emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.80

package/dist/accessi-module/security/serviceTokenGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTokenGuard.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenGuard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyBA,wDAMC;AA/BD,2CAQwB;AACxB,uCAAyC;AAGzC,6FAAsI;AACtI,6DAAiE;AACjE,mEAAsE;AAEtE,iEAAiE;AACpD,QAAA,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,2EAA2E;AACpE,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAgB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,qCAA6B,EAAE,MAAM,CAAC,CAAC;AAAxG,QAAA,yBAAyB,6BAA+E;AAIrH,iGAAiG;AACjG,SAAgB,sBAAsB,CAAC,GAAY;IACjD,MAAM,QAAQ,GAAI,GAAkC,CAAC,mBAAmB,CAAC;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,8BAAqB,CAAC,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,mBAAwC,EACxC,SAAoB,EACO,cAA8B;QAFzD,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,cAAS,GAAT,SAAS,CAAW;QACO,mBAAc,GAAd,cAAc,CAAgB;IACzE,CAAC;IAEE,WAAW,CAAC,OAAyB;;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;YAC7D,MAAM,EAAE,GAAG,MAAA,MAAA,OAAO,CAAC,EAAE,mCAAI,MAAA,OAAO,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC;YACpE,MAAM,IAAA,mDAA2B,EAAC,EAAE,EAAE,MAAA,IAAI,CAAC,cAAc,CAAC,aAAa,0CAAE,cAAc,CAAC,CAAC;YAEzF,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,8BAAqB,CAAC,mDAAmD,CAAC,CAAC;YACvF,CAAC;YAEA,OAAsC,CAAC,mBAAmB,GAAG,QAAQ,CAAC;YAEvE,MAAM,cAAc,GAAG,MAAA,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,qCAA6B,EAAE;gBAC/F,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,mCAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAA,0CAAoB,EAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,2BAAkB,CAAC,UAAU,YAAY,qCAAqC,CAAC,CAAC;YAC5F,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;CACF,CAAA;AAnCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFY,yCAAmB;QAC7B,gBAAS;GAH5B,iBAAiB,CAmC7B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport type { Request } from 'express';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ServiceTokenService, serviceTokenHasScope, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';\nimport { extractAccessiBearerToken } from './authenticatedToken';\nimport { assertServiceTokenRateLimit } from './serviceTokenRateLimit';\n\n/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */\nexport const SERVICE_TOKEN_SCOPES_METADATA = 'accessi:service-token-scopes';\n\n/** Richiede che il token di servizio presenti tutti gli scope indicati. */\nexport const RequireServiceTokenScopes = (...scopes: string[]) => SetMetadata(SERVICE_TOKEN_SCOPES_METADATA, scopes);\n\nexport type AccessiServiceTokenRequest = Request & { accessiServiceToken?: VerifiedServiceToken };\n\n/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */\nexport function getAccessiServiceToken(req: Request): VerifiedServiceToken {\n  const verified = (req as AccessiServiceTokenRequest).accessiServiceToken;\n  if (!verified) {\n    throw new UnauthorizedException('Token di servizio non verificato.');\n  }\n  return verified;\n}\n\n/**\n * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.\n *\n * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano\n * con `@RequireServiceTokenScopes('ia')`.\n */\n@Injectable()\nexport class ServiceTokenGuard implements CanActivate {\n  constructor(\n    private readonly serviceTokenService: ServiceTokenService,\n    private readonly reflector: Reflector,\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest<Request>();\n    const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';\n    await assertServiceTokenRateLimit(ip, this.accessiOptions.serviceTokens?.rateLimitStore);\n\n    const token = extractAccessiBearerToken(request.headers['authorization']);\n    if (!token) {\n      throw new UnauthorizedException('Token di servizio mancante.');\n    }\n\n    const verified = await this.serviceTokenService.verify(token, { ip });\n    if (!verified) {\n      throw new UnauthorizedException('Token di servizio non valido, scaduto o revocato.');\n    }\n\n    (request as AccessiServiceTokenRequest).accessiServiceToken = verified;\n\n    const requiredScopes = this.reflector.getAllAndOverride<string[]>(SERVICE_TOKEN_SCOPES_METADATA, [\n      context.getHandler(),\n      context.getClass(),\n    ]) ?? [];\n    const missingScope = requiredScopes.find((scope) => !serviceTokenHasScope(verified.scopes, scope));\n    if (missingScope) {\n      throw new ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);\n    }\n\n    return true;\n  }\n}\n"]}

package/dist/accessi-module/security/serviceTokenRateLimit.d.ts

@@ -0,0 +1,9 @@
+import type { RateLimitStore } from './rateLimitStore';
+export declare function checkServiceTokenRateLimit(identifier: string, store?: RateLimitStore): Promise<{
+    allowed: boolean;
+    retryAfterSeconds: number;
+}>;
+/** Svuota i bucket dello store di default (usato nei test). */
+export declare function resetServiceTokenRateLimit(): void;
+/** Lancia 429 con `Retry-After` quando il limite e superato. */
+export declare function assertServiceTokenRateLimit(identifier: string, store?: RateLimitStore): Promise<void>;

package/dist/accessi-module/security/serviceTokenRateLimit.js

@@ -0,0 +1,56 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkServiceTokenRateLimit = checkServiceTokenRateLimit;
+exports.resetServiceTokenRateLimit = resetServiceTokenRateLimit;
+exports.assertServiceTokenRateLimit = assertServiceTokenRateLimit;
+const common_1 = require("@nestjs/common");
+const rateLimitStore_1 = require("./rateLimitStore");
+const metrics_1 = require("../observability/metrics");
+/**
+ * Limite anti-abuso per la verifica dei token di servizio.
+ *
+ * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita
+ * che un client difettoso o malevolo martelli l'endpoint. Con `serviceTokens.rateLimitStore`
+ * e possibile usare uno store condiviso in cluster.
+ */
+const WINDOW_MS = 60000;
+const MAX_ATTEMPTS = 120;
+function checkServiceTokenRateLimit(identifier_1) {
+    return __awaiter(this, arguments, void 0, function* (identifier, store = (0, rateLimitStore_1.getDefaultRateLimitStore)()) {
+        const key = identifier && identifier.trim() !== '' ? identifier.trim() : 'unknown';
+        try {
+            return yield store.consume(`service-token|${key}`, WINDOW_MS, MAX_ATTEMPTS);
+        }
+        catch (_a) {
+            (0, metrics_1.recordAccessiMetric)('accessi_store_errors_total', 1, { store: 'service_token_rate_limit' });
+            throw new common_1.HttpException({
+                code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',
+                message: 'Rate limit non disponibile. Riprova piu tardi.',
+            }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+        }
+    });
+}
+/** Svuota i bucket dello store di default (usato nei test). */
+function resetServiceTokenRateLimit() {
+    (0, rateLimitStore_1.getDefaultRateLimitStore)().reset();
+}
+/** Lancia 429 con `Retry-After` quando il limite e superato. */
+function assertServiceTokenRateLimit(identifier, store) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const decision = yield checkServiceTokenRateLimit(identifier, store);
+        if (!decision.allowed) {
+            (0, metrics_1.recordAccessiMetric)('accessi_rate_limit_blocked_total', 1, { layer: 'service_token' });
+            throw new common_1.HttpException({ code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' }, common_1.HttpStatus.TOO_MANY_REQUESTS);
+        }
+    });
+}
+//# sourceMappingURL=serviceTokenRateLimit.js.map

