emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.80

package/dist/accessi-module/security/accessControl.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAcA,kEAeC;AAED,0CAOC;AAED,sDAUC;AAED,4DAcC;AAlED,2CAA2E;AAU3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAW,aAAX,GAAG,uBAAH,GAAG,CAAU,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,MAAM,mCAAI,OAAO,CAAC;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,qBAAqB,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,qBAAqB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,wBAAwB,CAAC,IAMxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,qBAAqB,KAAK,SAAS;QACxC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\r\nimport { Request } from 'express';\r\n\r\nexport interface AuthenticatedAccessiUser {\r\n  codiceUtente: number;\r\n  email?: string;\r\n  flagSuper: boolean;\r\n  flagAdminConfigurator: boolean;\r\n}\r\n\r\nfunction normalizeBooleanFlag(value: unknown): boolean {\r\n  return value === true || value === 1 || value === '1';\r\n}\r\n\r\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\r\n  const payload = (req as any)?.user;\r\n  const utente = payload?.utente ?? payload?.userData?.utente ?? payload;\r\n  const codiceUtente = Number(utente?.codiceUtente);\r\n\r\n  if (!codiceUtente) {\r\n    throw new UnauthorizedException('Utente non autenticato.');\r\n  }\r\n\r\n  return {\r\n    codiceUtente,\r\n    email: typeof utente?.email === 'string' ? utente.email : undefined,\r\n    flagSuper: normalizeBooleanFlag(utente?.flagSuper),\r\n    flagAdminConfigurator: normalizeBooleanFlag(utente?.flagAdminConfigurator),\r\n  };\r\n}\r\n\r\nexport function ensureSuperUser(\r\n  user: AuthenticatedAccessiUser,\r\n  message = 'Operazione riservata agli amministratori.',\r\n): void {\r\n  if (!user.flagSuper) {\r\n    throw new ForbiddenException(message);\r\n  }\r\n}\r\n\r\nexport function ensureSelfOrSuperUser(\r\n  user: AuthenticatedAccessiUser,\r\n  targetUserCode: number,\r\n  message = 'Operazione non autorizzata su questo utente.',\r\n): void {\r\n  if (user.flagSuper || user.codiceUtente === targetUserCode) {\r\n    return;\r\n  }\r\n\r\n  throw new ForbiddenException(message);\r\n}\r\n\r\nexport function hasPrivilegedUserChanges(user: {\r\n  statoRegistrazione?: unknown;\r\n  flagSuper?: unknown;\r\n  flagAdminConfigurator?: unknown;\r\n  roles?: unknown;\r\n  permissions?: unknown;\r\n}): boolean {\r\n  return (\r\n    user.statoRegistrazione !== undefined ||\r\n    user.flagSuper !== undefined ||\r\n    user.flagAdminConfigurator !== undefined ||\r\n    user.roles !== undefined ||\r\n    user.permissions !== undefined\r\n  );\r\n}\r\n"]}
+{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,kCAOC;AAMD,oDAOC;AAOD,0CAIC;AAMD,8DAQC;AAOD,gEAUC;AAGD,kDAOC;AAGD,sDAUC;AAGD,4DAoBC;AAhKD,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,sCAAsC;IAEhD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,WAAW,CACzB,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAkD;IAChF,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,KAA+B,EAC/B,MAAoD,EACpD,OAAO,GAAG,uDAAuD;IAEjE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,IAA8B,EAC9B,OAAqD;IAErD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,2BAAkB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,2BAAkB,CAAC,oEAAoE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,mBAAmB,CACjC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */\nexport interface AuthenticatedAccessiUser {\n  codiceUtente: number;\n  email?: string;\n  flagSuper: boolean;\n  flagAdmin: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\n/**\n * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n */\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n  const payload = (req as Request & { user?: unknown }).user;\n  const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\n  const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\n    ? payloadRecord.userData as Record<string, unknown>\n    : undefined;\n  const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\n  const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\n  const codiceUtente = Number(utente?.codiceUtente);\n\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n    throw new UnauthorizedException('Utente non autenticato.');\n  }\n\n  return {\n    codiceUtente,\n    email: typeof utente?.email === 'string' ? utente.email : undefined,\n    flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n    flagAdmin: normalizeBooleanFlag(utente?.flagAdmin),\n  };\n}\n\n/** Impone il flag superutente: gestione utenti e dei loro grant. */\nexport function ensureSuperUser(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata ai superutenti.',\n): void {\n  if (!user.flagSuper) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */\nexport function ensureAdmin(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori.',\n): void {\n  if (!user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Gestione utenti e assegnazioni: consentita a superutenti e admin.\n * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.\n */\nexport function ensureUserManagement(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori degli utenti.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.\n * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango\n * pari o inferiore, quindi un superutente non puo' toccare un admin.\n */\nexport function accessiUserRank(user: { flagSuper?: boolean; flagAdmin?: boolean }): number {\n  if (user.flagAdmin) return 2;\n  if (user.flagSuper) return 1;\n  return 0;\n}\n\n/**\n * Impone che l'attore possa gestire il target: rango attore >= rango target.\n * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).\n */\nexport function ensureCanManageTargetUser(\n  actor: AuthenticatedAccessiUser,\n  target: { flagSuper?: boolean; flagAdmin?: boolean },\n  message = 'Non puoi gestire un utente di rango superiore al tuo.',\n): void {\n  if (accessiUserRank(actor) < accessiUserRank(target)) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:\n * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza\n * `flagAdmin` gestisce solo `flagSuper`.\n */\nexport function ensurePrivilegeFlagChanges(\n  user: AuthenticatedAccessiUser,\n  changes: { flagSuper?: unknown; flagAdmin?: unknown },\n): void {\n  if (changes.flagAdmin !== undefined && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un admin puo modificare il flag admin.');\n  }\n  if (changes.flagSuper !== undefined && !user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un superutente o un admin puo modificare il flag superutente.');\n  }\n}\n\n/** Accesso alla console: superutenti e admin. */\nexport function ensureConsoleAccess(\n  user: AuthenticatedAccessiUser,\n  message = 'La console richiede un superutente o un admin Accessi.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */\nexport function ensureSelfOrSuperUser(\n  user: AuthenticatedAccessiUser,\n  targetUserCode: number,\n  message = 'Operazione non autorizzata su questo utente.',\n): void {\n  if (user.flagSuper || user.flagAdmin || user.codiceUtente === targetUserCode) {\n    return;\n  }\n\n  throw new ForbiddenException(message);\n}\n\n/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n  statoRegistrazione?: unknown;\n  flagSuper?: unknown;\n  flagAdmin?: unknown;\n  passwordLoginEnabled?: unknown;\n  passwordlessLoginEnabled?: unknown;\n  flagDueFattori?: unknown;\n  roles?: unknown;\n  permissions?: unknown;\n}): boolean {\n  return (\n    user.statoRegistrazione !== undefined ||\n    user.flagSuper !== undefined ||\n    user.flagAdmin !== undefined ||\n    user.passwordLoginEnabled !== undefined ||\n    user.passwordlessLoginEnabled !== undefined ||\n    user.flagDueFattori !== undefined ||\n    user.roles !== undefined ||\n    user.permissions !== undefined\n  );\n}\n"]}

