options = options;
+    }
+    indexHtml() {
+        var _a;
+        const baseUrl = (_a = this.options.consoleApiBaseUrl) === null || _a === void 0 ? void 0 : _a.replace(/\/+$/, '');
+        if (this.htmlCache && this.htmlCache.baseUrl === baseUrl)
+            return this.htmlCache.content;
+        const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
+        const bootstrap = [
+            baseUrl ? `window.__ACCESSI_API_BASE_URL__=${JSON.stringify(baseUrl)};` : '',
+            cookieConfig ? 'window.__ACCESSI_AUTH_COOKIE__=true;' : '',
+            cookieConfig ? `window.__ACCESSI_CSRF_COOKIE_NAME__=${JSON.stringify(cookieConfig.csrfTokenName)};` : '',
+            cookieConfig ? `window.__ACCESSI_CSRF_HEADER_NAME__=${JSON.stringify(cookieConfig.csrfHeaderName)};` : '',
+        ].join('');
+        const marker = bootstrap
+            ? `<script nonce="__ACCESSI_CSP_NONCE__">${bootstrap}</script>`
+            : '';
+        const content = (0, fs_1.readFileSync)((0, path_1.join)(__dirname, '..', 'Console', 'index.html'), 'utf8')
+            .replace('</head>', `${marker}</head>`);
+        this.htmlCache = { baseUrl, content };
+        return content;
+    }
+    /** Origini raggiungibili dalla console: l'API puo stare su un dominio diverso. */
+    consoleConnectSrc() {
+        var _a;
+        const baseUrl = (_a = this.options.consoleApiBaseUrl) === null || _a === void 0 ? void 0 : _a.replace(/\/+$/, '');
+        if (!baseUrl)
+            return [];
+        try {
+            const url = new URL(baseUrl);
+            return [`${url.protocol}//${url.host}`];
+        }
+        catch (_b) {
+            return [];
+        }
+    }
+    index(res) {
+        var _a;
+        const security = (0, securityHeaders_1.resolveAccessiSecurityHeaders)((_a = this.options.http) === null || _a === void 0 ? void 0 : _a.securityHeaders);
+        res.setHeader('Cache-Control', (security === null || security === void 0 ? void 0 : security.cacheControl) || 'no-store, max-age=0');
+        res.setHeader('Referrer-Policy', (security === null || security === void 0 ? void 0 : security.referrerPolicy) || 'no-referrer');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        if (security) {
+            if (security.frameOptions)
+                res.setHeader('X-Frame-Options', security.frameOptions);
+            if (security.permissionsPolicy)
+                res.setHeader('Permissions-Policy', security.permissionsPolicy);
+        }
+        // Il nonce cambia a ogni risposta: la shell HTML non puo essere cacheata con il valore incorporato.
+        const nonce = (security === null || security === void 0 ? void 0 : security.contentSecurityPolicy) ? (0, crypto_1.randomBytes)(16).toString('base64') : '';
+        if (security) {
+            (0, securityHeaders_1.applyAccessiContentSecurityPolicy)(res, security, 'console', Object.assign(Object.assign({}, (nonce ? { nonce } : {})), { connectSrc: this.consoleConnectSrc() }));
+        }
+        const html = this.indexHtml().split('__ACCESSI_CSP_NONCE__').join(nonce);
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        return res.send(html);
+    }
+    // Le route statiche vanno dichiarate prima di `:view/:sub`, che altrimenti
+    // catturerebbe `assets/<file>` e restituirebbe 404 per CSS e bundle.
+    asset(file, res) {
+        const allowed = new Set(['console.css', 'console.js']);
+        if (!allowed.has(file))
+            return res.status(404).end();
+        // Keep the SPA shell, styles and bundle on the same deployed revision.
+        res.setHeader('Cache-Control', 'no-store, max-age=0');
+        return res.sendFile((0, path_1.join)(__dirname, '..', 'Console', file));
+    }
+    /**
+     * Serves the SPA shell for the supported console sections, allowing direct
+     * navigation, bookmarks and browser back/forward without server-side state.