package/dist/accessi-module/security/serviceTokenRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTokenRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenRateLimit.ts"],"names":[],"mappings":";;;;;;;;;;;AAeA,gEAiBC;AAGD,gEAEC;AAGD,kEAYC;AApDD,2CAA2D;AAC3D,qDAA4D;AAE5D,sDAA+D;AAE/D;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,KAAM,CAAC;AACzB,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,SAAsB,0BAA0B;yDAC9C,UAAkB,EAClB,QAAwB,IAAA,yCAAwB,GAAE;QAElD,MAAM,GAAG,GAAG,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9E,CAAC;QAAC,WAAM,CAAC;YACP,IAAA,6BAAmB,EAAC,4BAA4B,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5F,MAAM,IAAI,sBAAa,CACrB;gBACE,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,gDAAgD;aAC1D,EACD,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;CAAA;AAED,+DAA+D;AAC/D,SAAgB,0BAA0B;IACxC,IAAA,yCAAwB,GAAE,CAAC,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,gEAAgE;AAChE,SAAsB,2BAA2B,CAC/C,UAAkB,EAClB,KAAsB;;QAEtB,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAA,6BAAmB,EAAC,kCAAkC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACvF,MAAM,IAAI,sBAAa,CACrB,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAC/F,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { HttpException, HttpStatus } from '@nestjs/common';\nimport { getDefaultRateLimitStore } from './rateLimitStore';\nimport type { RateLimitStore } from './rateLimitStore';\nimport { recordAccessiMetric } from '../observability/metrics';\n\n/**\n * Limite anti-abuso per la verifica dei token di servizio.\n *\n * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita\n * che un client difettoso o malevolo martelli l'endpoint. Con `serviceTokens.rateLimitStore`\n * e possibile usare uno store condiviso in cluster.\n */\nconst WINDOW_MS = 60_000;\nconst MAX_ATTEMPTS = 120;\n\nexport async function checkServiceTokenRateLimit(\n  identifier: string,\n  store: RateLimitStore = getDefaultRateLimitStore(),\n): Promise<{ allowed: boolean; retryAfterSeconds: number }> {\n  const key = identifier && identifier.trim() !== '' ? identifier.trim() : 'unknown';\n  try {\n    return await store.consume(`service-token|${key}`, WINDOW_MS, MAX_ATTEMPTS);\n  } catch {\n    recordAccessiMetric('accessi_store_errors_total', 1, { store: 'service_token_rate_limit' });\n    throw new HttpException(\n      {\n        code: 'ACCESSI_RATE_LIMIT_UNAVAILABLE',\n        message: 'Rate limit non disponibile. Riprova piu tardi.',\n      },\n      HttpStatus.SERVICE_UNAVAILABLE,\n    );\n  }\n}\n\n/** Svuota i bucket dello store di default (usato nei test). */\nexport function resetServiceTokenRateLimit(): void {\n  getDefaultRateLimitStore().reset();\n}\n\n/** Lancia 429 con `Retry-After` quando il limite e superato. */\nexport async function assertServiceTokenRateLimit(\n  identifier: string,\n  store?: RateLimitStore,\n): Promise<void> {\n  const decision = await checkServiceTokenRateLimit(identifier, store);\n  if (!decision.allowed) {\n    recordAccessiMetric('accessi_rate_limit_blocked_total', 1, { layer: 'service_token' });\n    throw new HttpException(\n      { code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' },\n      HttpStatus.TOO_MANY_REQUESTS,\n    );\n  }\n}\n"]}

package/dist/accessi-module/security/sessionRevocation.d.ts

@@ -0,0 +1,67 @@
+import type { AccessiOptions } from '../AccessiModule';
+/**
+ * Revoca delle sessioni per utente.
+ *
+ * La revoca e un timestamp: un token emesso prima del cutoff viene rifiutato.
+ * I token emessi dopo il cutoff restano validi. I token includono `iatMs`
+ * (millisecondi) per rendere la revoca deterministica anche quando il cambio
+ * password e il login avvengono nello stesso secondo; per i token legacy senza
+ * `iatMs` si usa `iat` in secondi.
+ */
+export interface SessionRevocationStore {
+    revokeUser(codiceUtente: number, revokedAtMs: number): Promise<void>;
+    getUserRevocation(codiceUtente: number): Promise<number | null>;
+    /** Health check opzionale per readiness del servizio. */
+    healthCheck?(): Promise<boolean>;
+}
+export interface SessionRevocationOptions {
+    /** Default: disabilitata se non viene fornito uno store. */
+    enabled?: boolean;
+    /** Store condiviso (es. Redis) per invalidare le sessioni tra istanze. */
+    store?: SessionRevocationStore;
+    /** TTL delle chiavi Redis. Default: 365 giorni. */
+    ttlMs?: number;
+}
+export interface MemorySessionRevocationStore extends SessionRevocationStore {
+    clear(): void;
+}
+export declare function createMemorySessionRevocationStore(): MemorySessionRevocationStore;
+export interface SessionRevocationRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+export interface RedisSessionRevocationStoreOptions {
+    client: SessionRevocationRedisClient;
+    /** Default: `accessi:revoked-user:`. */
+    keyPrefix?: string;
+    /** Default: 365 giorni. */
+    ttlMs?: number;
+}
+/**
+ * Store Redis per la revoca sessioni.
+ *
+ * `revokeUser` scrive un timestamp con TTL; `getUserRevocation` lo legge.
+ * Il TTL deve essere maggiore della durata massima dei token.
+ */
+export declare function createRedisSessionRevocationStore(options: RedisSessionRevocationStoreOptions): SessionRevocationStore;
+/** Store di default in memoria, usato quando `sessionRevocation.store` non e configurato ma la revoca e abilitata. */
+export declare function getSessionRevocationStore(options: AccessiOptions): SessionRevocationStore | undefined;
+/**
+ * Issued-at in millisecondi. I token emessi da questa versione includono `iatMs`;
+ * per quelli legacy si ricade su `iat` (secondi) per restare compatibili.
+ */
+export declare function resolveAccessiTokenIssuedAtMs(payload: Record<string, unknown>): number | null;
+/**
+ * True se il token e stato revocato: famiglia refresh revocata, `jti` revocato
+ * oppure sessione utente revocata prima dell'emissione del token.
+ */
+export declare function isAccessiTokenRevoked(options: AccessiOptions, payload: Record<string, unknown>, codiceUtente: number): Promise<boolean>;
+/** Revoca tutte le sessioni dell'utente. Richiede uno store configurato. */
+export declare function revokeAccessiUserSessions(options: AccessiOptions, codiceUtente: number, revokedAtMs?: number, reason?: string): Promise<void>;
+/**
+ * Variante per i flussi applicativi (cambio password, blocco, cancellazione):
+ * se la revoca non e configurata non fallisce, perche quei flussi devono
+ * continuare a funzionare anche senza store condiviso.
+ */
+export declare function revokeAccessiUserSessionsIfConfigured(options: AccessiOptions, codiceUtente: number, reason?: string, revokedAtMs?: number): Promise<boolean>;
+/** Solo per test: azzera lo store in memoria di default. */
+export declare function clearDefaultSessionRevocations(): void;