package/dist/accessi-module/security/accessTokenRevocation.d.ts

@@ -0,0 +1,47 @@
+import type { AccessiOptions } from '../AccessiModule';
+/**
+ * Revoca dei singoli access token tramite `jti`.
+ *
+ * A differenza della revoca per utente, questa annulla un solo token senza
+ * toccare le altre sessioni. La chiave scade al massimo a `exp` del token, cosi
+ * la memoria usata resta limitata alla durata dei token emessi.
+ */
+export interface AccessTokenRevocationStore {
+    revoke(jti: string, expiresAtMs: number): Promise<void>;
+    isRevoked(jti: string): Promise<boolean>;
+    /** Health check opzionale per readiness del servizio. */
+    healthCheck?(): Promise<boolean>;
+}
+export interface AccessTokenRevocationOptions {
+    /** Default: disabilitata se non viene fornito uno store. */
+    enabled?: boolean;
+    /** Store condiviso (es. Redis) per revocare i token tra istanze. */
+    store?: AccessTokenRevocationStore;
+    /** TTL di default quando `exp` non e noto. Default: 24 ore. */
+    ttlMs?: number;
+}
+export interface MemoryAccessTokenRevocationStore extends AccessTokenRevocationStore {
+    clear(): void;
+}
+export declare function createMemoryAccessTokenRevocationStore(): MemoryAccessTokenRevocationStore;
+export interface AccessTokenRevocationRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+export interface RedisAccessTokenRevocationStoreOptions {
+    client: AccessTokenRevocationRedisClient;
+    /** Default: `accessi:revoked-token:`. */
+    keyPrefix?: string;
+    /** Default: 24 ore. */
+    ttlMs?: number;
+}
+/** Store Redis per la revoca dei singoli access token. */
+export declare function createRedisAccessTokenRevocationStore(options: RedisAccessTokenRevocationStoreOptions): AccessTokenRevocationStore;
+export declare function getAccessTokenRevocationStore(options: AccessiOptions): AccessTokenRevocationStore | undefined;
+/** True se il `jti` del token risulta revocato. */
+export declare function isAccessiAccessTokenRevoked(options: AccessiOptions, payload: Record<string, unknown>): Promise<boolean>;
+/** Revoca un singolo access token. Richiede uno store configurato. */
+export declare function revokeAccessiAccessToken(options: AccessiOptions, jti: string, expiresAtMs?: number): Promise<void>;
+/** Variante per i flussi applicativi: no-op se la revoca non e configurata. */
+export declare function revokeAccessiAccessTokenIfConfigured(options: AccessiOptions, jti: string, expiresAtMs?: number): Promise<boolean>;
+/** Solo per test: azzera lo store in memoria di default. */
+export declare function clearDefaultAccessTokenRevocations(): void;