+     */
+    section(view, res) {
+        if (!AccessiConsoleController_1.allowedViews.has(view))
+            return res.status(404).end();
+        return this.index(res);
+    }
+    /** Serves the SPA shell for nested sections (menu, filtri, SSO). */
+    subsection(view, sub, res) {
+        if (!AccessiConsoleController_1.allowedViews.has(`${view}/${sub}`))
+            return res.status(404).end();
+        return this.index(res);
+    }
+};
+exports.AccessiConsoleController = AccessiConsoleController;
+/**
+ * Percorsi SPA ammessi. Deve restare allineato a `routeSegment` (e ai padri dei
+ * sottomenu) in Console/console.ts, altrimenti i deep link restituiscono 404.
+ */
+AccessiConsoleController.allowedViews = new Set([
+    'utenti',
+    'ruoli-e-grant',
+    'menu-e-gruppi',
+    'menu-e-gruppi/gruppi',
+    'menu-e-gruppi/menu',
+    'menu-e-gruppi/tipi-menu',
+    'filtri',
+    'filtri/utente',
+    'filtri/tipi',
+    'sso',
+    'sso/provider',
+    'sso/utenti',
+    'token-di-servizio',
+    'wiki',
+]);
+__decorate([
+    (0, common_1.Get)(),
+    __param(0, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], AccessiConsoleController.prototype, "index", null);
+__decorate([
+    (0, common_1.Get)('assets/:file'),
+    __param(0, (0, common_1.Param)('file')),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", void 0)
+], AccessiConsoleController.prototype, "asset", null);
+__decorate([
+    (0, common_1.Get)(':view'),
+    __param(0, (0, common_1.Param)('view')),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", void 0)
+], AccessiConsoleController.prototype, "section", null);
+__decorate([
+    (0, common_1.Get)(':view/:sub'),
+    __param(0, (0, common_1.Param)('view')),
+    __param(1, (0, common_1.Param)('sub')),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, Object]),
+    __metadata("design:returntype", void 0)
+], AccessiConsoleController.prototype, "subsection", null);
+exports.AccessiConsoleController = AccessiConsoleController = AccessiConsoleController_1 = __decorate([
+    (0, swagger_1.ApiExcludeController)(),
+    (0, common_1.Controller)('accessi/console'),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object])
+], AccessiConsoleController);
+//# sourceMappingURL=AccessiConsoleController.js.map

package/dist/accessi-module/Controllers/AccessiConsoleController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessiConsoleController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AccessiConsoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAqE;AACrE,6CAAuD;AAEvD,mCAAqC;AACrC,2BAAkC;AAClC,+BAA4B;AAE5B,iEAGqC;AACrC,yDAA0E;AAE1E,6HAA6H;AAGtH,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YAAwD,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAE3E,SAAS;;QACf,MAAM,OAAO,GAAG,MAAA,IAAI,CAAC,OAAO,CAAC,iBAAiB,0CAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAExF,MAAM,YAAY,GAAG,IAAA,6CAA+B,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG;YAChB,OAAO,CAAC,CAAC,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC5E,YAAY,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE;YAC1D,YAAY,CAAC,CAAC,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACxG,YAAY,CAAC,CAAC,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;SAC1G,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,MAAM,MAAM,GAAG,SAAS;YACtB,CAAC,CAAC,yCAAyC,SAAS,WAAW;YAC/D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC;aACjF,OAAO,CAAC,SAAS,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kFAAkF;IAC1E,iBAAiB;;QACvB,MAAM,OAAO,GAAG,MAAA,IAAI,CAAC,OAAO,CAAC,iBAAiB,0CAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAGD,KAAK,CAAQ,GAAa;;QACxB,MAAM,QAAQ,GAAG,IAAA,+CAA6B,EAAC,MAAA,IAAI,CAAC,OAAO,CAAC,IAAI,0CAAE,eAAe,CAAC,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,YAAY,KAAI,qBAAqB,CAAC,CAAC;QAChF,