package/dist/accessi-module/security/sessionRevocation.js

@@ -0,0 +1,174 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemorySessionRevocationStore = createMemorySessionRevocationStore;
+exports.createRedisSessionRevocationStore = createRedisSessionRevocationStore;
+exports.getSessionRevocationStore = getSessionRevocationStore;
+exports.resolveAccessiTokenIssuedAtMs = resolveAccessiTokenIssuedAtMs;
+exports.isAccessiTokenRevoked = isAccessiTokenRevoked;
+exports.revokeAccessiUserSessions = revokeAccessiUserSessions;
+exports.revokeAccessiUserSessionsIfConfigured = revokeAccessiUserSessionsIfConfigured;
+exports.clearDefaultSessionRevocations = clearDefaultSessionRevocations;
+const redisMetrics_1 = require("../observability/redisMetrics");
+const audit_1 = require("./audit");
+const metrics_1 = require("../observability/metrics");
+const accessTokenRevocation_1 = require("./accessTokenRevocation");
+const refreshTokenRotation_1 = require("./refreshTokenRotation");
+const REVOKE_USER_SCRIPT = "if tonumber(ARGV[2]) > 0 then return redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2]) else return redis.call('SET', KEYS[1], ARGV[1]) end";
+const GET_USER_SCRIPT = "return redis.call('GET', KEYS[1])";
+function createMemorySessionRevocationStore() {
+    const revokedAt = new Map();
+    return {
+        revokeUser(codiceUtente, timestamp) {
+            return __awaiter(this, void 0, void 0, function* () {
+                revokedAt.set(codiceUtente, timestamp);
+            });
+        },
+        getUserRevocation(codiceUtente) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                return (_a = revokedAt.get(codiceUtente)) !== null && _a !== void 0 ? _a : null;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                return true;
+            });
+        },
+        clear() {
+            revokedAt.clear();
+        },
+    };
+}
+/**
+ * Store Redis per la revoca sessioni.
+ *
+ * `revokeUser` scrive un timestamp con TTL; `getUserRevocation` lo legge.
+ * Il TTL deve essere maggiore della durata massima dei token.
+ */
+function createRedisSessionRevocationStore(options) {
+    var _a, _b;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis session revocation store: client.eval non configurato.');
+    }
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:revoked-user:').replace(/:+$/, ':');
+    const ttlMs = Math.max(0, Math.trunc((_b = options.ttlMs) !== null && _b !== void 0 ? _b : 365 * 24 * 60 * 60 * 1000));
+    const client = (0, redisMetrics_1.instrumentAccessiRedisClient)('session_revocation', options.client);
+    return {
+        revokeUser(codiceUtente, revokedAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield client.eval(REVOKE_USER_SCRIPT, 1, `${keyPrefix}${codiceUtente}`, String(revokedAtMs), ttlMs);
+            });
+        },
+        getUserRevocation(codiceUtente) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const value = yield client.eval(GET_USER_SCRIPT, 1, `${keyPrefix}${codiceUtente}`);
+                if (typeof value !== 'string' && typeof value !== 'number')
+                    return null;
+                const timestamp = Number(value);
+                return Number.isFinite(timestamp) ? timestamp : null;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const result = yield client.eval("return redis.call('PING')", 0);
+                    return String(result).toUpperCase() === 'PONG';
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+    };
+}
+const defaultMemoryStore = createMemorySessionRevocationStore();
+/** Store di default in memoria, usato quando `sessionRevocation.store` non e configurato ma la revoca e abilitata. */
+function getSessionRevocationStore(options) {
+    var _a, _b, _c;
+    if (((_a = options.sessionRevocation) === null || _a === void 0 ? void 0 : _a.enabled) === false)
+        return undefined;
+    if ((_b = options.sessionRevocation) === null || _b === void 0 ? void 0 : _b.store)
+        return options.sessionRevocation.store;
+    return ((_c = options.sessionRevocation) === null || _c === void 0 ? void 0 : _c.enabled) === true ? defaultMemoryStore : undefined;
+}
+/**
+ * Issued-at in millisecondi. I token emessi da questa versione includono `iatMs`;
+ * per quelli legacy si ricade su `iat` (secondi) per restare compatibili.
+ */
+function resolveAccessiTokenIssuedAtMs(payload) {
+    const issuedAtMs = Number(payload.iatMs);
+    if (Number.isFinite(issuedAtMs) && issuedAtMs > 0)
+        return issuedAtMs;
+    const issuedAt = Number(payload.iat);
+    if (!Number.isFinite(issuedAt))
+        return null;
+    return issuedAt * 1000;
+}
+/**
+ * True se il token e stato revocato: famiglia refresh revocata, `jti` revocato
+ * oppure sessione utente revocata prima dell'emissione del token.
+ */
+function isAccessiTokenRevoked(options, payload, codiceUtente) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (yield (0, refreshTokenRotation_1.isRefreshTokenFamilyRevoked)(options, payload.fid))
+            return true;
+        if (yield (0, accessTokenRevocation_1.isAccessiAccessTokenRevoked)(options, payload))
+            return true;
+        const store = getSessionRevocationStore(options);
+        if (!store)
+            return false;
+        const issuedAtMs = resolveAccessiTokenIssuedAtMs(payload);
+        if (issuedAtMs === null)
+            return true;
+        const revokedAt = yield store.getUserRevocation(codiceUtente);
+        if (revokedAt === null)
+            return false;
+        // I token emessi da questa versione hanno `iatMs`: un token emesso nello
+        // stesso millisecondo della revoca e considerato revocato. Per i token
+        // legacy (solo `iat`, secondi) si mantiene il confronto per secondo.
+        const preciseIssuedAtMs = Number(payload.iatMs);
+        if (Number.isFinite(preciseIssuedAtMs) && preciseIssuedAtMs > 0) {
+            return issuedAtMs <= revokedAt;
+        }
+        return issuedAtMs < Math.floor(revokedAt / 1000) * 1000;
+    });
+}
+/** Revoca tutte le sessioni dell'utente. Richiede uno store configurato. */
+function revokeAccessiUserSessions(options_1, codiceUtente_1) {
+    return __awaiter(this, arguments, void 0, function* (options, codiceUtente, revokedAtMs = Date.now(), reason = 'manual') {
+        const store = getSessionRevocationStore(options);
+        if (!store) {
+            throw new Error('Session revocation store non configurato.');
+        }
+        yield store.revokeUser(codiceUtente, revokedAtMs);
+        (0, audit_1.auditAccessi)('accessi_sessions_revoked', { codiceUtente, revokedAtMs, reason });
+        (0, metrics_1.countAccessiMetric)(options, 'sessions_revoked_total', { reason });
+    });
+}
+/**
+ * Variante per i flussi applicativi (cambio password, blocco, cancellazione):
+ * se la revoca non e configurata non fallisce, perche quei flussi devono
+ * continuare a funzionare anche senza store condiviso.
+ */
+function revokeAccessiUserSessionsIfConfigured(options_1, codiceUtente_1) {
+    return __awaiter(this, arguments, void 0, function* (options, codiceUtente, reason = 'manual', revokedAtMs = Date.now()) {
+        if (!getSessionRevocationStore(options))
+            return false;
+        yield revokeAccessiUserSessions(options, codiceUtente, revokedAtMs, reason);
+        return true;
+    });
+}
+/** Solo per test: azzera lo store in memoria di default. */
+function clearDefaultSessionRevocations() {
+    defaultMemoryStore.clear();
+}
+//# sourceMappingURL=sessionRevocation.js.map