package/dist/accessi-module/security/accessTokenRevocation.js

@@ -0,0 +1,148 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemoryAccessTokenRevocationStore = createMemoryAccessTokenRevocationStore;
+exports.createRedisAccessTokenRevocationStore = createRedisAccessTokenRevocationStore;
+exports.getAccessTokenRevocationStore = getAccessTokenRevocationStore;
+exports.isAccessiAccessTokenRevoked = isAccessiAccessTokenRevoked;
+exports.revokeAccessiAccessToken = revokeAccessiAccessToken;
+exports.revokeAccessiAccessTokenIfConfigured = revokeAccessiAccessTokenIfConfigured;
+exports.clearDefaultAccessTokenRevocations = clearDefaultAccessTokenRevocations;
+const redisMetrics_1 = require("../observability/redisMetrics");
+const REVOKE_SCRIPT = "if tonumber(ARGV[1]) > 0 then return redis.call('SET', KEYS[1], '1', 'PX', ARGV[1]) else return redis.call('SET', KEYS[1], '1') end";
+const IS_REVOKED_SCRIPT = "return redis.call('EXISTS', KEYS[1])";
+function createMemoryAccessTokenRevocationStore() {
+    const revoked = new Map();
+    const prune = (now) => {
+        for (const [jti, expiresAt] of revoked) {
+            if (expiresAt <= now)
+                revoked.delete(jti);
+        }
+    };
+    return {
+        revoke(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const now = Date.now();
+                prune(now);
+                revoked.set(jti, Math.max(expiresAtMs, now + 1));
+            });
+        },
+        isRevoked(jti) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const expiresAt = revoked.get(jti);
+                if (expiresAt === undefined)
+                    return false;
+                if (expiresAt <= Date.now()) {
+                    revoked.delete(jti);
+                    return false;
+                }
+                return true;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                return true;
+            });
+        },
+        clear() {
+            revoked.clear();
+        },
+    };
+}
+/** Store Redis per la revoca dei singoli access token. */
+function createRedisAccessTokenRevocationStore(options) {
+    var _a, _b;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis access token revocation store: client.eval non configurato.');
+    }
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:revoked-token:').replace(/:+$/, ':');
+    const ttlMs = Math.max(0, Math.trunc((_b = options.ttlMs) !== null && _b !== void 0 ? _b : 24 * 60 * 60 * 1000));
+    const client = (0, redisMetrics_1.instrumentAccessiRedisClient)('access_token_revocation', options.client);
+    return {
+        revoke(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                // Se il token e gia scaduto non serve conservare la revoca a lungo: una
+                // chiave senza TTL resterebbe per sempre. Il minimo di 1 ms la fa sparire
+                // subito, come nello store in memoria.
+                const ttl = Number.isFinite(expiresAtMs)
+                    ? Math.max(1, Math.trunc(expiresAtMs - Date.now()))
+                    : ttlMs;
+                yield client.eval(REVOKE_SCRIPT, 1, `${keyPrefix}${jti}`, ttl);
+            });
+        },
+        isRevoked(jti) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const result = yield client.eval(IS_REVOKED_SCRIPT, 1, `${keyPrefix}${jti}`);
+                return Number(result) > 0;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const result = yield client.eval("return redis.call('PING')", 0);
+                    return String(result).toUpperCase() === 'PONG';
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+    };
+}
+const defaultMemoryStore = createMemoryAccessTokenRevocationStore();
+function getAccessTokenRevocationStore(options) {
+    var _a, _b, _c;
+    if (((_a = options.accessTokenRevocation) === null || _a === void 0 ? void 0 : _a.enabled) === false)
+        return undefined;
+    if ((_b = options.accessTokenRevocation) === null || _b === void 0 ? void 0 : _b.store)
+        return options.accessTokenRevocation.store;
+    return ((_c = options.accessTokenRevocation) === null || _c === void 0 ? void 0 : _c.enabled) === true ? defaultMemoryStore : undefined;
+}
+/** True se il `jti` del token risulta revocato. */
+function isAccessiAccessTokenRevoked(options, payload) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const store = getAccessTokenRevocationStore(options);
+        if (!store)
+            return false;
+        const jti = typeof payload.jti === 'string' ? payload.jti : undefined;
+        if (!jti)
+            return false;
+        return store.isRevoked(jti);
+    });
+}
+/** Revoca un singolo access token. Richiede uno store configurato. */
+function revokeAccessiAccessToken(options, jti, expiresAtMs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const store = getAccessTokenRevocationStore(options);
+        if (!store)
+            throw new Error('Access token revocation store non configurato.');
+        if (typeof jti !== 'string' || jti.trim() === '') {
+            throw new Error('jti non valido.');
+        }
+        const ttlMs = Math.max(0, Math.trunc((_b = (_a = options.accessTokenRevocation) === null || _a === void 0 ? void 0 : _a.ttlMs) !== null && _b !== void 0 ? _b : 24 * 60 * 60 * 1000));
+        yield store.revoke(jti, expiresAtMs !== null && expiresAtMs !== void 0 ? expiresAtMs : Date.now() + ttlMs);
+    });
+}
+/** Variante per i flussi applicativi: no-op se la revoca non e configurata. */
+function revokeAccessiAccessTokenIfConfigured(options, jti, expiresAtMs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!getAccessTokenRevocationStore(options))
+            return false;
+        yield revokeAccessiAccessToken(options, jti, expiresAtMs);
+        return true;
+    });
+}
+/** Solo per test: azzera lo store in memoria di default. */
+function clearDefaultAccessTokenRevocations() {
+    defaultMemoryStore.clear();
+}
+//# sourceMappingURL=accessTokenRevocation.js.map