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,cAAc,KAAI,aAAa,CAAC,CAAC;QAC5E,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,YAAY;gBAAE,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YACnF,IAAI,QAAQ,CAAC,iBAAiB;gBAAE,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAClG,CAAC;QAED,oGAAoG;QACpG,MAAM,KAAK,GAAG,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,qBAAqB,EAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,QAAQ,EAAE,CAAC;YACb,IAAA,mDAAiC,EAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,kCACrD,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC3B,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,IACpC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAuBD,2EAA2E;IAC3E,qEAAqE;IAErE,KAAK,CAAgB,IAAY,EAAS,GAAa;QACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACrD,uEAAuE;QACvE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;OAGG;IAEH,OAAO,CAAgB,IAAY,EAAS,GAAa;QACvD,IAAI,CAAC,0BAAwB,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,oEAAoE;IAEpE,UAAU,CAAgB,IAAY,EAAgB,GAAW,EAAS,GAAa;QACrF,IAAI,CAAC,0BAAwB,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;;AA7GU,4DAAwB;AA8DnC;;;GAGG;AACqB,qCAAY,GAAG,IAAI,GAAG,CAAC;IAC7C,QAAQ;IACR,eAAe;IACf,eAAe;IACf,sBAAsB;IACtB,oBAAoB;IACpB,yBAAyB;IACzB,QAAQ;IACR,eAAe;IACf,aAAa;IACb,KAAK;IACL,cAAc;IACd,YAAY;IACZ,mBAAmB;IACnB,MAAM;CACP,CAAC,AAfkC,CAejC;AA3CH;IADC,IAAA,YAAG,GAAE;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;qDAsBX;AA0BD;IADC,IAAA,YAAG,EAAC,cAAc,CAAC;IACb,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;qDAMxC;AAOD;IADC,IAAA,YAAG,EAAC,OAAO,CAAC;IACJ,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAG1C;AAID;IADC,IAAA,YAAG,EAAC,YAAY,CAAC;IACN,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;IAAe,WAAA,IAAA,YAAG,GAAE,CAAA;;;;0DAGxE;mCA7GU,wBAAwB;IAFpC,IAAA,8BAAoB,GAAE;IACtB,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAIf,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAH3B,wBAAwB,CA8GpC","sourcesContent":["import { Controller, Get, Inject, Param, Res } from '@nestjs/common';\nimport { ApiExcludeController } from '@nestjs/swagger';\nimport { Response } from 'express';\nimport { randomBytes } from 'crypto';\nimport { readFileSync } from 'fs';\nimport { join } from 'path';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n  applyAccessiContentSecurityPolicy,\n  resolveAccessiSecurityHeaders,\n} from '../security/securityHeaders';\nimport { resolveAccessiAuthCookieOptions } from '../security/authCookies';\n\n/** Serves the framework-free administrative console bundled with Accessi. API authorization remains on each API endpoint. */\n@ApiExcludeController()\n@Controller('accessi/console')\nexport class AccessiConsoleController {\n  private htmlCache?: { baseUrl: string | undefined; content: string };\n\n  constructor(@Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions) {}\n\n  private indexHtml(): string {\n    const baseUrl = this.options.consoleApiBaseUrl?.replace(/\\/+$/, '');\n    if (this.htmlCache && this.htmlCache.baseUrl === baseUrl) return this.htmlCache.content;\n\n    const cookieConfig = resolveAccessiAuthCookieOptions(this.options);\n    const bootstrap = [\n      baseUrl ? `window.__ACCESSI_API_BASE_URL__=${JSON.stringify(baseUrl)};` : '',\n      cookieConfig ? 'window.__ACCESSI_AUTH_COOKIE__=true;' : '',\n      cookieConfig ? `window.__ACCESSI_CSRF_COOKIE_NAME__=${JSON.stringify(cookieConfig.csrfTokenName)};` : '',\n      cookieConfig ? `window.