package/dist/accessi-module/security/sessionRevocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRevocation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/sessionRevocation.ts"],"names":[],"mappings":";;;;;;;;;;;AAuCA,gFAgBC;AAoBD,8EA0CC;AAKD,8DAIC;AAMD,sEAOC;AAMD,sDAyBC;AAGD,8DAaC;AAOD,sFASC;AAGD,wEAEC;AA9MD,gEAA6E;AAC7E,mCAAuC;AACvC,sDAA8D;AAAA,mEAAsE;AACpI,iEAAqE;AA+BrE,MAAM,kBAAkB,GACtB,6IAA6I,CAAC;AAChJ,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,SAAgB,kCAAkC;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,OAAO;QACC,UAAU,CAAC,YAAY,EAAE,SAAS;;gBACtC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACzC,CAAC;SAAA;QACK,iBAAiB,CAAC,YAAY;;;gBAClC,OAAO,MAAA,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,mCAAI,IAAI,CAAC;YAC7C,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACD,KAAK;YACH,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAcD;;;;;GAKG;AACH,SAAgB,iCAAiC,CAC/C,OAA2C;;IAE3C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAA,2CAA4B,EAAC,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAElF,OAAO;QACC,UAAU,CAAC,YAAY,EAAE,WAAW;;gBACxC,MAAM,MAAM,CAAC,IAAI,CACf,kBAAkB,EAClB,CAAC,EACD,GAAG,SAAS,GAAG,YAAY,EAAE,EAC7B,MAAM,CAAC,WAAW,CAAC,EACnB,KAAK,CACN,CAAC;YACJ,CAAC;SAAA;QAEK,iBAAiB,CAAC,YAAY;;gBAClC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAC7B,eAAe,EACf,CAAC,EACD,GAAG,SAAS,GAAG,YAAY,EAAE,CAC9B,CAAC;gBACF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBACxE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,CAAC;SAAA;QAEK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,kCAAkC,EAAE,CAAC;AAEhE,sHAAsH;AACtH,SAAgB,yBAAyB,CAAC,OAAuB;;IAC/D,IAAI,CAAA,MAAA,OAAO,CAAC,iBAAiB,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,MAAA,OAAO,CAAC,iBAAiB,0CAAE,KAAK;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;IAC7E,OAAO,CAAA,MAAA,OAAO,CAAC,iBAAiB,0CAAE,OAAO,MAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,SAAgB,6BAA6B,CAAC,OAAgC;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAErE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,QAAQ,GAAG,IAAI,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAsB,qBAAqB,CACzC,OAAuB,EACvB,OAAgC,EAChC,YAAoB;;QAEpB,IAAI,MAAM,IAAA,kDAA2B,EAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzE,IAAI,MAAM,IAAA,mDAA2B,EAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAErE,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAErC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAErC,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,UAAU,IAAI,SAAS,CAAC;QACjC,CAAC;QACD,OAAO,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,CAAC;CAAA;AAED,4EAA4E;AAC5E,SAAsB,yBAAyB;yDAC7C,OAAuB,EACvB,YAAoB,EACpB,cAAsB,IAAI,CAAC,GAAG,EAAE,EAChC,SAAiB,QAAQ;QAEzB,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAClD,IAAA,oBAAY,EAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,IAAA,4BAAkB,EAAC,OAAO,EAAE,wBAAwB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;CAAA;AAED;;;;GAIG;AACH,SAAsB,qCAAqC;yDACzD,OAAuB,EACvB,YAAoB,EACpB,SAAiB,QAAQ,EACzB,cAAsB,IAAI,CAAC,GAAG,EAAE;QAEhC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,yBAAyB,CAAC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,4DAA4D;AAC5D,SAAgB,8BAA8B;IAC5C,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\nimport { instrumentAccessiRedisClient } from '../observability/redisMetrics';\nimport { auditAccessi } from './audit';\nimport { countAccessiMetric } from '../observability/metrics';import { isAccessiAccessTokenRevoked } from './accessTokenRevocation';\nimport { isRefreshTokenFamilyRevoked } from './refreshTokenRotation';\n\n/**\n * Revoca delle sessioni per utente.\n *\n * La revoca e un timestamp: un token emesso prima del cutoff viene rifiutato.\n * I token emessi dopo il cutoff restano validi. I token includono `iatMs`\n * (millisecondi) per rendere la revoca deterministica anche quando il cambio\n * password e il login avvengono nello stesso secondo; per i token legacy senza\n * `iatMs` si usa `iat` in secondi.\n */\nexport interface SessionRevocationStore {\n  revokeUser(codiceUtente: number, revokedAtMs: number): Promise<void>;\n  getUserRevocation(codiceUtente: number): Promise<number | null>;\n  /** Health check opzionale per readiness del servizio. */\n  healthCheck?(): Promise<boolean>;\n}\n\nexport interface SessionRevocationOptions {\n  /** Default: disabilitata se non viene fornito uno store. */\n  enabled?: boolean;\n  /** Store condiviso (es. Redis) per invalidare le sessioni tra istanze. */\n  store?: SessionRevocationStore;\n  /** TTL delle chiavi Redis. Default: 365 giorni. */\n  ttlMs?: number;\n}\n\nexport interface MemorySessionRevocationStore extends SessionRevocationStore {\n  clear(): void;\n}\n\nconst REVOKE_USER_SCRIPT =\n  \"if tonumber(ARGV[2]) > 0 then return redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2]) else return redis.call('SET', KEYS[1], ARGV[1]) end\";\nconst GET_USER_SCRIPT = \"return redis.call('GET', KEYS[1])\";\n\nexport function createMemorySessionRevocationStore(): MemorySessionRevocationStore {\n  const revokedAt = new Map<number, number>();\n  return {\n    async revokeUser(codiceUtente, timestamp) {\n      revokedAt.set(codiceUtente, timestamp);\n    },\n    async getUserRevocation(codiceUtente) {\n      return revokedAt.get(codiceUtente) ?? null;\n    },\n    async healthCheck() {\n      return true;\n    },\n    clear() {\n      revokedAt.clear();\n    },\n  };\n}\n\nexport interface SessionRevocationRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisSessionRevocationStoreOptions {\n  client: SessionRevocationRedisClient;\n  /** Default: `accessi:revoked-user:`. */\n  keyPrefix?: string;\n  /** Default: 365 giorni. */\n  ttlMs?: number;\n}\n\n/**\n * Store Redis per la revoca sessioni.\n *\n * `revokeUser` scrive un timestamp con TTL; `getUserRevocation` lo legge.\n * Il TTL deve essere maggiore della durata massima dei token.\n */\nexport function createRedisSessionRevocationStore(\n  options: RedisSessionRevocationStoreOptions,\n): SessionRevocationStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis session revocation store: client.eval non configurato.');\n  }\n\n  const keyPrefix = (options.keyPrefix ?? 'accessi:revoked-user:').replace(/:+$/, ':');\n  const ttlMs = Math.max(0, Math.trunc(options.ttlMs ?? 365 * 24 * 60 * 60 * 1000));\n  const client = instrumentAccessiRedisClient('session_revocation', options.client);\n\n  return {\n    async revokeUser(codiceUtente, revokedAtMs) {\n      await client.eval(\n        REVOKE_USER_SCRIPT,\n        1,\n        `${keyPrefix}${codiceUtente}`,\n        String(revokedAtMs),\n        ttlMs,\n      );\n    },\n\n    async getUserRevocation(codiceUtente) {\n      const value = await client.eval(\n        GET_USER_SCRIPT,\n        1,\n        `${keyPrefix}${codiceUtente}`,\n      );\n      if (typeof value !== 'string' && typeof value !== 'number') return null;\n      const timestamp = Number(value);\n      return Number.isFinite(timestamp) ? timestamp : null;\n    },\n\n    async healthCheck() {\n      try {\n        const result = await client.eval(\"return redis.call('PING')\", 0);\n        return String(result).toUpperCase() === 'PONG';\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n\nconst defaultMemoryStore = createMemorySessionRevocationStore();\n\n/** Store di default in memoria, usato quando `sessionRevocation.store` non e configurato ma la revoca e abilitata. */\nexport function getSessionRevocationStore(options: AccessiOptions): SessionRevocationStore | undefined {\n  if (options.sessionRevocation?.enabled === false) return undefined;\n  if (options.sessionRevocation?.store) return options.sessionRevocation.store;\n  return options.sessionRevocation?.enabled === true ? defaultMemoryStore : undefined;\n}\n\n/**\n * Issued-at in millisecondi. I token emessi da questa versione includono `iatMs`;\n * per quelli legacy si ricade su `iat` (secondi) per restare compatibili.\n */\nexport function resolveAccessiTokenIssuedAtMs(payload: Record<string, unknown>): number | null {\n  const issuedAtMs = Number(payload.iatMs);\n  if (Number.isFinite(issuedAtMs) && issuedAtMs > 0) return issuedAtMs;\n\n  const issuedAt = Number(payload.iat);\n  if (!Number.isFinite(issuedAt)) return null;\n  return issuedAt * 1000;\n}\n\n/**\n * True se il token e stato revocato: famiglia refresh revocata, `jti` revocato\n * oppure sessione utente revocata prima dell'emissione del token.\n */\nexport async function isAccessiTokenRevoked(\n  options: AccessiOptions,\n  payload: Record<string, unknown>,\n  codiceUtente: number,\n): Promise<boolean> {\n  if (await isRefreshTokenFamilyRevoked(options, payload.fid)) return true;\n  if (await isAccessiAccessTokenRevoked(options, payload)) return true;\n\n  const store = getSessionRevocationStore(options);\n  if (!store) return false;\n\n  const issuedAtMs = resolveAccessiTokenIssuedAtMs(payload);\n  if (issuedAtMs === null) return true;\n\n  const revokedAt = await store.getUserRevocation(codiceUtente);\n  if (revokedAt === null) return false;\n\n  // I token emessi da questa versione hanno `iatMs`: un token emesso nello\n  // stesso millisecondo della revoca e considerato revocato. Per i token\n  // legacy (solo `iat`, secondi) si mantiene il confronto per secondo.\n  const preciseIssuedAtMs = Number(payload.iatMs);\n  if (Number.isFinite(preciseIssuedAtMs) && preciseIssuedAtMs > 0) {\n    return issuedAtMs <= revokedAt;\n  }\n  return issuedAtMs < Math.floor(revokedAt / 1000) * 1000;\n}\n\n/** Revoca tutte le sessioni dell'utente. Richiede uno store configurato. */\nexport async function revokeAccessiUserSessions(\n  options: AccessiOptions,\n  codiceUtente: number,\n  revokedAtMs: number = Date.now(),\n  reason: string = 'manual',\n): Promise<void> {\n  const store = getSessionRevocationStore(options);\n  if (!store) {\n    throw new Error('Session revocation store non configurato.');\n  }\n  await store.revokeUser(codiceUtente, revokedAtMs);\n  auditAccessi('accessi_sessions_revoked', { codiceUtente, revokedAtMs, reason });\n  countAccessiMetric(options, 'sessions_revoked_total', { reason });\n}\n\n/**\n * Variante per i flussi applicativi (cambio password, blocco, cancellazione):\n * se la revoca non e configurata non fallisce, perche quei flussi devono\n * continuare a funzionare anche senza store condiviso.\n */\nexport async function revokeAccessiUserSessionsIfConfigured(\n  options: AccessiOptions,\n  codiceUtente: number,\n  reason: string = 'manual',\n  revokedAtMs: number = Date.now(),\n): Promise<boolean> {\n  if (!getSessionRevocationStore(options)) return false;\n  await revokeAccessiUserSessions(options, codiceUtente, revokedAtMs, reason);\n  return true;\n}\n\n/** Solo per test: azzera lo store in memoria di default. */\nexport function clearDefaultSessionRevocations(): void {\n  defaultMemoryStore.clear();\n}\n"]}