package/dist/accessi-module/security/accessTokenRevocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessTokenRevocation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessTokenRevocation.ts"],"names":[],"mappings":";;;;;;;;;;;AAkCA,wFA6BC;AAeD,sFAoCC;AAID,sEAMC;AAGD,kEASC;AAGD,4DAYC;AAGD,oFAQC;AAGD,gFAEC;AAtKD,gEAA6E;AA6B7E,MAAM,aAAa,GACjB,qIAAqI,CAAC;AACxI,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE,SAAgB,sCAAsC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,SAAS,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACC,MAAM,CAAC,GAAG,EAAE,WAAW;;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;SAAA;QACK,SAAS,CAAC,GAAG;;gBACjB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC1C,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACpB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAcD,0DAA0D;AAC1D,SAAgB,qCAAqC,CACnD,OAA+C;;IAE/C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAA,2CAA4B,EAAC,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvF,OAAO;QACC,MAAM,CAAC,GAAG,EAAE,WAAW;;gBAC3B,wEAAwE;gBACxE,0EAA0E;gBAC1E,uCAAuC;gBACvC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBACnD,CAAC,CAAC,KAAK,CAAC;gBACV,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,SAAS,GAAG,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;SAAA;QAEK,SAAS,CAAC,GAAG;;gBACjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,GAAG,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC7E,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;SAAA;QAEK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,sCAAsC,EAAE,CAAC;AAEpE,SAAgB,6BAA6B,CAC3C,OAAuB;;IAEvB,IAAI,CAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,MAAA,OAAO,CAAC,qBAAqB,0CAAE,KAAK;QAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;IACrF,OAAO,CAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,OAAO,MAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED,mDAAmD;AACnD,SAAsB,2BAA2B,CAC/C,OAAuB,EACvB,OAAgC;;QAEhC,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CAAA;AAED,sEAAsE;AACtE,SAAsB,wBAAwB,CAC5C,OAAuB,EACvB,GAAW,EACX,WAAoB;;;QAEpB,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,KAAK,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACnG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IAC7D,CAAC;CAAA;AAED,+EAA+E;AAC/E,SAAsB,oCAAoC,CACxD,OAAuB,EACvB,GAAW,EACX,WAAoB;;QAEpB,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,4DAA4D;AAC5D,SAAgB,kCAAkC;IAChD,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\nimport { instrumentAccessiRedisClient } from '../observability/redisMetrics';\n\n/**\n * Revoca dei singoli access token tramite `jti`.\n *\n * A differenza della revoca per utente, questa annulla un solo token senza\n * toccare le altre sessioni. La chiave scade al massimo a `exp` del token, cosi\n * la memoria usata resta limitata alla durata dei token emessi.\n */\nexport interface AccessTokenRevocationStore {\n  revoke(jti: string, expiresAtMs: number): Promise<void>;\n  isRevoked(jti: string): Promise<boolean>;\n  /** Health check opzionale per readiness del servizio. */\n  healthCheck?(): Promise<boolean>;\n}\n\nexport interface AccessTokenRevocationOptions {\n  /** Default: disabilitata se non viene fornito uno store. */\n  enabled?: boolean;\n  /** Store condiviso (es. Redis) per revocare i token tra istanze. */\n  store?: AccessTokenRevocationStore;\n  /** TTL di default quando `exp` non e noto. Default: 24 ore. */\n  ttlMs?: number;\n}\n\nexport interface MemoryAccessTokenRevocationStore extends AccessTokenRevocationStore {\n  clear(): void;\n}\n\nconst REVOKE_SCRIPT =\n  \"if tonumber(ARGV[1]) > 0 then return redis.call('SET', KEYS[1], '1', 'PX', ARGV[1]) else return redis.call('SET', KEYS[1], '1') end\";\nconst IS_REVOKED_SCRIPT = \"return redis.call('EXISTS', KEYS[1])\";\n\nexport function createMemoryAccessTokenRevocationStore(): MemoryAccessTokenRevocationStore {\n  const revoked = new Map<string, number>();\n  const prune = (now: number) => {\n    for (const [jti, expiresAt] of revoked) {\n      if (expiresAt <= now) revoked.delete(jti);\n    }\n  };\n  return {\n    async revoke(jti, expiresAtMs) {\n      const now = Date.now();\n      prune(now);\n      revoked.set(jti, Math.max(expiresAtMs, now + 1));\n    },\n    async isRevoked(jti) {\n      const expiresAt = revoked.get(jti);\n      if (expiresAt === undefined) return false;\n      if (expiresAt <= Date.now()) {\n        revoked.delete(jti);\n        return false;\n      }\n      return true;\n    },\n    async healthCheck() {\n      return true;\n    },\n    clear() {\n      revoked.clear();\n    },\n  };\n}\n\nexport interface AccessTokenRevocationRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisAccessTokenRevocationStoreOptions {\n  client: AccessTokenRevocationRedisClient;\n  /** Default: `accessi:revoked-token:`. */\n  keyPrefix?: string;\n  /** Default: 24 ore. */\n  ttlMs?: number;\n}\n\n/** Store Redis per la revoca dei singoli access token. */\nexport function createRedisAccessTokenRevocationStore(\n  options: RedisAccessTokenRevocationStoreOptions,\n): AccessTokenRevocationStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis access token revocation store: client.eval non configurato.');\n  }\n\n  const keyPrefix = (options.keyPrefix ?? 'accessi:revoked-token:').replace(/:+$/, ':');\n  const ttlMs = Math.max(0, Math.trunc(options.ttlMs ?? 24 * 60 * 60 * 1000));\n  const client = instrumentAccessiRedisClient('access_token_revocation', options.client);\n\n  return {\n    async revoke(jti, expiresAtMs) {\n      // Se il token e gia scaduto non serve conservare la revoca a lungo: una\n      // chiave senza TTL resterebbe per sempre. Il minimo di 1 ms la fa sparire\n      // subito, come nello store in memoria.\n      const ttl = Number.isFinite(expiresAtMs)\n        ? Math.max(1, Math.trunc(expiresAtMs - Date.now()))\n        : ttlMs;\n      await client.eval(REVOKE_SCRIPT, 1, `${keyPrefix}${jti}`, ttl);\n    },\n\n    async isRevoked(jti) {\n      const result = await client.eval(IS_REVOKED_SCRIPT, 1, `${keyPrefix}${jti}`);\n      return Number(result) > 0;\n    },\n\n    async healthCheck() {\n      try {\n        const result = await client.eval(\"return redis.call('PING')\", 0);\n        return String(result).toUpperCase() === 'PONG';\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n\nconst defaultMemoryStore = createMemoryAccessTokenRevocationStore();\n\nexport function getAccessTokenRevocationStore(\n  options: AccessiOptions,\n): AccessTokenRevocationStore | undefined {\n  if (options.accessTokenRevocation?.enabled === false) return undefined;\n  if (options.accessTokenRevocation?.store) return options.accessTokenRevocation.store;\n  return options.accessTokenRevocation?.enabled === true ? defaultMemoryStore : undefined;\n}\n\n/** True se il `jti` del token risulta revocato. */\nexport async function isAccessiAccessTokenRevoked(\n  options: AccessiOptions,\n  payload: Record<string, unknown>,\n): Promise<boolean> {\n  const store = getAccessTokenRevocationStore(options);\n  if (!store) return false;\n  const jti = typeof payload.jti === 'string' ? payload.jti : undefined;\n  if (!jti) return false;\n  return store.isRevoked(jti);\n}\n\n/** Revoca un singolo access token. Richiede uno store configurato. */\nexport async function revokeAccessiAccessToken(\n  options: AccessiOptions,\n  jti: string,\n  expiresAtMs?: number,\n): Promise<void> {\n  const store = getAccessTokenRevocationStore(options);\n  if (!store) throw new Error('Access token revocation store non configurato.');\n  if (typeof jti !== 'string' || jti.trim() === '') {\n    throw new Error('jti non valido.');\n  }\n  const ttlMs = Math.max(0, Math.trunc(options.accessTokenRevocation?.ttlMs ?? 24 * 60 * 60 * 1000));\n  await store.revoke(jti, expiresAtMs ?? Date.now() + ttlMs);\n}\n\n/** Variante per i flussi applicativi: no-op se la revoca non e configurata. */\nexport async function revokeAccessiAccessTokenIfConfigured(\n  options: AccessiOptions,\n  jti: string,\n  expiresAtMs?: number,\n): Promise<boolean> {\n  if (!getAccessTokenRevocationStore(options)) return false;\n  await revokeAccessiAccessToken(options, jti, expiresAtMs);\n  return true;\n}\n\n/** Solo per test: azzera lo store in memoria di default. */\nexport function clearDefaultAccessTokenRevocations(): void {\n  defaultMemoryStore.clear();\n}\n"]}