__ACCESSI_CSRF_HEADER_NAME__=${JSON.stringify(cookieConfig.csrfHeaderName)};` : '',\n    ].join('');\n    const marker = bootstrap\n      ? `<script nonce=\"__ACCESSI_CSP_NONCE__\">${bootstrap}</script>`\n      : '';\n    const content = readFileSync(join(__dirname, '..', 'Console', 'index.html'), 'utf8')\n      .replace('</head>', `${marker}</head>`);\n    this.htmlCache = { baseUrl, content };\n    return content;\n  }\n\n  /** Origini raggiungibili dalla console: l'API puo stare su un dominio diverso. */\n  private consoleConnectSrc(): string[] {\n    const baseUrl = this.options.consoleApiBaseUrl?.replace(/\\/+$/, '');\n    if (!baseUrl) return [];\n    try {\n      const url = new URL(baseUrl);\n      return [`${url.protocol}//${url.host}`];\n    } catch {\n      return [];\n    }\n  }\n\n  @Get()\n  index(@Res() res: Response) {\n    const security = resolveAccessiSecurityHeaders(this.options.http?.securityHeaders);\n    res.setHeader('Cache-Control', security?.cacheControl || 'no-store, max-age=0');\n    res.setHeader('Referrer-Policy', security?.referrerPolicy || 'no-referrer');\n    res.setHeader('X-Content-Type-Options', 'nosniff');\n    if (security) {\n      if (security.frameOptions) res.setHeader('X-Frame-Options', security.frameOptions);\n      if (security.permissionsPolicy) res.setHeader('Permissions-Policy', security.permissionsPolicy);\n    }\n\n    // Il nonce cambia a ogni risposta: la shell HTML non puo essere cacheata con il valore incorporato.\n    const nonce = security?.contentSecurityPolicy ? randomBytes(16).toString('base64') : '';\n    if (security) {\n      applyAccessiContentSecurityPolicy(res, security, 'console', {\n        ...(nonce ? { nonce } : {}),\n        connectSrc: this.consoleConnectSrc(),\n      });\n    }\n\n    const html = this.indexHtml().split('__ACCESSI_CSP_NONCE__').join(nonce);\n    res.setHeader('Content-Type', 'text/html; charset=utf-8');\n    return res.send(html);\n  }\n\n  /**\n   * Percorsi SPA ammessi. Deve restare allineato a `routeSegment` (e ai padri dei\n   * sottomenu) in Console/console.ts, altrimenti i deep link restituiscono 404.\n   */\n  private static readonly allowedViews = new Set([\n    'utenti',\n    'ruoli-e-grant',\n    'menu-e-gruppi',\n    'menu-e-gruppi/gruppi',\n    'menu-e-gruppi/menu',\n    'menu-e-gruppi/tipi-menu',\n    'filtri',\n    'filtri/utente',\n    'filtri/tipi',\n    'sso',\n    'sso/provider',\n    'sso/utenti',\n    'token-di-servizio',\n    'wiki',\n  ]);\n\n  // Le route statiche vanno dichiarate prima di `:view/:sub`, che altrimenti\n  // catturerebbe `assets/<file>` e restituirebbe 404 per CSS e bundle.\n  @Get('assets/:file')\n  asset(@Param('file') file: string, @Res() res: Response) {\n    const allowed = new Set(['console.css', 'console.js']);\n    if (!allowed.has(file)) return res.status(404).end();\n    // Keep the SPA shell, styles and bundle on the same deployed revision.\n    res.setHeader('Cache-Control', 'no-store, max-age=0');\n    return res.sendFile(join(__dirname, '..', 'Console', file));\n  }\n\n  /**\n   * Serves the SPA shell for the supported console sections, allowing direct\n   * navigation, bookmarks and browser back/forward without server-side state.\n   */\n  @Get(':view')\n  section(@Param('view') view: string, @Res() res: Response) {\n    if (!AccessiConsoleController.allowedViews.has(view)) return res.status(404).end();\n    return this.index(res);\n  }\n\n  /** Serves the SPA shell for nested sections (menu, filtri, SSO). */\n  @Get(':view/:sub')\n  subsection(@Param('view') view: string, @Param('sub') sub: string, @Res() res: Response) {\n    if (!AccessiConsoleController.allowedViews.has(`${view}/${sub}`)) return res.status(404).end();\n    return this.index(res);\n  }\n}\n"]}

package/dist/accessi-module/Controllers/AccessiIntrospectionController.d.ts

@@ -0,0 +1,17 @@
+import { Response } from 'express';
+import { IntrospectAccessiTokenRequest } from '../Dtos';
+import { PermissionService } from '../Services/PermissionService/PermissionService';
+import { AuthService } from '../Services/AuthService/AuthService';
+/**
+ * Endpoint service-to-service per validare un access token Accessi.
