npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.8 → 2.0.0-dev.80 - Mend

emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.80

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (914) hide show

package/dist/accessi-module/middleware/accessiRequirements.d.ts CHANGED Viewed

@@ -1,42 +1,57 @@
 import { Request } from "express";
+/** Grant effettivo letto da Accessi. Il confronto usa `tipoAbilitazione >= minPermissionLevel`. */
 export type AccessiGrant = {
     codiceMenu: string;
     tipoAbilitazione?: number;
 };
+/** Risultato memoizzato durante una singola autorizzazione. Non modificarlo nel custom handler. */
 export type GrantsResult = {
     grants?: AccessiGrant[];
     [key: string]: unknown;
 };
+/** Richiede l'accesso a un menu con almeno il livello indicato. Valori convenzionali: 10 lettura, 20 scrittura. */
 export type AccessiPermissionRequirement = {
     type: "permission";
     menuCode: string;
     minPermissionLevel: number;
 };
+/** Tutti i requisiti figli devono essere soddisfatti. Una lista vuota e una configurazione non valida. */
 export type AccessiAllRequirement = {
     type: "and";
     requirements: AccessiRequirementNode[];
 };
+/** Almeno un requisito figlio deve essere soddisfatto. Una lista vuota e una configurazione non valida. */
 export type AccessiAnyRequirement = {
     type: "or";
     requirements: AccessiRequirementNode[];
 };
+/** Nega il risultato del requisito figlio. Usarlo con cautela per non creare policy difficili da verificare. */
 export type AccessiNotRequirement = {
     type: "not";
     requirement: AccessiRequirementNode;
 };
+/** Delega una condizione applicativa a un handler registrato dal backend. */
 export type AccessiCustomRequirement = {
     type: "custom";
     key: string;
     payload?: unknown;
 };
+/** Nodo composabile dell'albero di autorizzazione valutato da `authorizeAccessi`. */
 export type AccessiRequirementNode = AccessiPermissionRequirement | AccessiAllRequirement | AccessiAnyRequirement | AccessiNotRequirement | AccessiCustomRequirement;
+/** Contesto in sola lettura consegnato a un requisito personalizzato. */
 export type AccessiCustomRequirementContext = {
     req: Request;
-    decodedToken: any;
+    decodedToken: Record<string, unknown>;
     userCode: number;
     getGrantsResult: () => Promise<GrantsResult>;
 };
+/** Handler applicativo per `accessiRequirement.custom`; `false` nega la richiesta, un errore produce 500. */
 export type AccessiCustomRequirementHandler = (context: AccessiCustomRequirementContext, payload?: unknown) => boolean | Promise<boolean>;
+/**
+ * Policy passata a `authorizeAccessi`.
+ * `requirements` e la forma compatibile storica ed equivale a un AND; `requirementTree`
+ * permette policy annidate e ha precedenza quando entrambi sono presenti.
+ */
 export type AccessiAuthorizationOptions = {
     requirements?: {
         menuCode: string;
@@ -45,10 +60,12 @@ export type AccessiAuthorizationOptions = {
     requirementTree?: AccessiRequirementNode;
     customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;
 };
+/** Errore di configurazione di una policy, distinto dal normale diniego 403. */
 export declare class RequirementEvaluationError extends Error {
     readonly code: string;
     constructor(code: string, message: string);
 }
+/** Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. */
 export declare const accessiRequirement: {
     permission: (menuCode: string, minPermissionLevel: number) => AccessiPermissionRequirement;
     and: (...requirements: AccessiRequirementNode[]) => AccessiAllRequirement;
@@ -56,5 +73,10 @@ export declare const accessiRequirement: {
     not: (requirement: AccessiRequirementNode) => AccessiNotRequirement;
     custom: (key: string, payload?: unknown) => AccessiCustomRequirement;
 };
+/** Normalizza la forma compatibile `requirements` nell'albero interno. */
 export declare function buildRequirementTree(options?: AccessiAuthorizationOptions): AccessiRequirementNode | undefined;
+/**
+ * Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.
+ * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.
+ */
 export declare function evaluateRequirement(requirement: AccessiRequirementNode, context: AccessiCustomRequirementContext, options?: AccessiAuthorizationOptions): Promise<boolean>;

package/dist/accessi-module/middleware/accessiRequirements.js CHANGED Viewed

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.accessiRequirement = exports.RequirementEvaluationError = void 0;
 exports.buildRequirementTree = buildRequirementTree;
 exports.evaluateRequirement = evaluateRequirement;
+/** Errore di configurazione di una policy, distinto dal normale diniego 403. */
 class RequirementEvaluationError extends Error {
     constructor(code, message) {
         super(message);
@@ -23,6 +24,7 @@ exports.RequirementEvaluationError = RequirementEvaluationError;
 function requirementError(code, message) {
     return new RequirementEvaluationError(code, message);
 }
+/** Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. */
 exports.accessiRequirement = {
     permission: (menuCode, minPermissionLevel) => ({
         type: "permission",
@@ -47,6 +49,7 @@ exports.accessiRequirement = {
         payload,
     }),
 };
+/** Normalizza la forma compatibile `requirements` nell'albero interno. */
 function buildRequirementTree(options) {
     var _a;
     if (options === null || options === void 0 ? void 0 : options.requirementTree)
@@ -57,6 +60,10 @@ function buildRequirementTree(options) {
     const nodes = requirements.map((requirement) => exports.accessiRequirement.permission(requirement.menuCode, requirement.minPermissionLevel));
     return exports.accessiRequirement.and(...nodes);
 }
+/**
+ * Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.
+ * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.