package/dist/accessi-module/security/accessiValidation.d.ts

@@ -0,0 +1,9 @@
+import { ValidationPipe } from '@nestjs/common';
+/**
+ * Creates the validation pipe used by every Accessi bootstrap path.
+ *
+ * It deliberately returns one stable, documented error contract instead of
+ * Nest's default array. Consumers can branch on `code`; `details` is safe to
+ * display or log because it contains only DTO field names and validation text.
+ */
+export declare function createAccessiValidationPipe(): ValidationPipe;

package/dist/accessi-module/security/accessiValidation.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiValidationPipe = createAccessiValidationPipe;
+const common_1 = require("@nestjs/common");
+const Utilities_1 = require("../../Utilities");
+/**
+ * Creates the validation pipe used by every Accessi bootstrap path.
+ *
+ * It deliberately returns one stable, documented error contract instead of
+ * Nest's default array. Consumers can branch on `code`; `details` is safe to
+ * display or log because it contains only DTO field names and validation text.
+ */
+function createAccessiValidationPipe() {
+    return new common_1.ValidationPipe({
+        whitelist: true,
+        forbidNonWhitelisted: true,
+        transform: true,
+        transformOptions: {
+            enableImplicitConversion: true,
+        },
+        exceptionFactory: (errors) => new common_1.BadRequestException({
+            severity: 'error',
+            status: 400,
+            statusCode: Utilities_1.StatusCode.Error,
+            code: 'ACCESSI_VALIDATION_ERROR',
+            error: 'ACCESSI_VALIDATION_ERROR',
+            message: 'La richiesta contiene dati non validi.',
+            details: flattenValidationErrors(errors),
+        }),
+    });
+}
+/** Converts nested class-validator failures into deterministic client details. */
+function flattenValidationErrors(errors, parentPath = '') {
+    return errors.flatMap((error) => {
+        var _a, _b;
+        const path = parentPath ? `${parentPath}.${error.property}` : error.property;
+        const ownMessages = Object.values((_a = error.constraints) !== null && _a !== void 0 ? _a : {}).map((message) => `${path}: ${message}`);
+        return [...ownMessages, ...flattenValidationErrors((_b = error.children) !== null && _b !== void 0 ? _b : [], path)];
+    });
+}
+//# sourceMappingURL=accessiValidation.js.map