+ *
+ * Non e pensato per il browser: richiede un service token con scope
+ * `accessi:introspect`. I backend fratelli lo usano per autorizzare richieste
+ * senza accedere al database Accessi.
+ */
+export declare class AccessiIntrospectionController {
+    private readonly authService;
+    private readonly permissionService;
+    constructor(authService: AuthService, permissionService: PermissionService);
+    introspect(body: IntrospectAccessiTokenRequest, res: Response): Promise<Response>;
+}

package/dist/accessi-module/Controllers/AccessiIntrospectionController.js

@@ -0,0 +1,102 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var AccessiIntrospectionController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiIntrospectionController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const Utilities_1 = require("../../Utilities");
+const Dtos_1 = require("../Dtos");
+const PermissionService_1 = require("../Services/PermissionService/PermissionService");
+const AuthService_1 = require("../Services/AuthService/AuthService");
+const serviceTokenGuard_1 = require("../security/serviceTokenGuard");
+const metrics_1 = require("../observability/metrics");
+/**
+ * Endpoint service-to-service per validare un access token Accessi.
+ *
+ * Non e pensato per il browser: richiede un service token con scope
+ * `accessi:introspect`. I backend fratelli lo usano per autorizzare richieste
+ * senza accedere al database Accessi.
+ */
+let AccessiIntrospectionController = AccessiIntrospectionController_1 = class AccessiIntrospectionController {
+    constructor(authService, permissionService) {
+        this.authService = authService;
+        this.permissionService = permissionService;
+    }
+    introspect(body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const startedAt = Date.now();
+            try {
+                if (!(body === null || body === void 0 ? void 0 : body.token)) {
+                    (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'bad_request' });
+                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Token non fornito.', AccessiIntrospectionController_1.name, common_1.HttpStatus.BAD_REQUEST);
+                }
+                const introspection = yield this.authService.introspectAccessToken(body.token);
+                if (!introspection.active || !introspection.codiceUtente) {
+                    (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'inactive' });
+                    return Utilities_1.RestUtilities.sendBaseResponse(res, { active: false });
+                }
+                const user = (_a = introspection.payload) === null || _a === void 0 ? void 0 : _a.utente;
+                const grants = yield this.permissionService.getUserRolesAndGrants(introspection.codiceUtente);
+                (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'active' });
+                return Utilities_1.RestUtilities.sendBaseResponse(res, Object.assign(Object.assign({ active: true }, (user ? { user } : {})), { grants }));
+            }
+            catch (error) {
+                (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'error' });
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AccessiIntrospectionController_1.name);
+            }
+            finally {
+                (0, metrics_1.recordAccessiDuration)('accessi_introspection_duration_ms', Date.now() - startedAt);
+            }
+        });
+    }
+};
+exports.AccessiIntrospectionController = AccessiIntrospectionController;
+__decorate([
+    (0, common_1.Post)('introspect'),
+    (0, serviceTokenGuard_1.RequireServiceTokenScopes)('accessi:introspect'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Verifica un access token Accessi',
+        operationId: 'introspectAccessiToken',
+        description: 'Restituisce active=false per token invalido, scaduto o utente non piu abilitato. Richiede un service token con scope accessi:introspect.',
+    }),
+    (0, swagger_1.ApiBody)({ type: Dtos_1.IntrospectAccessiTokenRequest }),
+    (0, swagger_1.ApiOkResponse)({ description: 'Esito della verifica token.', type: Dtos_1.IntrospectAccessiTokenResponse }),
+    (0, swagger_1.ApiResponse)({ status: common_1.HttpStatus.UNAUTHORIZED, description: 'Service token mancante o non valido.', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: common_1.HttpStatus.FORBIDDEN, description: 'Scope accessi:introspect mancante.', type: Dtos_1.ErrorResponse }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Dtos_1.IntrospectAccessiTokenRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AccessiIntrospectionController.prototype, "introspect", null);