+ */
 function evaluateRequirement(requirement, context, options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;

package/dist/accessi-module/middleware/accessiRequirements.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"accessiRequirements.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/accessiRequirements.ts"],"names":[],"mappings":";;;;;;;;;;;;AAuGA,oDAgBC;AAED,kDAwDC;AAjHD,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAEY,QAAA,kBAAkB,GAAG;IAChC,UAAU,EAAE,CACV,QAAgB,EAChB,kBAA0B,EACI,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,kBAAkB;KACnB,CAAC;IACF,GAAG,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,KAAK;QACX,YAAY;KACb,CAAC;IACF,EAAE,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,IAAI;QACV,YAAY;KACb,CAAC;IACF,GAAG,EAAE,CAAC,WAAmC,EAAyB,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,KAAK;QACX,WAAW;KACZ,CAAC;IACF,MAAM,EAAE,CAAC,GAAW,EAAE,OAAiB,EAA4B,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,OAAO;KACR,CAAC;CACH,CAAC;AAEF,SAAgB,oBAAoB,CAClC,OAAqC;;IAErC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC;IAE7D,MAAM,YAAY,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE,CAAC;IACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,KAAK,GAA6B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACvE,0BAAkB,CAAC,UAAU,CAC3B,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,kBAAkB,CAC/B,CACF,CAAC;IAEF,OAAO,0BAAkB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,SAAsB,mBAAmB,CACvC,WAAmC,EACnC,OAAwC,EACxC,OAAqC;;;QAErC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAA,YAAY,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE;;oBACR,OAAA,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ;wBACxC,MAAM,CAAC,MAAA,KAAK,CAAC,gBAAgB,mCAAI,CAAC,CAAC,IAAI,WAAW,CAAC,kBAAkB,CAAA;iBAAA,CACxE,CAAC;YACJ,CAAC;YACD,KAAK,KAAK;gBACR,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,6DAA6D,CAC9D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAC1E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,KAAK,IAAI;gBACP,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,4DAA4D,CAC7D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtE,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,KAAK,KAAK;gBACR,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,yBAAyB,mCAAI,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,WAAW,CAAC,GAAG,aAAa,CAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD;gBACE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,CAChC,CAAC;QACN,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { Request } from \"express\";\r\n\r\nexport type AccessiGrant = {\r\n codiceMenu: string;\r\n tipoAbilitazione?: number;\r\n};\r\n\r\nexport type GrantsResult = {\r\n grants?: AccessiGrant[];\r\n [key: string]: unknown;\r\n};\r\n\r\nexport type AccessiPermissionRequirement = {\r\n type: \"permission\";\r\n menuCode: string;\r\n minPermissionLevel: number;\r\n};\r\n\r\nexport type AccessiAllRequirement = {\r\n type: \"and\";\r\n requirements: AccessiRequirementNode[];\r\n};\r\n\r\nexport type AccessiAnyRequirement = {\r\n type: \"or\";\r\n requirements: AccessiRequirementNode[];\r\n};\r\n\r\nexport type AccessiNotRequirement = {\r\n type: \"not\";\r\n requirement: AccessiRequirementNode;\r\n};\r\n\r\nexport type AccessiCustomRequirement = {\r\n type: \"custom\";\r\n key: string;\r\n payload?: unknown;\r\n};\r\n\r\nexport type AccessiRequirementNode =\r\n \| AccessiPermissionRequirement\r\n \| AccessiAllRequirement\r\n \| AccessiAnyRequirement\r\n \| AccessiNotRequirement\r\n \| AccessiCustomRequirement;\r\n\r\nexport type AccessiCustomRequirementContext = {\r\n req: Request;\r\n decodedToken: any;\r\n userCode: number;\r\n getGrantsResult: () => Promise<GrantsResult>;\r\n};\r\n\r\nexport type AccessiCustomRequirementHandler = (\r\n context: AccessiCustomRequirementContext,\r\n payload?: unknown\r\n) => boolean \| Promise<boolean>;\r\n\r\nexport type AccessiAuthorizationOptions = {\r\n requirements?: { menuCode: string; minPermissionLevel: number }[];\r\n requirementTree?: AccessiRequirementNode;\r\n customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;\r\n};\r\n\r\nexport class RequirementEvaluationError extends Error {\r\n constructor(public readonly code: string, message: string) {\r\n super(message);\r\n this.name = \"RequirementEvaluationError\";\r\n }\r\n}\r\n\r\nfunction requirementError(code: string, message: string): RequirementEvaluationError {\r\n return new RequirementEvaluationError(code, message);\r\n}\r\n\r\nexport const accessiRequirement = {\r\n permission: (\r\n menuCode: string,\r\n minPermissionLevel: number\r\n ): AccessiPermissionRequirement => ({\r\n type: \"permission\",\r\n menuCode,\r\n minPermissionLevel,\r\n }),\r\n and: (...requirements: AccessiRequirementNode[]): AccessiAllRequirement => ({\r\n type: \"and\",\r\n requirements,\r\n }),\r\n or: (...requirements: AccessiRequirementNode[]): AccessiAnyRequirement => ({\r\n type: \"or\",\r\n requirements,\r\n }),\r\n not: (requirement: AccessiRequirementNode): AccessiNotRequirement => ({\r\n type: \"not\",\r\n requirement,\r\n }),\r\n custom: (key: string, payload?: unknown): AccessiCustomRequirement => ({\r\n type: \"custom\",\r\n key,\r\n payload,\r\n }),\r\n};\r\n\r\nexport function buildRequirementTree(\r\n options?: AccessiAuthorizationOptions\r\n): AccessiRequirementNode \| undefined {\r\n if (options?.requirementTree) return options.requirementTree;\r\n\r\n const requirements = options?.requirements ?? [];\r\n if (requirements.length === 0) return undefined;\r\n\r\n const nodes: AccessiRequirementNode[] = requirements.map((requirement) =>\r\n accessiRequirement.permission(\r\n requirement.menuCode,\r\n requirement.minPermissionLevel\r\n )\r\n );\r\n\r\n return accessiRequirement.and(...nodes);\r\n}\r\n\r\nexport async function evaluateRequirement(\r\n requirement: AccessiRequirementNode,\r\n context: AccessiCustomRequirementContext,\r\n options?: AccessiAuthorizationOptions\r\n): Promise<boolean> {\r\n switch (requirement.type) {\r\n case \"permission\": {\r\n const grantsResult = await context.getGrantsResult();\r\n const grants = grantsResult.grants ?? [];\r\n return grants.some(\r\n (grant) =>\r\n grant.codiceMenu == requirement.menuCode &&\r\n Number(grant.tipoAbilitazione ?? 0) >= requirement.minPermissionLevel\r\n );\r\n }\r\n case \"and\":\r\n if (!requirement.requirements \|\| requirement.requirements.length === 0) {\r\n throw requirementError(\r\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n \"AND requirement must contain at least one child requirement\"\r\n );\r\n }\r\n for (const child of requirement.requirements) {\r\n if (!(await evaluateRequirement(child, context, options))) return false;\r\n }\r\n return true;\r\n case \"or\":\r\n if (!requirement.requirements \|\| requirement.requirements.length === 0) {\r\n throw requirementError(\r\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n \"OR requirement must contain at least one child requirement\"\r\n );\r\n }\r\n for (const child of requirement.requirements) {\r\n if (await evaluateRequirement(child, context, options)) return true;\r\n }\r\n return false;\r\n case \"not\":\r\n return !(await evaluateRequirement(requirement.requirement, context, options));\r\n case \"custom\": {\r\n const handlers = options?.customRequirementHandlers ?? {};\r\n const handler = handlers[requirement.key];\r\n if (!handler) {\r\n throw requirementError(\r\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n `Custom requirement handler \"${requirement.key}\" not found`\r\n );\r\n }\r\n return Boolean(await handler(context, requirement.payload));\r\n }\r\n default:\r\n throw requirementError(\r\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n \"Unknown requirement node type\"\r\n );\r\n }\r\n}\r\n"]}