package/dist/accessi-module/security/validateOptions.d.ts

@@ -0,0 +1,19 @@
+import type { AccessiOptions } from '../AccessiModule';
+export interface AccessiOptionsValidationIssue {
+    code: string;
+    message: string;
+}
+export interface AccessiOptionsValidationResult {
+    errors: AccessiOptionsValidationIssue[];
+    warnings: AccessiOptionsValidationIssue[];
+}
+/**
+ * Validazione fail-fast della configurazione Accessi.
+ *
+ * `createAccessiService` usa `assertValidAccessiOptions`; i bootstrap esistenti
+ * possono usare `validateAccessiOptions` per loggare warning senza rompere il
+ * comportamento storico.
+ */
+export declare function validateAccessiOptions(options: AccessiOptions): AccessiOptionsValidationResult;
+/** Lancia un errore aggregato se la configurazione non e valida. */
+export declare function assertValidAccessiOptions(options: AccessiOptions): void;

package/dist/accessi-module/security/validateOptions.js

@@ -0,0 +1,176 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAccessiOptions = validateAccessiOptions;
+exports.assertValidAccessiOptions = assertValidAccessiOptions;
+const crypto_1 = require("crypto");
+const authCookies_1 = require("./authCookies");
+function isHttpUrl(value) {
+    if (!value)
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:';
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function positive(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0;
+}
+/**
+ * Validazione fail-fast della configurazione Accessi.
+ *
+ * `createAccessiService` usa `assertValidAccessiOptions`; i bootstrap esistenti
+ * possono usare `validateAccessiOptions` per loggare warning senza rompere il
+ * comportamento storico.
+ */
+function validateAccessiOptions(options) {
+    var _a, _b, _c, _d, _e;
+    const errors = [];
+    const warnings = [];
+    const addError = (code, message) => errors.push({ code, message });
+    const addWarning = (code, message) => warnings.push({ code, message });
+    if (!(options === null || options === void 0 ? void 0 : options.databaseOptions)) {
+        addError('ACCESSI_DB_OPTIONS_MISSING', 'databaseOptions e obbligatorio.');
+    }
+    const jwt = options === null || options === void 0 ? void 0 : options.jwtOptions;
+    const secret = (jwt === null || jwt === void 0 ? void 0 : jwt.secret) || process.env.ACC_JWT_SECRET;
+    if (!secret) {
+        addError('ACCESSI_JWT_SECRET_MISSING', 'jwtOptions.secret e obbligatorio.');
+    }
+    else if (secret.length < 32) {
+        addWarning('ACCESSI_JWT_SECRET_WEAK', 'jwtOptions.secret dovrebbe avere almeno 32 caratteri.');
+    }
+    if (!(jwt === null || jwt === void 0 ? void 0 : jwt.expiresIn)) {
+        addError('ACCESSI_JWT_EXPIRES_MISSING', 'jwtOptions.expiresIn e obbligatorio.');
+    }
+    const algorithm = (_a = jwt === null || jwt === void 0 ? void 0 : jwt.algorithm) !== null && _a !== void 0 ? _a : 'HS256';
+    if (algorithm.startsWith('HS')) {
+        if ((jwt === null || jwt === void 0 ? void 0 : jwt.privateKey) || (jwt === null || jwt === void 0 ? void 0 : jwt.publicKey)) {
+            addWarning('ACCESSI_JWT_ASYMMETRIC_KEYS_WITH_HMAC', 'Sono configurate chiavi asimmetriche ma algorithm e HS256: verranno ignorate.');
+        }
+    }
+    else {
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.privateKey)) {
+            addError('ACCESSI_JWT_PRIVATE_KEY_MISSING', `jwtOptions.privateKey e obbligatoria per ${algorithm}.`);
+        }
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.publicKey) && !(jwt === null || jwt === void 0 ? void 0 : jwt.privateKey)) {
+            addError('ACCESSI_JWT_PUBLIC_KEY_MISSING', `jwtOptions.publicKey e obbligatoria per ${algorithm}.`);
+        }
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.keyId)) {
+            addWarning('ACCESSI_JWT_KEY_ID_MISSING', 'jwtOptions.keyId e consigliato per la rotazione JWKS.');
+        }
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.jwksPath)) {
+            addWarning('ACCESSI_JWKS_PATH_DEFAULT', 'jwksPath non configurato: verra usato accessi/.well-known/jwks.json.');
+        }
+    }
+    const previousKeys = (_b = jwt === null || jwt === void 0 ? void 0 : jwt.previousPublicKeys) !== null && _b !== void 0 ? _b : [];
+    if (previousKeys.length > 0 && algorithm.startsWith('HS')) {
+        addWarning('ACCESSI_JWT_PREVIOUS_KEYS_WITH_HMAC', 'previousPublicKeys e configurato ma algorithm e HS*: le chiavi verranno ignorate.');
+    }
+    if (!algorithm.startsWith('HS') && previousKeys.length > 0) {
+        const knownKeyIds = new Set();
+        if (jwt === null || jwt === void 0 ? void 0 : jwt.keyId)
+            knownKeyIds.add(jwt.keyId);
+        previousKeys.forEach((previous, index) => {
+            try {
+                (0, crypto_1.createPublicKey)(previous.publicKey);
+            }
+            catch (_a) {
+                addError('ACCESSI_JWT_PREVIOUS_KEY_INVALID', `previousPublicKeys[${index}] non e una chiave pubblica PEM valida.`);
+            }
+            if (!previous.keyId) {
+                addWarning('ACCESSI_JWT_PREVIOUS_KEY_ID_MISSING', `previousPublicKeys[${index}] non ha keyId: verra usato il fingerprint della chiave.`);
+                return;
+            }
+            if (knownKeyIds.has(previous.keyId)) {
+                addWarning('ACCESSI_JWT_PREVIOUS_KEY_DUPLICATE_KID', `previousPublicKeys[${index}].keyId "${previous.keyId}" e duplicato: vince la chiave corrente.`);
+                return;
+            }
+            knownKeyIds.add(previous.keyId);
+        });
+    }
+    if (!(jwt === null || jwt === void 0 ? void 0 : jwt.issuer)) {
+        addWarning('ACCESSI_JWT_ISSUER_MISSING', 'jwtOptions.issuer e consigliato in multi-servizio.');
+    }
+    if (!(jwt === null || jwt === void 0 ? void 0 : jwt.audience)) {
+        addWarning('ACCESSI_JWT_AUDIENCE_MISSING', 'jwtOptions.audience e consigliato in multi-servizio.');
+    }
+    if (!(options === null || options === void 0 ? void 0 : options.encryptionKey)) {
+        addError('ACCESSI_ENCRYPTION_KEY_MISSING', 'encryptionKey e obbligatoria.');
+    }
+    else if (options.encryptionKey.length < 16) {
+        addWarning('ACCESSI_ENCRYPTION_KEY_WEAK', 'encryptionKey dovrebbe avere almeno 16 caratteri.');
+    }
+    if (!isHttpUrl(options === null || options === void 0 ? void 0 : options.confirmationEmailUrl)) {
+        addWarning('ACCESSI_CONFIRMATION_URL_INVALID', 'confirmationEmailUrl dovrebbe essere un URL http/https.');
+    }
+    if (!isHttpUrl(options === null || options === void 0 ? void 0 : options.confirmationEmailReturnUrl)) {
+        addWarning('ACCESSI_CONFIRMATION_RETURN_URL_INVALID', 'confirmationEmailReturnUrl dovrebbe essere un URL http/https.');
+    }
+    if ((options === null || options === void 0 ? void 0 : options.publicBaseUrl) && !isHttpUrl(options.publicBaseUrl)) {
+        addWarning('ACCESSI_PUBLIC_BASE_URL_INVALID', 'publicBaseUrl dovrebbe essere un URL http/https.');
+    }
+    if (((_c = options === null || options === void 0 ? void 0 : options.publicAuthRateLimit) === null || _c === void 0 ? void 0 : _c.login) && !positive(options.publicAuthRateLimit.login.windowMs)) {
+        addError('ACCESSI_RATE_LIMIT_WINDOW_INVALID', 'publicAuthRateLimit.login.windowMs deve essere positivo.');
+    }
+    if (((_d = options === null || options === void 0 ? void 0 : options.publicAuthRateLimit) === null || _d === void 0 ? void 0 : _d.login) && !positive(options.publicAuthRateLimit.login.maxAttempts)) {
+        addError('ACCESSI_RATE_LIMIT_ATTEMPTS_INVALID', 'publicAuthRateLimit.login.maxAttempts deve essere positivo.');
+    }
+    if (options === null || options === void 0 ? void 0 : options.edgeRateLimit) {
+        if (options.edgeRateLimit.windowMs !== undefined && !positive(options.edgeRateLimit.windowMs)) {
+            addError('ACCESSI_EDGE_RATE_LIMIT_WINDOW_INVALID', 'edgeRateLimit.windowMs deve essere positivo.');
+        }
+        if (options.edgeRateLimit.maxAttempts !== undefined && !positive(options.edgeRateLimit.maxAttempts)) {
+            addError('ACCESSI_EDGE_RATE_LIMIT_ATTEMPTS_INVALID', 'edgeRateLimit.maxAttempts deve essere positivo.');
+        }
+    }
+    if (((_e = options === null || options === void 0 ? void 0 : options.consoleEntry) === null || _e === void 0 ? void 0 : _e.ttlMs) !== undefined && !positive(options.consoleEntry.ttlMs)) {
+        addError('ACCESSI_CONSOLE_ENTRY_TTL_INVALID', 'consoleEntry.ttlMs deve essere positivo.');
+    }
+    const authCookie = (0, authCookies_1.resolveAccessiAuthCookieOptions)(options !== null && options !== void 0 ? options : {});
+    if (authCookie) {
+        const names = (0, authCookies_1.accessiCookieNames)(authCookie);
+        names.forEach((name, index) => {
+            if (!(0, authCookies_1.isValidAccessiCookieName)(name)) {
+                addError('ACCESSI_AUTH_COOKIE_NAME_INVALID', `Il nome cookie "${names[index]}" non e valido.`);
+            }
+        });
+        if (new Set(names).size !== names.length) {
+            addError('ACCESSI_AUTH_COOKIE_NAME_DUPLICATE', 'I nomi dei cookie access, refresh e CSRF devono essere diversi.');
+        }
+        if (authCookie.sameSite === 'none' && !authCookie.secure) {
+            addError('ACCESSI_AUTH_COOKIE_SAMESITE_NONE_INSECURE', 'SameSite=None richiede secure: true.');
+        }
+        if (!authCookie.accessPath.startsWith('/')) {
+            addError('ACCESSI_AUTH_COOKIE_PATH_INVALID', 'accessPath deve iniziare con "/".');
+        }
+        if (!authCookie.refreshPath.startsWith('/')) {
+            addError('ACCESSI_AUTH_COOKIE_PATH_INVALID', 'refreshPath deve iniziare con "/".');
+        }
+        if (!authCookie.csrfPath.startsWith('/')) {
+            addError('ACCESSI_AUTH_COOKIE_PATH_INVALID', 'csrfPath deve iniziare con "/".');
+        }
+        if (authCookie.csrf === 'off') {
+            addWarning('ACCESSI_AUTH_COOKIE_CSRF_DISABLED', 'CSRF disattivato in modalita cookie: l host deve applicare una propria protezione.');
+        }
+        if (authCookie.exposeTokens) {
+            addWarning('ACCESSI_AUTH_COOKIE_TOKENS_EXPOSED', 'exposeTokens restituisce i token nel body: riduce il beneficio di httpOnly.');
+        }
+        if (!(jwt === null || jwt === void 0 ? void 0 : jwt.refreshExpiresIn) && authCookie.refreshFromCookie) {
+            addWarning('ACCESSI_AUTH_COOKIE_REFRESH_DISABLED', 'refreshFromCookie e attivo ma jwtOptions.refreshExpiresIn non e configurato.');
+        }
+    }
+    return { errors, warnings };
+}
+/** Lancia un errore aggregato se la configurazione non e valida. */
+function assertValidAccessiOptions(options) {
+    const result = validateAccessiOptions(options);
+    if (result.errors.length === 0)
+        return;
+    throw new Error(`Configurazione Accessi non valida:\n${result.errors
+        .map((issue) => `- ${issue.code}: ${issue.message}`)
+        .join('\n')}`);
+}
+//# sourceMappingURL=validateOptions.js.map