package/dist/accessi-module/security/accessiValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessiValidation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessiValidation.ts"],"names":[],"mappings":";;AAUA,kEAmBC;AA7BD,2CAAsF;AACtF,+CAA6C;AAE7C;;;;;;GAMG;AACH,SAAgB,2BAA2B;IACzC,OAAO,IAAI,uBAAc,CAAC;QACxB,SAAS,EAAE,IAAI;QACf,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE;YAChB,wBAAwB,EAAE,IAAI;SAC/B;QACD,gBAAgB,EAAE,CAAC,MAAyB,EAAE,EAAE,CAC9C,IAAI,4BAAmB,CAAC;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,sBAAU,CAAC,KAAK;YAC5B,IAAI,EAAE,0BAA0B;YAChC,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,wCAAwC;YACjD,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC;SACzC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,uBAAuB,CAAC,MAAyB,EAAE,UAAU,GAAG,EAAE;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,uBAAuB,CAAC,MAAA,KAAK,CAAC,QAAQ,mCAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { BadRequestException, ValidationError, ValidationPipe } from '@nestjs/common';\nimport { StatusCode } from '../../Utilities';\n\n/**\n * Creates the validation pipe used by every Accessi bootstrap path.\n *\n * It deliberately returns one stable, documented error contract instead of\n * Nest's default array. Consumers can branch on `code`; `details` is safe to\n * display or log because it contains only DTO field names and validation text.\n */\nexport function createAccessiValidationPipe(): ValidationPipe {\n  return new ValidationPipe({\n    whitelist: true,\n    forbidNonWhitelisted: true,\n    transform: true,\n    transformOptions: {\n      enableImplicitConversion: true,\n    },\n    exceptionFactory: (errors: ValidationError[]) =>\n      new BadRequestException({\n        severity: 'error',\n        status: 400,\n        statusCode: StatusCode.Error,\n        code: 'ACCESSI_VALIDATION_ERROR',\n        error: 'ACCESSI_VALIDATION_ERROR',\n        message: 'La richiesta contiene dati non validi.',\n        details: flattenValidationErrors(errors),\n      }),\n  });\n}\n\n/** Converts nested class-validator failures into deterministic client details. */\nfunction flattenValidationErrors(errors: ValidationError[], parentPath = ''): string[] {\n  return errors.flatMap((error) => {\n    const path = parentPath ? `${parentPath}.${error.property}` : error.property;\n    const ownMessages = Object.values(error.constraints ?? {}).map((message) => `${path}: ${message}`);\n    return [...ownMessages, ...flattenValidationErrors(error.children ?? [], path)];\n  });\n}\n"]}

package/dist/accessi-module/security/adminBootstrap.d.ts

@@ -0,0 +1,8 @@
+/** Genera (una sola volta per processo) il token di bootstrap admin. */
+export declare function getOrCreateAdminBootstrapToken(): string;
+/** Token corrente, oppure null se non ancora generato. */
+export declare function getAdminBootstrapToken(): string | null;
+/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */
+export declare function clearAdminBootstrapToken(): void;
+/** Confronto a tempo costante del token candidato con quello generato. */
+export declare function isValidAdminBootstrapToken(candidate: unknown): boolean;

package/dist/accessi-module/security/adminBootstrap.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOrCreateAdminBootstrapToken = getOrCreateAdminBootstrapToken;
+exports.getAdminBootstrapToken = getAdminBootstrapToken;
+exports.clearAdminBootstrapToken = clearAdminBootstrapToken;
+exports.isValidAdminBootstrapToken = isValidAdminBootstrapToken;
+const crypto_1 = require("crypto");
+/**
+ * Token di bootstrap admin, valido per il singolo processo Accessi.
+ * Viene generato al primo accesso (avvio del modulo) e rigenerato a ogni riavvio: non e mai
+ * persistito ne restituito via API, e viene stampato solo nel log del backend.
+ */
+let processToken = null;
+/** Genera (una sola volta per processo) il token di bootstrap admin. */
+function getOrCreateAdminBootstrapToken() {
+    if (!processToken) {
+        processToken = (0, crypto_1.randomBytes)(32).toString('hex');
+    }
+    return processToken;
+}
+/** Token corrente, oppure null se non ancora generato. */
+function getAdminBootstrapToken() {
+    return processToken;
+}
+/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */
+function clearAdminBootstrapToken() {
+    processToken = null;
+}
+/** Confronto a tempo costante del token candidato con quello generato. */
+function isValidAdminBootstrapToken(candidate) {
+    if (!processToken || typeof candidate !== 'string' || candidate.length === 0) {
+        return false;
+    }
+    const expected = Buffer.from(processToken, 'utf8');
+    const provided = Buffer.from(candidate, 'utf8');
+    if (expected.length !== provided.length) {
+        return false;
+    }
+    return (0, crypto_1.timingSafeEqual)(expected, provided);
+}
+//# sourceMappingURL=adminBootstrap.js.map

package/dist/accessi-module/security/adminBootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminBootstrap.js","sourceRoot":"","sources":["../../../src/accessi-module/security/adminBootstrap.ts"],"names":[],"mappings":";;AAUA,wEAKC;AAGD,wDAEC;AAGD,4DAEC;AAGD,gEAYC;AAxCD,mCAAsD;AAEtD;;;;GAIG;AACH,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC,wEAAwE;AACxE,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,0DAA0D;AAC1D,SAAgB,sBAAsB;IACpC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iFAAiF;AACjF,SAAgB,wBAAwB;IACtC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,0BAA0B,CAAC,SAAkB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAA,wBAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { randomBytes, timingSafeEqual } from 'crypto';\n\n/**\n * Token di bootstrap admin, valido per il singolo processo Accessi.\n * Viene generato al primo accesso (avvio del modulo) e rigenerato a ogni riavvio: non e mai\n * persistito ne restituito via API, e viene stampato solo nel log del backend.\n */\nlet processToken: string | null = null;\n\n/** Genera (una sola volta per processo) il token di bootstrap admin. */\nexport function getOrCreateAdminBootstrapToken(): string {\n  if (!processToken) {\n    processToken = randomBytes(32).toString('hex');\n  }\n  return processToken;\n}\n\n/** Token corrente, oppure null se non ancora generato. */\nexport function getAdminBootstrapToken(): string | null {\n  return processToken;\n}\n\n/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */\nexport function clearAdminBootstrapToken(): void {\n  processToken = null;\n}\n\n/** Confronto a tempo costante del token candidato con quello generato. */\nexport function isValidAdminBootstrapToken(candidate: unknown): boolean {\n  if (!processToken || typeof candidate !== 'string' || candidate.length === 0) {\n    return false;\n  }\n\n  const expected = Buffer.from(processToken, 'utf8');\n  const provided = Buffer.from(candidate, 'utf8');\n  if (expected.length !== provided.length) {\n    return false;\n  }\n\n  return timingSafeEqual(expected, provided);\n}\n"]}