1	+ {"version":3,"file":"accessiRequirements.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/accessiRequirements.ts"],"names":[],"mappings":";;;;;;;;;;;;AAyHA,oDAgBC;AAMD,kDAwDC;AAxHD,gFAAgF;AAChF,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,yGAAyG;AAC5F,QAAA,kBAAkB,GAAG;IAChC,UAAU,EAAE,CACV,QAAgB,EAChB,kBAA0B,EACI,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,kBAAkB;KACnB,CAAC;IACF,GAAG,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,KAAK;QACX,YAAY;KACb,CAAC;IACF,EAAE,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,IAAI;QACV,YAAY;KACb,CAAC;IACF,GAAG,EAAE,CAAC,WAAmC,EAAyB,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,KAAK;QACX,WAAW;KACZ,CAAC;IACF,MAAM,EAAE,CAAC,GAAW,EAAE,OAAiB,EAA4B,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,OAAO;KACR,CAAC;CACH,CAAC;AAEF,0EAA0E;AAC1E,SAAgB,oBAAoB,CAClC,OAAqC;;IAErC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC;IAE7D,MAAM,YAAY,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE,CAAC;IACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,KAAK,GAA6B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACvE,0BAAkB,CAAC,UAAU,CAC3B,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,kBAAkB,CAC/B,CACF,CAAC;IAEF,OAAO,0BAAkB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAsB,mBAAmB,CACvC,WAAmC,EACnC,OAAwC,EACxC,OAAqC;;;QAErC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAA,YAAY,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE;;oBACR,OAAA,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ;wBACxC,MAAM,CAAC,MAAA,KAAK,CAAC,gBAAgB,mCAAI,CAAC,CAAC,IAAI,WAAW,CAAC,kBAAkB,CAAA;iBAAA,CACxE,CAAC;YACJ,CAAC;YACD,KAAK,KAAK;gBACR,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,6DAA6D,CAC9D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAC1E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,KAAK,IAAI;gBACP,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,4DAA4D,CAC7D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtE,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,KAAK,KAAK;gBACR,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,yBAAyB,mCAAI,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,WAAW,CAAC,GAAG,aAAa,CAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD;gBACE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,CAChC,CAAC;QACN,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { Request } from \"express\";\n\n/** Grant effettivo letto da Accessi. Il confronto usa `tipoAbilitazione >= minPermissionLevel`. /\nexport type AccessiGrant = {\n codiceMenu: string;\n tipoAbilitazione?: number;\n};\n\n/* Risultato memoizzato durante una singola autorizzazione. Non modificarlo nel custom handler. /\nexport type GrantsResult = {\n grants?: AccessiGrant[];\n [key: string]: unknown;\n};\n\n/* Richiede l'accesso a un menu con almeno il livello indicato. Valori convenzionali: 10 lettura, 20 scrittura. /\nexport type AccessiPermissionRequirement = {\n type: \"permission\";\n menuCode: string;\n minPermissionLevel: number;\n};\n\n/* Tutti i requisiti figli devono essere soddisfatti. Una lista vuota e una configurazione non valida. /\nexport type AccessiAllRequirement = {\n type: \"and\";\n requirements: AccessiRequirementNode[];\n};\n\n/* Almeno un requisito figlio deve essere soddisfatto. Una lista vuota e una configurazione non valida. /\nexport type AccessiAnyRequirement = {\n type: \"or\";\n requirements: AccessiRequirementNode[];\n};\n\n/* Nega il risultato del requisito figlio. Usarlo con cautela per non creare policy difficili da verificare. /\nexport type AccessiNotRequirement = {\n type: \"not\";\n requirement: AccessiRequirementNode;\n};\n\n/* Delega una condizione applicativa a un handler registrato dal backend. /\nexport type AccessiCustomRequirement = {\n type: \"custom\";\n key: string;\n payload?: unknown;\n};\n\n/* Nodo composabile dell'albero di autorizzazione valutato da `authorizeAccessi`. /\nexport type AccessiRequirementNode =\n \| AccessiPermissionRequirement\n \| AccessiAllRequirement\n \| AccessiAnyRequirement\n \| AccessiNotRequirement\n \| AccessiCustomRequirement;\n\n/* Contesto in sola lettura consegnato a un requisito personalizzato. /\nexport type AccessiCustomRequirementContext = {\n req: Request;\n decodedToken: Record<string, unknown>;\n userCode: number;\n getGrantsResult: () => Promise<GrantsResult>;\n};\n\n/* Handler applicativo per `accessiRequirement.custom`; `false` nega la richiesta, un errore produce 500. /\nexport type AccessiCustomRequirementHandler = (\n context: AccessiCustomRequirementContext,\n payload?: unknown\n) => boolean \| Promise<boolean>;\n\n/\n Policy passata a `authorizeAccessi`.\n * `requirements` e la forma compatibile storica ed equivale a un AND; `requirementTree`\n * permette policy annidate e ha precedenza quando entrambi sono presenti.\n /\nexport type AccessiAuthorizationOptions = {\n requirements?: { menuCode: string; minPermissionLevel: number }[];\n requirementTree?: AccessiRequirementNode;\n customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;\n};\n\n/* Errore di configurazione di una policy, distinto dal normale diniego 403. /\nexport class RequirementEvaluationError extends Error {\n constructor(public readonly code: string, message: string) {\n super(message);\n this.name = \"RequirementEvaluationError\";\n }\n}\n\nfunction requirementError(code: string, message: string): RequirementEvaluationError {\n return new RequirementEvaluationError(code, message);\n}\n\n/* Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. /\nexport const accessiRequirement = {\n permission: (\n menuCode: string,\n minPermissionLevel: number\n ): AccessiPermissionRequirement => ({\n type: \"permission\",\n menuCode,\n minPermissionLevel,\n }),\n and: (...requirements: AccessiRequirementNode[]): AccessiAllRequirement => ({\n type: \"and\",\n requirements,\n }),\n or: (...requirements: AccessiRequirementNode[]): AccessiAnyRequirement => ({\n type: \"or\",\n requirements,\n }),\n not: (requirement: AccessiRequirementNode): AccessiNotRequirement => ({\n type: \"not\",\n requirement,\n }),\n custom: (key: string, payload?: unknown): AccessiCustomRequirement => ({\n type: \"custom\",\n key,\n payload,\n }),\n};\n\n/* Normalizza la forma compatibile `requirements` nell'albero interno. /\nexport function buildRequirementTree(\n options?: AccessiAuthorizationOptions\n): AccessiRequirementNode \| undefined {\n if (options?.requirementTree) return options.requirementTree;\n\n const requirements = options?.requirements ?? [];\n if (requirements.length === 0) return undefined;\n\n const nodes: AccessiRequirementNode[] = requirements.map((requirement) =>\n accessiRequirement.permission(\n requirement.menuCode,\n requirement.minPermissionLevel\n )\n );\n\n return accessiRequirement.and(...nodes);\n}\n\n/\n Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.\n * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.\n */\nexport async function evaluateRequirement(\n requirement: AccessiRequirementNode,\n context: AccessiCustomRequirementContext,\n options?: AccessiAuthorizationOptions\n): Promise<boolean> {\n switch (requirement.type) {\n case \"permission\": {\n const grantsResult = await context.getGrantsResult();\n const grants = grantsResult.grants ?? [];\n return grants.some(\n (grant) =>\n grant.codiceMenu == requirement.menuCode &&\n Number(grant.tipoAbilitazione ?? 0) >= requirement.minPermissionLevel\n );\n }\n case \"and\":\n if (!requirement.requirements \|\| requirement.requirements.length === 0) {\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n \"AND requirement must contain at least one child requirement\"\n );\n }\n for (const child of requirement.requirements) {\n if (!(await evaluateRequirement(child, context, options))) return false;\n }\n return true;\n case \"or\":\n if (!requirement.requirements \|\| requirement.requirements.length === 0) {\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n \"OR requirement must contain at least one child requirement\"\n );\n }\n for (const child of requirement.requirements) {\n if (await evaluateRequirement(child, context, options)) return true;\n }\n return false;\n case \"not\":\n return !(await evaluateRequirement(requirement.requirement, context, options));\n case \"custom\": {\n const handlers = options?.customRequirementHandlers ?? {};\n const handler = handlers[requirement.key];\n if (!handler) {\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n `Custom requirement handler \"${requirement.key}\" not found`\n );\n }\n return Boolean(await handler(context, requirement.payload));\n }\n default:\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n \"Unknown requirement node type\"\n );\n }\n}\n"]}

package/dist/accessi-module/middleware/authenticateGen.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { NextFunction, Request, Response } from "express";
-import { AccessiOptions } from "../AccessiModule";
+import type { AccessiOptions } from "../AccessiModule";
 import { PermissionService } from "../Services/PermissionService/PermissionService";
 import { UserService } from "../Services/UserService/UserService";
 import { AccessiAuthorizationOptions } from "./accessiRequirements";
@@ -8,10 +8,25 @@ export declare class AuthenticateGenService {
     private readonly permissionService;
     private readonly userService;
     constructor(accessiOptions: AccessiOptions, permissionService: PermissionService, userService: UserService);
+    /**
+     * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.