package/dist/accessi-module/security/validateOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateOptions.js","sourceRoot":"","sources":["../../../src/accessi-module/security/validateOptions.ts"],"names":[],"mappings":";;AAuCA,wDAoLC;AAGD,8DAQC;AAtOD,mCAAyC;AAEzC,+CAIuB;AAYvB,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC/D,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,OAAuB;;IAC5D,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAoC,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAEvF,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe,CAAA,EAAE,CAAC;QAC9B,QAAQ,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,CAAC;IAChC,MAAM,MAAM,GAAG,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,EAAE,mCAAmC,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC9B,UAAU,CAAC,yBAAyB,EAAE,uDAAuD,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,EAAE,CAAC;QACpB,QAAQ,CAAC,6BAA6B,EAAE,sCAAsC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,mCAAI,OAAO,CAAC;IAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,MAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,EAAE,CAAC;YACtC,UAAU,CACR,uCAAuC,EACvC,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAA,EAAE,CAAC;YACrB,QAAQ,CAAC,iCAAiC,EAAE,4CAA4C,SAAS,GAAG,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAA,EAAE,CAAC;YACxC,QAAQ,CAAC,gCAAgC,EAAE,2CAA2C,SAAS,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,KAAK,CAAA,EAAE,CAAC;YAChB,UAAU,CAAC,4BAA4B,EAAE,uDAAuD,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,CAAA,EAAE,CAAC;YACnB,UAAU,CACR,2BAA2B,EAC3B,sEAAsE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,kBAAkB,mCAAI,EAAE,CAAC;IACnD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,UAAU,CACR,qCAAqC,EACrC,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,IAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,KAAK;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,YAAY,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YACvC,IAAI,CAAC;gBACH,IAAA,wBAAe,EAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC;YAAC,WAAM,CAAC;gBACP,QAAQ,CACN,kCAAkC,EAClC,sBAAsB,KAAK,yCAAyC,CACrE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,UAAU,CACR,qCAAqC,EACrC,sBAAsB,KAAK,0DAA0D,CACtF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,UAAU,CACR,wCAAwC,EACxC,sBAAsB,KAAK,YAAY,QAAQ,CAAC,KAAK,0CAA0C,CAChG,CAAC;gBACF,OAAO;YACT,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,EAAE,CAAC;QACjB,UAAU,CAAC,4BAA4B,EAAE,oDAAoD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,CAAA,EAAE,CAAC;QACnB,UAAU,CAAC,8BAA8B,EAAE,sDAAsD,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,CAAA,EAAE,CAAC;QAC5B,QAAQ,CAAC,gCAAgC,EAAE,+BAA+B,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7C,UAAU,CAAC,6BAA6B,EAAE,mDAAmD,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9C,UAAU,CAAC,kCAAkC,EAAE,yDAAyD,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0BAA0B,CAAC,EAAE,CAAC;QACpD,UAAU,CAAC,yCAAyC,EAAE,+DAA+D,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,KAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,UAAU,CAAC,iCAAiC,EAAE,kDAAkD,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,mBAAmB,0CAAE,KAAK,KAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjG,QAAQ,CAAC,mCAAmC,EAAE,0DAA0D,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,mBAAmB,0CAAE,KAAK,KAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACpG,QAAQ,CAAC,qCAAqC,EAAE,6DAA6D,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9F,QAAQ,CAAC,wCAAwC,EAAE,8CAA8C,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACpG,QAAQ,CAAC,0CAA0C,EAAE,iDAAiD,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,0CAAE,KAAK,MAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,QAAQ,CAAC,mCAAmC,EAAE,0CAA0C,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,6CAA+B,EAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;IAClE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,IAAA,gCAAkB,EAAC,UAAU,CAAC,CAAC;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,IAAI,CAAC,IAAA,sCAAwB,EAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,QAAQ,CACN,kCAAkC,EAClC,mBAAmB,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACjD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACzC,QAAQ,CACN,oCAAoC,EACpC,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACzD,QAAQ,CACN,4CAA4C,EAC5C,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,kCAAkC,EAAE,mCAAmC,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,kCAAkC,EAAE,oCAAoC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,kCAAkC,EAAE,iCAAiC,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC9B,UAAU,CACR,mCAAmC,EACnC,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5B,UAAU,CACR,oCAAoC,EACpC,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,gBAAgB,CAAA,IAAI,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAC3D,UAAU,CACR,sCAAsC,EACtC,8EAA8E,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,SAAgB,yBAAyB,CAAC,OAAuB;IAC/D,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;AACJ,CAAC","sourcesContent":["import { createPublicKey } from 'crypto';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n  accessiCookieNames,\n  isValidAccessiCookieName,\n  resolveAccessiAuthCookieOptions,\n} from './authCookies';\n\nexport interface AccessiOptionsValidationIssue {\n  code: string;\n  message: string;\n}\n\nexport interface AccessiOptionsValidationResult {\n  errors: AccessiOptionsValidationIssue[];\n  warnings: AccessiOptionsValidationIssue[];\n}\n\nfunction isHttpUrl(value: string | undefined): boolean {\n  if (!value) return false;\n  try {\n    const url = new URL(value);\n    return url.protocol === 'http:' || url.protocol === 'https:';\n  } catch {\n    return false;\n  }\n}\n\nfunction positive(value: number | undefined): boolean {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0;\n}\n\n/**\n * Validazione fail-fast della configurazione Accessi.\n *\n * `createAccessiService` usa `assertValidAccessiOptions`; i bootstrap esistenti\n * possono usare `validateAccessiOptions` per loggare warning senza rompere il\n * comportamento storico.\n */\nexport function validateAccessiOptions(options: AccessiOptions): AccessiOptionsValidationResult {\n  const errors: AccessiOptionsValidationIssue[] = [];\n  const warnings: AccessiOptionsValidationIssue[] = [];\n\n  const addError = (code: string, message: string) => errors.push({ code, message });\n  const addWarning = (code: string, message: string) => warnings.push({ code, message });\n\n  if (!options?.databaseOptions) {\n    addError('ACCESSI_DB_OPTIONS_MISSING', 'databaseOptions e obbligatorio.');\n  }\n\n  const jwt = options?.jwtOptions;\n  const secret = jwt?.secret || process.env.ACC_JWT_SECRET;\n  if (!secret) {\n    addError('ACCESSI_JWT_SECRET_MISSING', 'jwtOptions.secret e obbligatorio.');\n  } else if (secret.length < 32) {\n    addWarning('ACCESSI_JWT_SECRET_WEAK', 'jwtOptions.secret dovrebbe avere almeno 32 caratteri.');\n  }\n\n  if (!jwt?.expiresIn) {\n    addError('ACCESSI_JWT_EXPIRES_MISSING', 'jwtOptions.expiresIn e obbligatorio.');\n  }\n\n  const algorithm = jwt?.algorithm ?? 