package/dist/accessi-module/security/audit.d.ts

@@ -0,0 +1,74 @@
+/** Record di audit normalizzato e gia redatto. */
+export interface AccessiAuditRecord {
+    event: string;
+    timestamp: string;
+    [key: string]: unknown;
+}
+/** Destinazione di un record di audit. */
+export interface AccessiAuditSink {
+    /** Nome usato nelle metriche di errore del sink. */
+    name?: string;
+    write(record: AccessiAuditRecord): void | Promise<void>;
+}
+export interface AccessiAuditQuery {
+    event?: string;
+    from?: string;
+    to?: string;
+    codiceUtente?: number;
+    limit?: number;
+    offset?: number;
+    order?: 'asc' | 'desc';
+}
+export interface AccessiAuditPage {
+    records: AccessiAuditRecord[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+/** Sink interrogabile dagli endpoint amministrativi e dalla retention. */
+export interface AccessiAuditQueryableSink extends AccessiAuditSink {
+    query(filter?: AccessiAuditQuery): Promise<AccessiAuditPage>;
+    purge(before: Date): Promise<number>;
+}
+/** Opzioni di audit del modulo. */
+export interface AccessiAuditOptions {
+    /** `false` disattiva i sink ma lascia il log strutturato. Default: abilitati. */
+    enabled?: boolean;
+    /** Sink aggiuntivi (HTTP, DB, OpenTelemetry). */
+    sinks?: AccessiAuditSink[];
+    /** Sink interrogabile usato da `/api/accessi/audit`. Default: primo sink queryable. */
+    store?: AccessiAuditQueryableSink;
+    /** Giorni di retention applicati ai sink queryable. Default: nessuna scadenza automatica. */
+    retentionDays?: number;
+    /** Chiavi aggiuntive da redigere, oltre a quelle predefinite. */
+    redact?: string[];
+    /** Etichetta tenant aggiunta a ogni record (multi-tenancy). */
+    tenantId?: string;
+    /** Scrivi anche sul Logger strutturato. Default: true. */
+    logger?: boolean;
+}
+/**
+ * Redige ricorsivamente token, segreti, cookie e header sensibili.
+ *
+ * Limita profondita, lunghezza delle stringhe e numero di elementi per evitare
+ * che un payload applicativo finisca per intero nell'audit.
+ */
+export declare function redactAccessiAuditValue(value: unknown, depth?: number): unknown;
+/**
+ * Configura i sink di audit del processo.
+ *
+ * Chiamato da `AccessiModule.forRoot`. Le opzioni sono globali: un solo modulo
+ * Accessi per processo e la configurazione consigliata.
+ */
+export declare function configureAccessiAudit(options: AccessiAuditOptions | undefined): void;
+/** Ripristina la configurazione iniziale (logger attivo, nessun sink). */
+export declare function resetAccessiAudit(): void;
+/** Sink interrogabile configurato, usato dagli endpoint amministrativi. */
+export declare function getAccessiAuditStore(): AccessiAuditQueryableSink | undefined;
+/**
+ * Registra un evento di sicurezza.
+ *
+ * Il record viene redatto prima di raggiungere logger e sink. Un sink guasto
+ * non interrompe mai il flusso applicativo.
+ */
+export declare function auditAccessi(event: string, details?: Record<string, unknown>): void;