+     * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.
+     */
     authorize(req: Request, res: Response, next: NextFunction, options?: AccessiAuthorizationOptions): Promise<void | Response<any, Record<string, any>>>;
 }
+/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */
 export declare function beginAccessiAuthInitialization(): void;
+/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */
 export declare function setAccessiAuthService(service: AuthenticateGenService): void;
+/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */
 export declare function failAccessiAuthInitialization(error: unknown): void;
+/**
+ * Middleware Express pubblico di Accessi.
+ *
+ * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente
+ * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente
+ * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.
+ */
 export declare function authorizeAccessi(req: Request, res: Response, next: NextFunction, options?: AccessiAuthorizationOptions): Promise<void | Response<any, Record<string, any>>>;
+/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */
 export declare const authenticateGen: typeof authorizeAccessi;

package/dist/accessi-module/middleware/authenticateGen.js CHANGED Viewed

@@ -1,43 +1,10 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
@@ -59,13 +26,14 @@ exports.beginAccessiAuthInitialization = beginAccessiAuthInitialization;
 exports.setAccessiAuthService = setAccessiAuthService;
 exports.failAccessiAuthInitialization = failAccessiAuthInitialization;
 exports.authorizeAccessi = authorizeAccessi;
-const jwt = __importStar(require("jsonwebtoken"));
 const common_1 = require("@nestjs/common");
 const PermissionService_1 = require("../Services/PermissionService/PermissionService");
 const UserService_1 = require("../Services/UserService/UserService");
 const Logger_1 = require("../../Logger");
 const accessiRequirements_1 = require("./accessiRequirements");
 const authenticatedToken_1 = require("../security/authenticatedToken");
+const jwtTokenOptions_1 = require("../security/jwtTokenOptions");
+const sessionRevocation_1 = require("../security/sessionRevocation");
 const logger = new Logger_1.Logger("AuthenticateGen");
 const ACCESSI_AUTH_SERVICE_LOCALS_KEY = "accessiAuthService";
 const ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for("emilsoftware.accessiAuthService");
@@ -112,35 +80,58 @@ function logAuthFailure(req, authErr) {
     else
         logger.warning(message);
 }
+/** Sends the documented Accessi error contract from Express middleware. */
+function sendAuthenticationError(res, authErr) {
+    const message = authErr.status === 403
+        ? 'Operazione non autorizzata.'
+        : authErr.status >= 500
+            ? 'Errore interno del modulo Accessi.'
+            : 'Autenticazione non valida o scaduta.';
+    return res.status(authErr.status).json({
+        severity: 'error',
+        status: authErr.status,
+        statusCode: 2,
+        code: authErr.code,
+        // Kept for callers of older versions which already inspected `error`.
+        error: authErr.code,
+        message,
+    });
+}
 function authorizeWithDependencies(req, res, next, options, accessiOptions, permissionService, userService) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
+        const authenticatedRequest = req;
         try {
             const authHeader = req.headers.authorization;
             if (!authHeader) {
                 throw authError(401, "AUTH_HEADER_MISSING", "Authorization header not found");
             }
-            const token = authHeader.split(" ")[1];
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(authHeader);
             if (!token) {
                 throw authError(401, "AUTH_TOKEN_MISSING", "Token not found in Authorization header");
             }
-            const secret = (_b = (_a = accessiOptions === null || accessiOptions === void 0 ? void 0 : accessiOptions.jwtOptions) === null || _a === void 0 ? void 0 : _a.secret) !== null && _b !== void 0 ? _b : process.env.ACC_JWT_SECRET;
-            if (!secret) {
-                throw authError(500, "AUTH_JWT_SECRET_MISSING", "JWT secret not configured");
+            let verification;
+            try {
+                verification = (0, jwtTokenOptions_1.getAccessiAccessTokenVerificationConfig)(accessiOptions);
+            }
+            catch (_a) {
+                throw authError(500, "AUTH_JWT_SECRET_MISSING", "JWT signing key not configured");
             }
             let decoded;
             try {
-                decoded = jwt.verify(token, secret);
+                decoded = (0, jwtTokenOptions_1.verifyAccessiJwt)(token, verification);
             }
-            catch (_c) {
+            catch (_b) {
                 throw authError(401, "AUTH_TOKEN_INVALID", "Invalid JWT token");
             }
             const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(decoded);
             if (!codiceUtente) {
                 throw authError(401, "AUTH_USER_CODE_MISSING", "codiceUtente not found in token payload");
             }
+            if (yield (0, sessionRevocation_1.isAccessiTokenRevoked)(accessiOptions, decoded, codiceUtente)) {
+                throw authError(401, "AUTH_TOKEN_REVOKED", "Session revoked");
+            }
             const currentUser = yield userService.getAuthenticatedUserSnapshot(codiceUtente);
-            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(decoded, currentUser)) {
                 throw authError(401, "AUTH_USER_DISABLED", "User is no longer authorized");
             }
             const authenticatedPayload = (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(decoded, currentUser);
@@ -166,23 +157,16 @@ function authorizeWithDependencies(req, res, next, options, accessiOptions, perm
                 if (!hasPermissions) {
                     throw authError(403, "AUTH_INSUFFICIENT_PERMISSIONS", "User does not have required permissions");
                 }
-                req.userGrants = yield getGrantsResult();
+                authenticatedRequest.userGrants = yield getGrantsResult();
             }
-            req.user = authenticatedPayload;
-            req.data = authenticatedPayload;
+            authenticatedRequest.user = authenticatedPayload;
+            authenticatedRequest.data = authenticatedPayload;
             return next();
         }
         catch (error) {
             const authErr = normalizeAuthError(error);
             logAuthFailure(req, authErr);
-            const publicMessage = authErr.status === 403
-                ? "Forbidden"
-                : authErr.status >= 500
-                    ? "Internal server error"
-                    : "Unauthorized";
-            return res
-                .status(authErr.status)
-                .json({ message: publicMessage, error: authErr.message, code: authErr.code });
+            return sendAuthenticationError(res, authErr);
         }
     });
 }
@@ -192,6 +176,10 @@ let AuthenticateGenService = class AuthenticateGenService {
         this.permissionService = permissionService;
         this.userService = userService;
     }
+    /**
+     * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.
+     * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.