+exports.AccessiIntrospectionController = AccessiIntrospectionController = AccessiIntrospectionController_1 = __decorate([
+    (0, swagger_1.ApiTags)('ServiceToken'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('accessi/auth'),
+    (0, common_1.UseGuards)(serviceTokenGuard_1.ServiceTokenGuard),
+    __metadata("design:paramtypes", [AuthService_1.AuthService,
+        PermissionService_1.PermissionService])
+], AccessiIntrospectionController);
+//# sourceMappingURL=AccessiIntrospectionController.js.map

package/dist/accessi-module/Controllers/AccessiIntrospectionController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessiIntrospectionController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AccessiIntrospectionController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoF;AACpF,6CAOyB;AAEzB,+CAAgD;AAChD,kCAIiB;AACjB,uFAAoF;AACpF,qEAAkE;AAClE,qEAA6F;AAC7F,sDAAsF;AAEtF;;;;;;GAMG;AAKI,IAAM,8BAA8B,sCAApC,MAAM,8BAA8B;IACzC,YACmB,WAAwB,EACxB,iBAAoC;QADpC,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAcE,UAAU,CACN,IAAmC,EACpC,GAAa;;;YAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,EAAE,CAAC;oBACjB,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;oBACjF,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,oBAAoB,EACpB,gCAA8B,CAAC,IAAI,EACnC,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/E,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;oBACzD,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,GAAG,MAAC,aAAa,CAAC,OAA4C,0CAAE,MAAM,CAAC;gBACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC9F,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,gCACvC,MAAM,EAAE,IAAI,IACT,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACzB,MAAM,IACN,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC3E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gCAA8B,CAAC,IAAI,CAAC,CAAC;YACzF,CAAC;oBAAS,CAAC;gBACT,IAAA,+BAAqB,EAAC,mCAAmC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAvDY,wEAA8B;AAkBnC;IAZL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,6CAAyB,EAAC,oBAAoB,CAAC;IAC/C,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,wBAAwB;QACrC,WAAW,EACT,0IAA0I;KAC7I,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,oCAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,qCAA8B,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,mBAAU,CAAC,YAAY,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC1H,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAEnH,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADQ,oCAA6B;;gEAmC5C;yCAtDU,8BAA8B;IAJ1C,IAAA,iBAAO,EAAC,cAAc,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC1B,IAAA,kBAAS,EAAC,qCAAiB,CAAC;qCAGK,yBAAW;QACL,qCAAiB;GAH5C,8BAA8B,CAuD1C","sourcesContent":["import { Body, Controller, HttpStatus, Post, Res, UseGuards } from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport {\n  ErrorResponse,\n  IntrospectAccessiTokenRequest,\n  IntrospectAccessiTokenResponse,\n} from '../Dtos';\nimport { PermissionService } from '../Services/PermissionService/PermissionService';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { RequireServiceTokenScopes, ServiceTokenGuard } from '../security/serviceTokenGuard';\nimport { recordAccessiDuration, recordAccessiMetric } from '../observability/metrics';\n\n/**\n * Endpoint service-to-service per validare un access token Accessi.\n *\n * Non e pensato per il browser: richiede un service token con scope\n * `accessi:introspect`. I backend fratelli lo usano per autorizzare richieste\n * senza accedere al database Accessi.\n */\n@ApiTags('ServiceToken')\n@ApiBearerAuth()\n@Controller('accessi/auth')\n@UseGuards(ServiceTokenGuard)\nexport class AccessiIntrospectionController {\n  constructor(\n    private readonly authService: AuthService,\n    private readonly permissionService: PermissionService,\n  ) {}\n\n  @Post('introspect')\n  @RequireServiceTokenScopes('accessi:introspect')\n  @ApiOperation({\n    summary: 'Verifica un access token Accessi',\n    operationId: 'introspectAccessiToken',\n    description:\n      'Restituisce active=false per token invalido, scaduto o utente non piu abilitato. Richiede un service token con scope accessi:introspect.',\n  })\n  @ApiBody({ type: IntrospectAccessiTokenRequest })\n  @ApiOkResponse({ description: 'Esito della verifica token.', type: IntrospectAccessiTokenResponse })\n  @ApiResponse({ status: HttpStatus.UNAUTHORIZED, description: 'Service token mancante o non valido.', type: ErrorResponse })\n  @ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Scope accessi:introspect mancante.', type: ErrorResponse })\n  async introspect(\n    @Body() body: IntrospectAccessiTokenRequest,\n    @Res() res: Response,\n  ): Promise<Response> {\n    const startedAt = Date.now();\n    try {\n      if (!body?.token) {\n        recordAccessiMetric('accessi_introspection_total', 1, { result: 'bad_request' });\n        return RestUtilities.sendErrorMessage(\n          res,\n          'Token non fornito.',\n          AccessiIntrospectionController.name,\n          HttpStatus.BAD_REQUEST,\n        );\n      }\n\n      const introspection = await this.authService.introspectAccessToken(body.token);\n      if (!introspection.active || !introspection.codiceUtente) {\n        recordAccessiMetric('accessi_introspection_total', 1, { result: 'inactive' });\n        return RestUtilities.sendBaseResponse(res, { active: false });\n      }\n\n      const user = (introspection.payload as { utente?: unknown } | undefined)?.utente;\n      const grants = await this.permissionService.getUserRolesAndGrants(introspection.codiceUtente);\n      recordAccessiMetric('accessi_introspection_total', 1, { result: 'active' });\n      return RestUtilities.sendBaseResponse(res, {\n        active: true,\n        ...(user ? { user } : {}),\n        grants,\n      });\n    } catch (error) {\n      recordAccessiMetric('accessi_introspection_total', 1, { result: 'error' });\n      return RestUtilities.sendErrorMessage(res, error, AccessiIntrospectionController.name);\n    } finally {\n      recordAccessiDuration('accessi_introspection_duration_ms', Date.now() - startedAt);\n    }\n  }\n}\n"]}

package/dist/accessi-module/Controllers/AuthController.d.ts

@@ -1,14 +1,24 @@
+import { ResendTwoFactorRequest, VerifyTwoFactorRequest } from '../Dtos/TwoFactorDtos';
 import { Request, Response } from 'express';
-import { AccessiOptions } from '../AccessiModule';
-import { AuthService } from '../Services/AuthService/AuthService';
-import { LoginRequest } from '../Dtos';
 import { Logger } from '../../Logger';
+import type { AccessiOptions } from '../AccessiModule';
+import { BootstrapAdminRequest, ConfirmResetPasswordRequest, GetUserByTokenRequest, LoginRequest, RefreshTokenRequest, RevokeTokenRequest } from '../Dtos';
+import { AuthService } from '../Services/AuthService/AuthService';
+import { AdminBootstrapService } from '../Services/AdminBootstrapService/AdminBootstrapService';
 export declare class AuthController {
     private readonly authService;
+    private readonly adminBootstrapService;
     private readonly options;
     logger: Logger;
-    constructor(authService: AuthService, options: AccessiOptions);
-    resetPassword(request: Request, res: Response, token: string, newPassword: string): Promise<Response<any, Record<string, any>>>;
-    getUserByToken(request: Request, token: string, res: Response): Promise<Response<any, Record<string, any>>>;
+    constructor(authService: AuthService, adminBootstrapService: AdminBootstrapService, options: AccessiOptions);
+    resetPassword(request: Request, res: Response, token: string, body: ConfirmResetPasswordRequest): Promise<Response<any, Record<string, any>>>;
+    getUserByToken(request: Request, body: GetUserByTokenRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    revokeSessions(request: Request, res: Response): Promise<Response<any, Record<string, any>>>;
+    revokeToken(request: Request, body: RevokeTokenRequest, res: Response): Promise<Response<any, Record<string, any>>>;
     login(request: Request, loginRequest: LoginRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    refresh(request: Request, body: RefreshTokenRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    verifyTwoFactor(request: Request, body: VerifyTwoFactorRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    resendTwoFactor(request: Request, body: ResendTwoFactorRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    bootstrapAdmin(request: Request, body: BootstrapAdminRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    adminBootstrapStatus(res: Response): Promise<Response<any, Record<string, any>>>;
 }