'HS256';\n  if (algorithm.startsWith('HS')) {\n    if (jwt?.privateKey || jwt?.publicKey) {\n      addWarning(\n        'ACCESSI_JWT_ASYMMETRIC_KEYS_WITH_HMAC',\n        'Sono configurate chiavi asimmetriche ma algorithm e HS256: verranno ignorate.',\n      );\n    }\n  } else {\n    if (!jwt?.privateKey) {\n      addError('ACCESSI_JWT_PRIVATE_KEY_MISSING', `jwtOptions.privateKey e obbligatoria per ${algorithm}.`);\n    }\n    if (!jwt?.publicKey && !jwt?.privateKey) {\n      addError('ACCESSI_JWT_PUBLIC_KEY_MISSING', `jwtOptions.publicKey e obbligatoria per ${algorithm}.`);\n    }\n    if (!jwt?.keyId) {\n      addWarning('ACCESSI_JWT_KEY_ID_MISSING', 'jwtOptions.keyId e consigliato per la rotazione JWKS.');\n    }\n    if (!jwt?.jwksPath) {\n      addWarning(\n        'ACCESSI_JWKS_PATH_DEFAULT',\n        'jwksPath non configurato: verra usato accessi/.well-known/jwks.json.',\n      );\n    }\n  }\n\n  const previousKeys = jwt?.previousPublicKeys ?? [];\n  if (previousKeys.length > 0 && algorithm.startsWith('HS')) {\n    addWarning(\n      'ACCESSI_JWT_PREVIOUS_KEYS_WITH_HMAC',\n      'previousPublicKeys e configurato ma algorithm e HS*: le chiavi verranno ignorate.',\n    );\n  }\n  if (!algorithm.startsWith('HS') && previousKeys.length > 0) {\n    const knownKeyIds = new Set<string>();\n    if (jwt?.keyId) knownKeyIds.add(jwt.keyId);\n    previousKeys.forEach((previous, index) => {\n      try {\n        createPublicKey(previous.publicKey);\n      } catch {\n        addError(\n          'ACCESSI_JWT_PREVIOUS_KEY_INVALID',\n          `previousPublicKeys[${index}] non e una chiave pubblica PEM valida.`,\n        );\n      }\n      if (!previous.keyId) {\n        addWarning(\n          'ACCESSI_JWT_PREVIOUS_KEY_ID_MISSING',\n          `previousPublicKeys[${index}] non ha keyId: verra usato il fingerprint della chiave.`,\n        );\n        return;\n      }\n      if (knownKeyIds.has(previous.keyId)) {\n        addWarning(\n          'ACCESSI_JWT_PREVIOUS_KEY_DUPLICATE_KID',\n          `previousPublicKeys[${index}].keyId \"${previous.keyId}\" e duplicato: vince la chiave corrente.`,\n        );\n        return;\n      }\n      knownKeyIds.add(previous.keyId);\n    });\n  }\n\n  if (!jwt?.issuer) {\n    addWarning('ACCESSI_JWT_ISSUER_MISSING', 'jwtOptions.issuer e consigliato in multi-servizio.');\n  }\n  if (!jwt?.audience) {\n    addWarning('ACCESSI_JWT_AUDIENCE_MISSING', 'jwtOptions.audience e consigliato in multi-servizio.');\n  }\n\n  if (!options?.encryptionKey) {\n    addError('ACCESSI_ENCRYPTION_KEY_MISSING', 'encryptionKey e obbligatoria.');\n  } else if (options.encryptionKey.length < 16) {\n    addWarning('ACCESSI_ENCRYPTION_KEY_WEAK', 'encryptionKey dovrebbe avere almeno 16 caratteri.');\n  }\n\n  if (!isHttpUrl(options?.confirmationEmailUrl)) {\n    addWarning('ACCESSI_CONFIRMATION_URL_INVALID', 'confirmationEmailUrl dovrebbe essere un URL http/https.');\n  }\n  if (!isHttpUrl(options?.confirmationEmailReturnUrl)) {\n    addWarning('ACCESSI_CONFIRMATION_RETURN_URL_INVALID', 'confirmationEmailReturnUrl dovrebbe essere un URL http/https.');\n  }\n  if (options?.publicBaseUrl && !isHttpUrl(options.publicBaseUrl)) {\n    addWarning('ACCESSI_PUBLIC_BASE_URL_INVALID', 'publicBaseUrl dovrebbe essere un URL http/https.');\n  }\n\n  if (options?.publicAuthRateLimit?.login && !positive(options.publicAuthRateLimit.login.windowMs)) {\n    addError('ACCESSI_RATE_LIMIT_WINDOW_INVALID', 'publicAuthRateLimit.login.windowMs deve essere positivo.');\n  }\n  if (options?.publicAuthRateLimit?.login && !positive(options.publicAuthRateLimit.login.maxAttempts)) {\n    addError('ACCESSI_RATE_LIMIT_ATTEMPTS_INVALID', 'publicAuthRateLimit.login.maxAttempts deve essere positivo.');\n  }\n  if (options?.edgeRateLimit) {\n    if (options.edgeRateLimit.windowMs !== undefined && !positive(options.edgeRateLimit.windowMs)) {\n      addError('ACCESSI_EDGE_RATE_LIMIT_WINDOW_INVALID', 'edgeRateLimit.windowMs deve essere positivo.');\n    }\n    if (options.edgeRateLimit.maxAttempts !== undefined && !positive(options.edgeRateLimit.maxAttempts)) {\n      addError('ACCESSI_EDGE_RATE_LIMIT_ATTEMPTS_INVALID', 'edgeRateLimit.maxAttempts deve essere positivo.');\n    }\n  }\n  if (options?.consoleEntry?.ttlMs !== undefined && !positive(options.consoleEntry.ttlMs)) {\n    addError('ACCESSI_CONSOLE_ENTRY_TTL_INVALID', 'consoleEntry.ttlMs deve essere positivo.');\n  }\n\n  const authCookie = resolveAccessiAuthCookieOptions(options ?? {});\n  if (authCookie) {\n    const names = accessiCookieNames(authCookie);\n    names.forEach((name, index) => {\n      if (!isValidAccessiCookieName(name)) {\n        addError(\n          'ACCESSI_AUTH_COOKIE_NAME_INVALID',\n          `Il nome cookie \"${names[index]}\" non e valido.`,\n        );\n      }\n    });\n    if (new Set(names).size !== names.length) {\n      addError(\n        'ACCESSI_AUTH_COOKIE_NAME_DUPLICATE',\n        'I nomi dei cookie access, refresh e CSRF devono essere diversi.',\n      );\n    }\n    if (authCookie.sameSite === 'none' && !authCookie.secure) {\n      addError(\n        'ACCESSI_AUTH_COOKIE_SAMESITE_NONE_INSECURE',\n        'SameSite=None richiede secure: true.',\n      );\n    }\n    if (!authCookie.accessPath.startsWith('/')) {\n      addError('ACCESSI_AUTH_COOKIE_PATH_INVALID', 'accessPath deve iniziare con \"/\".');\n    }\n    if (!authCookie.refreshPath.startsWith('/')) {\n      addError('ACCESSI_AUTH_COOKIE_PATH_INVALID', 'refreshPath deve iniziare con \"/\".');\n    }\n    if (!authCookie.csrfPath.startsWith('/')) {\n      addError('ACCESSI_AUTH_COOKIE_PATH_INVALID', 'csrfPath deve iniziare con \"/\".');\n    }\n    if (authCookie.csrf === 'off') {\n      addWarning(\n        'ACCESSI_AUTH_COOKIE_CSRF_DISABLED',\n        'CSRF disattivato in modalita cookie: l host deve applicare una propria protezione.',\n      );\n    }\n    if (authCookie.exposeTokens) {\n      addWarning(\n        'ACCESSI_AUTH_COOKIE_TOKENS_EXPOSED',\n        'exposeTokens restituisce i token nel body: riduce il beneficio di httpOnly.',\n      );\n    }\n    if (!jwt?.refreshExpiresIn && authCookie.refreshFromCookie) {\n      addWarning(\n        'ACCESSI_AUTH_COOKIE_REFRESH_DISABLED',\n        'refreshFromCookie e attivo ma jwtOptions.refreshExpiresIn non e configurato.',\n      );\n    }\n  }\n\n  return { errors, warnings };\n}\n\n/** Lancia un errore aggregato se la configurazione non e valida. */\nexport function assertValidAccessiOptions(options: AccessiOptions): void {\n  const result = validateAccessiOptions(options);\n  if (result.errors.length === 0) return;\n  throw new Error(\n    `Configurazione Accessi non valida:\\n${result.errors\n      .map((issue) => `- ${issue.code}: ${issue.message}`)\n      .join('\\n')}`,\n  );\n}\n"]}