+     */
     authorize(req, res, next, options) {
         return __awaiter(this, void 0, void 0, function* () {
             return authorizeWithDependencies(req, res, next, options, this.accessiOptions, this.permissionService, this.userService);
@@ -200,7 +188,9 @@ let AuthenticateGenService = class AuthenticateGenService {
 };
 exports.AuthenticateGenService = AuthenticateGenService;
 exports.AuthenticateGenService = AuthenticateGenService = __decorate([
-    (0, common_1.Injectable)(),
+    (0, common_1.Injectable)()
+    /** Nest service behind the Express-compatible `authorizeAccessi` middleware. */
+    ,
     __param(0, (0, common_1.Inject)("ACCESSI_OPTIONS")),
     __metadata("design:paramtypes", [Object, PermissionService_1.PermissionService,
         UserService_1.UserService])
@@ -220,11 +210,13 @@ function isAuthenticateGenService(value) {
     return Boolean(value &&
         typeof value.authorize === "function");
 }
+/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */
 function beginAccessiAuthInitialization() {
     if (!authServiceBootstrapDeferred) {
         authServiceBootstrapDeferred = createDeferred();
     }
 }
+/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */
 function setAccessiAuthService(service) {
     authenticateGenServiceRef = service;
     globalThis[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;
@@ -233,6 +225,7 @@ function setAccessiAuthService(service) {
         authServiceBootstrapDeferred = null;
     }
 }
+/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */
 function failAccessiAuthInitialization(error) {
     if (authServiceBootstrapDeferred) {
         authServiceBootstrapDeferred.reject(error);
@@ -282,26 +275,41 @@ function resolveAccessiAuthService(req) {
         return getAccessiAuthServiceFromRequest(req);
     });
 }
+/**
+ * Middleware Express pubblico di Accessi.
+ *
+ * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente
+ * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente
+ * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.
+ */
 function authorizeAccessi(req, res, next, options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         const authService = yield resolveAccessiAuthService(req);
         if (!authService) {
             const status = authServiceBootstrapDeferred ? 503 : 500;
-            const message = authServiceBootstrapDeferred
-                ? "Accessi authentication service is still initializing"
-                : "Accessi authentication service not initialized";
+            const code = authServiceBootstrapDeferred
+                ? 'ACCESSI_AUTH_INITIALIZING'
+                : 'ACCESSI_AUTH_NOT_INITIALIZED';
             logger.error(`Authentication service not initialized ${JSON.stringify({
                 method: req.method,
                 path: (_a = req.originalUrl) !== null && _a !== void 0 ? _a : req.url,
                 status,
             })}`);
-            return res
-                .status(status)
-                .json({ message });
+            return res.status(status).json({
+                severity: 'error',
+                status,
+                statusCode: 2,
+                code,
+                error: code,
+                message: status === 503
+                    ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'
+                    : 'Il modulo Accessi non e disponibile.',
+            });
         }
         return authService.authorize(req, res, next, options);
     });
 }
+/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */
 exports.authenticateGen = authorizeAccessi;
 //# sourceMappingURL=authenticateGen.js.map

package/dist/accessi-module/middleware/authenticateGen.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuPA,wEAIC;AAED,sDAOC;AAED,sEAKC;AAqDD,4CA0BC;AAzVD,kDAAoC;AACpC,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAIwC;AAExC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;;QAExB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAA,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,UAAU,0CAAE,MAAM,mCAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAChF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,OAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAEA,GAAW,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YACpD,CAAC;YAEA,GAAW,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACxC,GAAW,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACzC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,aAAa,GACjB,OAAO,CAAC,MAAM,KAAK,GAAG;gBACpB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;oBACrB,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,cAAc,CAAC;YACvB,OAAO,GAAG;iBACP,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;iBACtB,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CAAA;AAGM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEC,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AAxBY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CAwBlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,OAAO,GAAG,4BAA4B;gBAC1C,CAAC,CAAC,sDAAsD;gBACxD,CAAC,CAAC,gDAAgD,CAAC;YACrD,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG;iBACP,MAAM,CAAC,MAAM,CAAC;iBACd,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvB,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAEY,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\r\nimport * as jwt from \"jsonwebtoken\";\r\nimport { Inject, Injectable } from \"@nestjs/common\";\r\nimport { AccessiOptions } from \"../AccessiModule\";\r\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\r\nimport { UserService } from \"../Services/UserService/UserService\";\r\nimport { Logger } from \"../../Logger\";\r\nimport {\r\n AccessiAuthorizationOptions,\r\n AccessiCustomRequirementContext,\r\n GrantsResult,\r\n RequirementEvaluationError,\r\n buildRequirementTree,\r\n evaluateRequirement,\r\n} from \"./accessiRequirements\";\r\nimport {\r\n buildAuthenticatedTokenPayload,\r\n isAuthenticatedUserEnabledForJwt,\r\n resolveCodiceUtenteFromTokenPayload,\r\n} from \"../security/authenticatedToken\";\r\n\r\nconst logger = new Logger(\"AuthenticateGen\");\r\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\r\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\r\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\r\n\r\ntype Deferred<T> = {\r\n promise: Promise<T>;\r\n resolve: (value: T) => void;\r\n reject: (reason?: unknown) => void;\r\n};\r\n\r\nclass AuthMiddlewareError extends Error {\r\n constructor(\r\n public readonly status: number,\r\n public readonly code: string,\r\n message: string,\r\n public readonly details?: Record<string, unknown>\r\n ) {\r\n super(message);\r\n this.name = \"AuthMiddlewareError\";\r\n }\r\n}\r\n\r\nfunction authError(\r\n status: number,\r\n code: string,\r\n message: string,\r\n details?: Record<string, unknown>\r\n) {\r\n return new AuthMiddlewareError(status, code, message, details);\r\n}\r\n\r\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\r\n if (error instanceof AuthMiddlewareError) return error;\r\n if (error instanceof RequirementEvaluationError) {\r\n return authError(500, error.code, error.message);\r\n }\r\n if (error instanceof Error) {\r\n return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\r\n originalError: error.name,\r\n });\r\n }\r\n return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\r\n}\r\n\r\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\r\n const payload = {\r\n code: authErr.code,\r\n status: authErr.status,\r\n message: authErr.message,\r\n details: authErr.details,\r\n method: req.method,\r\n path: req.originalUrl ?? req.url,\r\n ip: req.ip,\r\n };\r\n\r\n const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\r\n if (authErr.status >= 500) logger.error(message);\r\n else logger.warning(message);\r\n}\r\n\r\nasync function authorizeWithDependencies(\r\n req: Request,\r\n