package/dist/accessi-module/security/audit.js

@@ -0,0 +1,189 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactAccessiAuditValue = redactAccessiAuditValue;
+exports.configureAccessiAudit = configureAccessiAudit;
+exports.resetAccessiAudit = resetAccessiAudit;
+exports.getAccessiAuditStore = getAccessiAuditStore;
+exports.auditAccessi = auditAccessi;
+const Logger_1 = require("../../Logger");
+const metrics_1 = require("../observability/metrics");
+const REDACTED = '[REDACTED]';
+const TRUNCATED = '[TRUNCATED]';
+const DEFAULT_REDACTED_KEYS = new Set([
+    'token',
+    'accesstoken',
+    'refreshtoken',
+    'idtoken',
+    'bearer',
+    'jwt',
+    'authorization',
+    'cookie',
+    'setcookie',
+    'password',
+    'passwordhash',
+    'hashedpassword',
+    'resettoken',
+    'secret',
+    'clientsecret',
+    'privatekey',
+    'apikey',
+    'csrf',
+    'csrftoken',
+]);
+const MAX_STRING_LENGTH = 512;
+const MAX_ARRAY_LENGTH = 50;
+const MAX_OBJECT_KEYS = 100;
+const MAX_DEPTH = 4;
+const PURGE_INTERVAL_MS = 60 * 60 * 1000;
+let sinks = [];
+let redactedKeys = new Set(DEFAULT_REDACTED_KEYS);
+let retentionDays;
+let loggerEnabled = true;
+let auditTenantId;
+let lastPurgeAt = 0;
+function normalizedKey(key) {
+    return key.toLowerCase().replace(/[-_\s]/g, '');
+}
+/**
+ * Redige ricorsivamente token, segreti, cookie e header sensibili.
+ *
+ * Limita profondita, lunghezza delle stringhe e numero di elementi per evitare
+ * che un payload applicativo finisca per intero nell'audit.
+ */
+function redactAccessiAuditValue(value, depth = 0) {
+    if (depth > MAX_DEPTH)
+        return TRUNCATED;
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === 'string') {
+        return value.length > MAX_STRING_LENGTH ? `${value.slice(0, MAX_STRING_LENGTH - 3)}...` : value;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'bigint')
+        return value.toString();
+    if (value instanceof Date)
+        return value.toISOString();
+    if (value instanceof Error) {
+        return { name: value.name, message: redactAccessiAuditValue(value.message, depth + 1) };
+    }
+    if (Array.isArray(value)) {
+        return value.slice(0, MAX_ARRAY_LENGTH).map((item) => redactAccessiAuditValue(item, depth + 1));
+    }
+    if (typeof value === 'object') {
+        const result = {};
+        for (const [key, entry] of Object.entries(value).slice(0, MAX_OBJECT_KEYS)) {
+            result[key] = redactedKeys.has(normalizedKey(key))
+                ? REDACTED
+                : redactAccessiAuditValue(entry, depth + 1);
+        }
+        return result;
+    }
+    return String(value);
+}
+function redactDetails(details) {
+    return redactAccessiAuditValue(details);
+}
+function reportSinkError(sink, error) {
+    var _a;
+    (0, metrics_1.recordAccessiMetric)('accessi_audit_sink_errors_total', 1, { sink: (_a = sink.name) !== null && _a !== void 0 ? _a : 'unknown' });
+    try {
+        new Logger_1.Logger('AccessiAudit').error(`Audit sink non disponibile${sink.name ? ` (${sink.name})` : ''}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    catch (_b) {
+        // Il logging non deve mai interrompere l'operazione applicativa.
+    }
+}
+function writeToSink(sink, record) {
+    try {
+        const result = sink.write(record);
+        if (result && typeof result.catch === 'function') {
+            result.catch((error) => reportSinkError(sink, error));
+        }
+    }
+    catch (error) {
+        reportSinkError(sink, error);
+    }
+}
+function maybePurge() {
+    if (!retentionDays || retentionDays <= 0)
+        return;
+    const now = Date.now();
+    if (now - lastPurgeAt < PURGE_INTERVAL_MS)
+        return;
+    lastPurgeAt = now;
+    const before = new Date(now - retentionDays * 24 * 60 * 60 * 1000);
+    for (const sink of sinks) {
+        if (typeof sink.purge !== 'function')
+            continue;
+        try {
+            const result = sink.purge(before);
+            if (result && typeof result.catch === 'function') {
+                result.catch((error) => reportSinkError(sink, error));
+            }
+        }
+        catch (error) {
+            reportSinkError(sink, error);
+        }
+    }
+}
+/**
+ * Configura i sink di audit del processo.
+ *
+ * Chiamato da `AccessiModule.forRoot`. Le opzioni sono globali: un solo modulo
+ * Accessi per processo e la configurazione consigliata.
+ */
+function configureAccessiAudit(options) {
+    var _a, _b;
+    sinks = [];
+    redactedKeys = new Set(DEFAULT_REDACTED_KEYS);
+    retentionDays = undefined;
+    loggerEnabled = true;
+    auditTenantId = options === null || options === void 0 ? void 0 : options.tenantId;
+    lastPurgeAt = 0;
+    for (const key of (_a = options === null || options === void 0 ? void 0 : options.redact) !== null && _a !== void 0 ? _a : [])
+        redactedKeys.add(normalizedKey(key));
+    loggerEnabled = (options === null || options === void 0 ? void 0 : options.logger) !== false;
+    if ((options === null || options === void 0 ? void 0 : options.enabled) === false)
+        return;
+    if (options === null || options === void 0 ? void 0 : options.store)
+        sinks.push(options.store);
+    for (const sink of (_b = options === null || options === void 0 ? void 0 : options.sinks) !== null && _b !== void 0 ? _b : []) {
+        if (!sinks.includes(sink))
+            sinks.push(sink);
+    }
+    const days = Number(options === null || options === void 0 ? void 0 : options.retentionDays);
+    if (Number.isFinite(days) && days > 0)
+        retentionDays = days;
+}
+/** Ripristina la configurazione iniziale (logger attivo, nessun sink). */
+function resetAccessiAudit() {
+    configureAccessiAudit(undefined);
+}
+/** Sink interrogabile configurato, usato dagli endpoint amministrativi. */
+function getAccessiAuditStore() {
+    const configured = sinks.find((sink) => typeof sink.query === 'function'
+        && typeof sink.purge === 'function');
+    return configured;
+}
+/**
+ * Registra un evento di sicurezza.
+ *
+ * Il record viene redatto prima di raggiungere logger e sink. Un sink guasto
+ * non interrompe mai il flusso applicativo.
+ */
+function auditAccessi(event, details = {}) {
+    const record = Object.assign(Object.assign({ event, timestamp: new Date().toISOString() }, (auditTenantId ? { tenant: auditTenantId } : {})), redactDetails(details !== null && details !== void 0 ? details : {}));
+    if (loggerEnabled) {
+        try {
+            new Logger_1.Logger('AccessiAudit').warning(JSON.stringify(record));
+        }
+        catch (_a) {
+            // Il logging non deve mai interrompere l'operazione applicativa.
+        }
+    }
+    for (const sink of sinks)
+        writeToSink(sink, record);
+    maybePurge();
+}
+//# sourceMappingURL=audit.js.map