package/dist/accessi-module/startupLog.d.ts

@@ -0,0 +1,7 @@
+import type { AccessiOptions } from './AccessiModule';
+import type { ResolvedOpenApiSetupOptions } from '../openapi/OpenApiConfig';
+/**
+ * Logga gli indirizzi utili del modulo Accessi appena il bootstrap e completato, cosi che
+ * console, OpenAPI e API siano visibili insieme nei log di avvio.
+ */
+export declare function logAccessiStartup(options: AccessiOptions, openApiOverride?: ResolvedOpenApiSetupOptions): void;

package/dist/accessi-module/startupLog.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logAccessiStartup = logAccessiStartup;
+const Logger_1 = require("../Logger");
+const adminBootstrap_1 = require("./security/adminBootstrap");
+const OpenApiConfig_1 = require("../openapi/OpenApiConfig");
+/**
+ * Logga gli indirizzi utili del modulo Accessi appena il bootstrap e completato, cosi che
+ * console, OpenAPI e API siano visibili insieme nei log di avvio.
+ */
+function logAccessiStartup(options, openApiOverride) {
+    var _a, _b;
+    const logger = new Logger_1.Logger('Accessi');
+    const base = ((_a = options.publicBaseUrl) !== null && _a !== void 0 ? _a : '').replace(/\/+$/, '');
+    const url = (path) => `${base}${path}`;
+    const openApi = openApiOverride !== null && openApiOverride !== void 0 ? openApiOverride : (0, OpenApiConfig_1.resolveAccessiOpenApiOptions)(options.openapi);
+    logger.info('Accessi pronto. Indirizzi utili:');
+    logger.info(`  Console:      ${url('/api/accessi/console')}`);
+    if (openApi.enabled) {
+        logger.info(`  OpenAPI UI:   ${url(`/${openApi.openApiPath}`)}`);
+        logger.info(`  OpenAPI JSON: ${url(`/${openApi.openApiJsonPath}`)}`);
+    }
+    logger.info(`  API:          ${url('/api/accessi')}`);
+    if (((_b = options.adminBootstrap) === null || _b === void 0 ? void 0 : _b.enabled) === true) {
+        const token = (0, adminBootstrap_1.getOrCreateAdminBootstrapToken)();
+        logger.warning(`  Bootstrap admin abilitato. Token di avvio (monouso, valido fino al riavvio): ${token}`);
+    }
+}
+//# sourceMappingURL=startupLog.js.map