res: Response,\r\n next: NextFunction,\r\n options: AccessiAuthorizationOptions \| undefined,\r\n accessiOptions: AccessiOptions,\r\n permissionService: PermissionService,\r\n userService: UserService\r\n) {\r\n try {\r\n const authHeader = req.headers.authorization;\r\n if (!authHeader) {\r\n throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\r\n }\r\n\r\n const token = authHeader.split(\" \")[1];\r\n if (!token) {\r\n throw authError(\r\n 401,\r\n \"AUTH_TOKEN_MISSING\",\r\n \"Token not found in Authorization header\"\r\n );\r\n }\r\n\r\n const secret = accessiOptions?.jwtOptions?.secret ?? process.env.ACC_JWT_SECRET;\r\n if (!secret) {\r\n throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT secret not configured\");\r\n }\r\n\r\n let decoded: any;\r\n try {\r\n decoded = jwt.verify(token, secret);\r\n } catch {\r\n throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\r\n }\r\n\r\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\r\n if (!codiceUtente) {\r\n throw authError(\r\n 401,\r\n \"AUTH_USER_CODE_MISSING\",\r\n \"codiceUtente not found in token payload\"\r\n );\r\n }\r\n\r\n const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\r\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\r\n throw authError(\r\n 401,\r\n \"AUTH_USER_DISABLED\",\r\n \"User is no longer authorized\"\r\n );\r\n }\r\n\r\n const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\r\n\r\n const requirementTree = buildRequirementTree(options);\r\n if (requirementTree) {\r\n if (!accessiOptions?.databaseOptions) {\r\n throw authError(\r\n 500,\r\n \"AUTH_DATABASE_OPTIONS_MISSING\",\r\n \"Database options not configured\"\r\n );\r\n }\r\n\r\n let grantsResultCache: GrantsResult \| null = null;\r\n const getGrantsResult = async () => {\r\n if (!grantsResultCache) {\r\n grantsResultCache = await permissionService.getUserRolesAndGrants(\r\n codiceUtente\r\n );\r\n }\r\n return grantsResultCache;\r\n };\r\n\r\n const requirementContext: AccessiCustomRequirementContext = {\r\n req,\r\n decodedToken: authenticatedPayload,\r\n userCode: codiceUtente,\r\n getGrantsResult,\r\n };\r\n\r\n const hasPermissions = await evaluateRequirement(\r\n requirementTree,\r\n requirementContext,\r\n options\r\n );\r\n\r\n if (!hasPermissions) {\r\n throw authError(\r\n 403,\r\n \"AUTH_INSUFFICIENT_PERMISSIONS\",\r\n \"User does not have required permissions\"\r\n );\r\n }\r\n\r\n (req as any).userGrants = await getGrantsResult();\r\n }\r\n\r\n (req as any).user = authenticatedPayload;\r\n (req as any).data = authenticatedPayload;\r\n return next();\r\n } catch (error: unknown) {\r\n const authErr = normalizeAuthError(error);\r\n logAuthFailure(req, authErr);\r\n const publicMessage =\r\n authErr.status === 403\r\n ? \"Forbidden\"\r\n : authErr.status >= 500\r\n ? \"Internal server error\"\r\n : \"Unauthorized\";\r\n return res\r\n .status(authErr.status)\r\n .json({ message: publicMessage, error: authErr.message, code: authErr.code });\r\n }\r\n}\r\n\r\n@Injectable()\r\nexport class AuthenticateGenService {\r\n constructor(\r\n @Inject(\"ACCESSI_OPTIONS\")\r\n private readonly accessiOptions: AccessiOptions,\r\n private readonly permissionService: PermissionService,\r\n private readonly userService: UserService\r\n ) { }\r\n\r\n async authorize(\r\n req: Request,\r\n res: Response,\r\n next: NextFunction,\r\n options?: AccessiAuthorizationOptions\r\n ) {\r\n return authorizeWithDependencies(\r\n req,\r\n res,\r\n next,\r\n options,\r\n this.accessiOptions,\r\n this.permissionService,\r\n this.userService\r\n );\r\n }\r\n}\r\n\r\nlet authenticateGenServiceRef: AuthenticateGenService \| null = null;\r\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> \| null = null;\r\n\r\nfunction createDeferred<T>(): Deferred<T> {\r\n let resolve!: (value: T) => void;\r\n let reject!: (reason?: unknown) => void;\r\n const promise = new Promise<T>((res, rej) => {\r\n resolve = res;\r\n reject = rej;\r\n });\r\n return { promise, resolve, reject };\r\n}\r\n\r\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\r\n return Boolean(\r\n value &&\r\n typeof (value as { authorize?: unknown }).authorize === \"function\"\r\n );\r\n}\r\n\r\nexport function beginAccessiAuthInitialization() {\r\n if (!authServiceBootstrapDeferred) {\r\n authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\r\n }\r\n}\r\n\r\nexport function setAccessiAuthService(service: AuthenticateGenService) {\r\n authenticateGenServiceRef = service;\r\n (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\r\n if (authServiceBootstrapDeferred) {\r\n authServiceBootstrapDeferred.resolve(service);\r\n authServiceBootstrapDeferred = null;\r\n }\r\n}\r\n\r\nexport function failAccessiAuthInitialization(error: unknown) {\r\n if (authServiceBootstrapDeferred) {\r\n authServiceBootstrapDeferred.reject(error);\r\n authServiceBootstrapDeferred = null;\r\n }\r\n}\r\n\r\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService \| null {\r\n const appLocalsService = (req.app?.locals as Record<string, unknown> \| undefined)?.[\r\n ACCESSI_AUTH_SERVICE_LOCALS_KEY\r\n ];\r\n\r\n if (isAuthenticateGenService(appLocalsService)) {\r\n return appLocalsService as AuthenticateGenService;\r\n }\r\n\r\n const globalService = (globalThis as Record<symbol, unknown>)[\r\n ACCESSI_AUTH_SERVICE_GLOBAL_KEY\r\n ];\r\n if (isAuthenticateGenService(globalService)) {\r\n return globalService as AuthenticateGenService;\r\n }\r\n\r\n return authenticateGenServiceRef;\r\n}\r\n\r\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService \| null> {\r\n if (!authServiceBootstrapDeferred) {\r\n return null;\r\n }\r\n\r\n const bootstrapPromise = authServiceBootstrapDeferred.promise;\r\n const timeoutPromise = new Promise<null>((resolve) => {\r\n setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\r\n });\r\n\r\n try {\r\n const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\r\n return isAuthenticateGenService(resolved) ? resolved : null;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService \| null> {\r\n const immediateService = getAccessiAuthServiceFromRequest(req);\r\n if (immediateService) {\r\n return immediateService;\r\n }\r\n\r\n const bootstrappedService = await waitForBootstrappedService();\r\n if (bootstrappedService) {\r\n return bootstrappedService;\r\n }\r\n\r\n return getAccessiAuthServiceFromRequest(req);\r\n}\r\n\r\nexport async function authorizeAccessi(\r\n req: Request,\r\n res: Response,\r\n next: NextFunction,\r\n options?: AccessiAuthorizationOptions\r\n) {\r\n const authService = await resolveAccessiAuthService(req);\r\n\r\n if (!authService) {\r\n const status = authServiceBootstrapDeferred ? 503 : 500;\r\n const message = authServiceBootstrapDeferred\r\n ? \"Accessi authentication service is still initializing\"\r\n : \"Accessi authentication service not initialized\";\r\n logger.error(\r\n `Authentication service not initialized ${JSON.stringify({\r\n method: req.method,\r\n path: req.originalUrl ?? req.url,\r\n status,\r\n })}`\r\n );\r\n return res\r\n .status(status)\r\n .json({ message });\r\n }\r\n\r\n return authService.authorize(req, res, next, options);\r\n}\r\n\r\nexport const authenticateGen = authorizeAccessi;\r\n"]}
1	+ {"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwRA,wEAIC;AAGD,sDAOC;AAGD,sEAKC;AA4DD,4CAiCC;AA1YD,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAMwC;AACxC,iEAAwG;AACxG,qEAAsE;AAEtE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,GAAa,EAAE,OAA4B;IAC1E,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;YACrB,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,sCAAsC,CAAC;IAE/C,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,sEAAsE;QACtE,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;QAOxB,MAAM,oBAAoB,GAAG,GAA2B,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,IAAI,YAAwE,CAAC;YAC7E,IAAI,CAAC;gBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,cAAc,CAAC,CAAC;YACzE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,gCAAgC,CAAC,CAAC;YACpF,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAClD,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBAClG,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,oBAAoB,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5D,CAAC;YAED,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CAAA;AAIM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEL;;;OAGG;IACG,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA5BY,wDAAsB;iCAAtB,sBAAsB;IAFlC,IAAA,mBAAU,GAAE;IACb,gFAAgF;;IAG3E,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CA4BlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED;;;;;;GAMG;AACH,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,IAAI,GAAG,4BAA4B;gBACvC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,8BAA8B,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,CAAC;gBACb,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,sCAAsC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAED,mIAAmI;AACtH,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\nimport { Inject, Injectable } from \"@nestjs/common\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\nimport { UserService } from \"../Services/UserService/UserService\";\nimport { Logger } from \"../../Logger\";\nimport {\n AccessiAuthorizationOptions,\n AccessiCustomRequirementContext,\n GrantsResult,\n RequirementEvaluationError,\n buildRequirementTree,\n evaluateRequirement,\n} from \"./accessiRequirements\";\nimport {\n buildAuthenticatedTokenPayload,\n extractAccessiBearerToken,\n isAuthenticatedUserEnabledForJwt,\n isAccessiTokenAllowedForUser,\n resolveCodiceUtenteFromTokenPayload,\n} from \"../security/authenticatedToken\";\nimport { getAccessiAccessTokenVerificationConfig, verifyAccessiJwt } from \"../security/jwtTokenOptions\";\nimport { isAccessiTokenRevoked } from \"../security/sessionRevocation\";\n\nconst logger = new Logger(\"AuthenticateGen\");\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\n\ntype Deferred<T> = {\n promise: Promise<T>;\n resolve: (value: T) => void;\n reject: (reason?: unknown) => void;\n};\n\nclass AuthMiddlewareError extends Error {\n constructor(\n public readonly status: number,\n public readonly code: string,\n message: string,\n public readonly details?: Record<string, unknown>\n ) {\n super(message);\n this.name = \"AuthMiddlewareError\";\n }\n}\n\nfunction authError(\n status: number,\n code: string,\n message: string,\n details?: Record<string, unknown>\n) {\n return new AuthMiddlewareError(status, code, message, details);\n}\n\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\n if (error instanceof AuthMiddlewareError) return error;\n if (error instanceof RequirementEvaluationError) {\n return authError(500, error.code, error.message);\n }\n if (error instanceof Error) {\n return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\n originalError: error.name,\n });\n }\n return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\n}\n\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\n const payload = {\n code: authErr.code,\n status: authErr.status,\n message: authErr.message,\n details: authErr.details,\n method: req.method,\n path: req.originalUrl ?? req.url,\n ip: req.ip,\n };\n\n const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\n if (authErr.status >= 500) logger.error(message);\n else logger.warning(message);\n}\n\n/** Sends the documented Accessi error contract from Express middleware. /\nfunction sendAuthenticationError(res: Response, authErr: AuthMiddlewareError): Response {\n const message =\n authErr.status === 403\n ? 'Operazione non autorizzata.'\n : authErr.status >= 500\n ? 'Errore interno del modulo Accessi.'\n : 'Autenticazione non valida o scaduta.';\n\n return res.status(authErr.status).json({\n severity: 'error',\n status: authErr.status,\n statusCode: 2,\n code: authErr.code,\n // Kept for callers of older versions which already inspected `error`.\n error: authErr.code,\n message,\n });\n}\n\nasync function authorizeWithDependencies(\n req: Request,\n res: Response,\n next: NextFunction,\n options: AccessiAuthorizationOptions \| undefined,\n accessiOptions: AccessiOptions,\n permissionService: PermissionService,\n userService: UserService\n) {\n type AuthenticatedRequest = Request & {\n userGrants?: unknown;\n user?: unknown;\n data?: unknown;\n };\n const authenticatedRequest = req as AuthenticatedRequest;\n\n try {\n const authHeader = req.headers.authorization;\n if (!authHeader) {\n throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\n }\n\n const token = extractAccessiBearerToken(authHeader);\n if (!token) {\n throw authError(\n 401,\n \"AUTH_TOKEN_MISSING\",\n \"Token not found in Authorization header\"\n );\n }\n\n let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n try {\n verification = getAccessiAccessTokenVerificationConfig(accessiOptions);\n } catch {\n throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT signing key not configured\");\n }\n\n let decoded: unknown;\n try {\n decoded = verifyAccessiJwt(token, verification);\n } catch {\n throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\n }\n\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n if (!codiceUtente) {\n throw authError(\n 401,\n \"AUTH_USER_CODE_MISSING\",\n \"codiceUtente not found in token payload\"\n );\n }\n if (await isAccessiTokenRevoked(accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n throw authError(401, \"AUTH_TOKEN_REVOKED\", \"Session revoked\");\n }\n\n const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(currentUser) \|\| !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n throw authError(\n 401,\n \"AUTH_USER_DISABLED\",\n \"User is no longer authorized\"\n );\n }\n\n const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\n\n const requirementTree = buildRequirementTree(options);\n if (requirementTree) {\n if (!accessiOptions?.databaseOptions) {\n throw authError(\n 500,\n \"AUTH_DATABASE_OPTIONS_MISSING\",\n \"Database options not configured\"\n );\n }\n\n let grantsResultCache: GrantsResult \| null = null;\n const getGrantsResult = async () => {\n if (!grantsResultCache) {\n grantsResultCache = await permissionService.getUserRolesAndGrants(\n codiceUtente\n );\n }\n return grantsResultCache;\n };\n\n const requirementContext: AccessiCustomRequirementContext = {\n req,\n decodedToken: authenticatedPayload,\n userCode: codiceUtente,\n getGrantsResult,\n };\n\n const hasPermissions = await evaluateRequirement(\n requirementTree,\n requirementContext,\n options\n );\n\n if (!hasPermissions) {\n throw authError(\n 403,\n \"AUTH_INSUFFICIENT_PERMISSIONS\",\n \"User does not have required permissions\"\n );\n }\n\n authenticatedRequest.userGrants = await getGrantsResult();\n }\n\n authenticatedRequest.user = authenticatedPayload;\n authenticatedRequest.data = authenticatedPayload;\n return next();\n } catch (error: unknown) {\n const authErr = normalizeAuthError(error);\n logAuthFailure(req, authErr);\n return sendAuthenticationError(res, authErr);\n }\n}\n\n@Injectable()\n/* Nest service behind the Express-compatible `authorizeAccessi` middleware. /\nexport class AuthenticateGenService {\n constructor(\n @Inject(\"ACCESSI_OPTIONS\")\n private readonly accessiOptions: AccessiOptions,\n private readonly permissionService: PermissionService,\n private readonly userService: UserService\n ) { }\n\n /\n Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.\n * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.\n /\n async authorize(\n req: Request,\n res: Response,\n next: NextFunction,\n options?: AccessiAuthorizationOptions\n ) {\n return authorizeWithDependencies(\n req,\n res,\n next,\n options,\n this.accessiOptions,\n this.permissionService,\n this.userService\n );\n }\n}\n\nlet authenticateGenServiceRef: AuthenticateGenService \| null = null;\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> \| null = null;\n\nfunction createDeferred<T>(): Deferred<T> {\n let resolve!: (value: T) => void;\n let reject!: (reason?: unknown) => void;\n const promise = new Promise<T>((res, rej) => {\n resolve = res;\n reject = rej;\n });\n return { promise, resolve, reject };\n}\n\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\n return Boolean(\n value &&\n typeof (value as { authorize?: unknown }).authorize === \"function\"\n );\n}\n\n/* Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. /\nexport function beginAccessiAuthInitialization() {\n if (!authServiceBootstrapDeferred) {\n authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\n }\n}\n\n/* Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. /\nexport function setAccessiAuthService(service: AuthenticateGenService) {\n authenticateGenServiceRef = service;\n (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\n if (authServiceBootstrapDeferred) {\n authServiceBootstrapDeferred.resolve(service);\n authServiceBootstrapDeferred = null;\n }\n}\n\n/* Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. /\nexport function failAccessiAuthInitialization(error: unknown) {\n if (authServiceBootstrapDeferred) {\n authServiceBootstrapDeferred.reject(error);\n authServiceBootstrapDeferred = null;\n }\n}\n\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService \| null {\n const appLocalsService = (req.app?.locals as Record<string, unknown> \| undefined)?.[\n ACCESSI_AUTH_SERVICE_LOCALS_KEY\n ];\n\n if (isAuthenticateGenService(appLocalsService)) {\n return appLocalsService as AuthenticateGenService;\n }\n\n const globalService = (globalThis as Record<symbol, unknown>)[\n ACCESSI_AUTH_SERVICE_GLOBAL_KEY\n ];\n if (isAuthenticateGenService(globalService)) {\n return globalService as AuthenticateGenService;\n }\n\n return authenticateGenServiceRef;\n}\n\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService \| null> {\n if (!authServiceBootstrapDeferred) {\n return null;\n }\n\n const bootstrapPromise = authServiceBootstrapDeferred.promise;\n const timeoutPromise = new Promise<null>((resolve) => {\n setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\n });\n\n try {\n const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\n return isAuthenticateGenService(resolved) ? resolved : null;\n } catch {\n return null;\n }\n}\n\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService \| null> {\n const immediateService = getAccessiAuthServiceFromRequest(req);\n if (immediateService) {\n return immediateService;\n }\n\n const bootstrappedService = await waitForBootstrappedService();\n if (bootstrappedService) {\n return bootstrappedService;\n }\n\n return getAccessiAuthServiceFromRequest(req);\n}\n\n/\n Middleware Express pubblico di Accessi.\n \n Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente\n * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente\n * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.\n /\nexport async function authorizeAccessi(\n req: Request,\n res: Response,\n next: NextFunction,\n options?: AccessiAuthorizationOptions\n) {\n const authService = await resolveAccessiAuthService(req);\n\n if (!authService) {\n const status = authServiceBootstrapDeferred ? 503 : 500;\n const code = authServiceBootstrapDeferred\n ? 'ACCESSI_AUTH_INITIALIZING'\n : 'ACCESSI_AUTH_NOT_INITIALIZED';\n logger.error(\n `Authentication service not initialized ${JSON.stringify({\n method: req.method,\n path: req.originalUrl ?? req.url,\n status,\n })}`\n );\n return res.status(status).json({\n severity: 'error',\n status,\n statusCode: 2,\n code,\n error: code,\n message: status === 503\n ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'\n : 'Il modulo Accessi non e disponibile.',\n });\n }\n\n return authService.authorize(req, res, next, options);\n}\n\n/* Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */\nexport const authenticateGen = authorizeAccessi;\n"]}

package/dist/accessi-module/observability/metrics.d.ts ADDED Viewed

@@ -0,0 +1,79 @@
+import type { AccessiOptions } from '../AccessiModule';
+/** Valore ammesso per un label Prometheus. */
+export type AccessiMetricLabelValue = string | number | boolean | undefined;
+export type AccessiMetricLabels = Record<string, AccessiMetricLabelValue>;
+/**
+ * Destinazione delle metriche Accessi.
+ *
+ * L'implementazione predefinita e il registry in memoria renderizzato in
+ * formato Prometheus. Un host puo passare un sink custom (OpenTelemetry,
+ * StatsD, ...) tramite `metrics.sink`.
+ */
+export interface AccessiMetricsSink {
+    increment(name: string, value?: number, labels?: AccessiMetricLabels): void;
+    gauge?(name: string, value: number, labels?: AccessiMetricLabels): void;
+    observe?(name: string, valueMs: number, labels?: AccessiMetricLabels): void;
+}
+/** Opzioni di osservabilita di Accessi. */
+export interface AccessiMetricsOptions {
+    /** `false` disabilita le metriche di dominio. Default: abilitate. */
+    enabled?: boolean;
+    /** Sink custom. Default: registry in memoria. */
+    sink?: AccessiMetricsSink;
+    /** Prefisso dei nomi. Default `accessi`. */
+    prefix?: string;
+}
+export interface AccessiMetricsRegistry extends AccessiMetricsSink {
+    observe(name: string, valueMs: number, labels?: AccessiMetricLabels): void;
+    gauge(name: string, value: number, labels?: AccessiMetricLabels): void;
+    renderPrometheus(): string;
+    snapshot(): AccessiMetricsSnapshot;
+    reset(): void;
+}
+export interface AccessiMetricsSnapshot {
+    counters: Array<{
+        name: string;
+        labels: Record<string, string>;
+        value: number;
+    }>;
+    gauges: Array<{
+        name: string;
+        labels: Record<string, string>;
+        value: number;
+    }>;
+    histograms: Array<{
+        name: string;
+        labels: Record<string, string>;
+        count: number;
+        sum: number;
+        buckets: Array<{
+            le: number;
+            count: number;
+        }>;
+    }>;
+}
+/**
+ * Registry in memoria con rendering Prometheus.
+ *
+ * Non usa dipendenze: la stessa struttura e usata dal servizio standalone e
+ * dai test. `reset()` serve per isolare i test.
+ */
+export declare function createAccessiMetricsRegistry(): AccessiMetricsRegistry;
+/** Registry globale usato da Accessi e dal servizio standalone. */
+export declare function getAccessiMetricsRegistry(): AccessiMetricsRegistry;
+/** Sink configurato per l'istanza, oppure registry globale. */
+export declare function getAccessiMetricsSink(options: AccessiOptions | undefined): AccessiMetricsSink | undefined;
+/** Registra una metrica sul registry globale (usato da store e moduli senza options). */
+export declare function recordAccessiMetric(name: string, value?: number, labels?: AccessiMetricLabels): void;
+/** Registra una durata in millisecondi sul registry globale. */
+export declare function recordAccessiDuration(name: string, valueMs: number, labels?: AccessiMetricLabels): void;
+/** Render Prometheus del registry globale. */
+export declare function renderAccessiMetrics(): string;
+/** Azzera il registry globale (test e reset espliciti). */
+export declare function resetAccessiMetrics(): void;
+/** Prefisso configurato, con normalizzazione per evitare nomi non validi. */
+export declare function accessiMetricName(options: AccessiOptions | undefined, name: string): string;
+/** Incrementa un contatore di dominio sull'istanza (o sul registry globale). */
+export declare function countAccessiMetric(options: AccessiOptions | undefined, name: string, labels?: AccessiMetricLabels, value?: number): void;
+/** Registra una durata di dominio in millisecondi. */
+export declare function observeAccessiMetric(options: AccessiOptions | undefined, name: string, valueMs: number, labels?: AccessiMetricLabels): void;