emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.81

package/dist/accessi/resource-server/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/runtime.ts"],"names":[],"mappings":";;;;;;;;;;;AA+CA,kEAkBC;AAyED,gEAsGC;AA/OD,4CAIsB;AAKtB,qCAA4C;AAC5C,mDAAmE;AAEnE,mCAAqD;AAsBrD,SAAS,WAAW,CAAC,OAAqC;IACxD,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC;IAClD,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,8DAA8D,CAC/D,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,2BAA2B,CACzC,OAAqC;IAErC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACnG,CAAC;IAED,qCACE,OAAO,kCAAO,OAAO,KAAE,IAAI,OACxB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAA,kCAA0B,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC1E,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAA,gDAAgC,EAAC,OAAO,CAAC,aAAa,CAAC,EAAE;QAClF,CAAC,CAAC,EAAE,CAAC,EACP;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA8C,EAC9C,IAA6B;IAE7B,qDACK,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,GAC9B,IAAI,KACP,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,IAAI,IACZ;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,OAA4C;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,QAAQ,GAAG,IAAI,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAe,qBAAqB,CAClC,OAAkC,EAClC,YAAoB,EACpB,OAAqC;;;QAErC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,QAAQ,KAAI,MAAA,UAAU,CAAC,WAAW,0CAAE,eAAe,CAAA,EAAE,CAAC;YACxD,IAAI,MAAM,UAAU,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,yDAAyD,CAAC,CAAC;YAC/G,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,GAAG,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YACvC,IAAI,MAAM,UAAU,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAkC,CAAC,CAAC;YACzE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzE,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,IAAI,CACtC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC;gBACzD,CAAC,CAAC,UAAU,IAAI,SAAS;gBACzB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI,CACrD,CAAC;YACF,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;CAAA;AAED;;;;;GAKG;AACH,SAAsB,0BAA0B,CAC9C,OAAgB,EAChB,OAAqC;;;QAErC,MAAM,KAAK,GAAG,IAAA,qCAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,qCAAqC,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,IAAI,mCAAI,OAAO,CAAC;QAC7C,IAAI,OAA8C,CAAC;QACnD,IAAI,IAAI,GAA4B,EAAE,CAAC;QACvC,IAAI,YAAgC,CAAC;QACrC,IAAI,MAAgC,CAAC;QAErC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,mCAAmC,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;YAC/B,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;YACzB,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBACjC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,GAAG,MAAA,aAAa,CAAC,IAAI,mCAAI,EAAE,CAAC;YAChC,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;YAC1C,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;YAC9B,OAAO,GAAG,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACnD,MAAM,qBAAqB,CAAC,OAAoC,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,eAAe,GAAG,IAAA,gCAAoB,EAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5E,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;oBACjC,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,4BAA4B,EAC5B,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;gBACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC1E,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;oBAC1B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;gBAC7F,CAAC;gBACD,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;gBAC9B,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;oBACvB,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;oBAC1B,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAmB,EAC9C,eAAe,EACf;gBACE,GAAG,EAAE,OAAO;gBACZ,YAAY,EAAE,OAAO;gBACrB,QAAQ,EAAE,YAAY;gBACtB,eAAe,EAAE,GAAS,EAAE,gDAAC,OAAA,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAA,GAAA;aAC1C,EACD,OAAO,CAAC,OAAO,CAAC,aAAa,CAC9B,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,+BAA+B,EAC/B,+CAA+C,CAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAG,OAAsC,CAAC;QACpE,MAAM,WAAW,GAA4B,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI;YACtD,GAAG,EAAE,QAAQ;YACb,YAAY;YACZ,MAAM,EAAE,IAAI;SACb,CAAC;QACF,oBAAoB,CAAC,IAAI,GAAG,WAAW,CAAC;QACxC,oBAAoB,CAAC,IAAI,GAAG,WAAW,CAAC;QACxC,IAAI,MAAM;YAAE,oBAAoB,CAAC,UAAU,GAAG,MAAM,CAAC;QACrD,oBAAoB,CAAC,OAAO,iCAC1B,KAAK;YACL,IAAI;YACJ,YAAY,IACT,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7B,OAAO,EAAE,WAAW,GACrB,CAAC;QACF,OAAO,oBAAoB,CAAC,OAAO,CAAC;IACtC,CAAC;CAAA","sourcesContent":["import type { Request } from \"express\";\nimport {\n  buildRequirementTree,\n  evaluateRequirement,\n  extractAccessiBearerToken,\n} from \"../contracts\";\nimport type {\n  AccessiAccessTokenPayload,\n  GrantsResult,\n} from \"../contracts\";\nimport { accessiAuthError } from \"./errors\";\nimport { createAccessiIntrospectionClient } from \"./introspection\";\nimport type { AccessiIntrospectionClient } from \"./introspection\";\nimport { createAccessiTokenVerifier } from \"./token\";\nimport type { AccessiTokenVerifier } from \"./token\";\nimport type {\n  AccessiRequestContext,\n  AccessiResourceServerOptions,\n} from \"./types\";\n\n/** Request Express arricchita dal resource server. */\nexport interface AccessiAuthenticatedRequest extends Request {\n  user?: Record<string, unknown>;\n  data?: Record<string, unknown>;\n  userGrants?: GrantsResult;\n  accessi?: AccessiRequestContext;\n}\n\n/** Runtime creato una volta al bootstrap e riutilizzato a ogni richiesta. */\nexport interface AccessiResourceServerRuntime {\n  options: AccessiResourceServerOptions;\n  verifier?: AccessiTokenVerifier;\n  introspectionClient?: AccessiIntrospectionClient;\n}\n\nfunction resolveMode(options: AccessiResourceServerOptions): \"local\" | \"introspection\" {\n  if (options.mode) return options.mode;\n  if (options.jwt) return \"local\";\n  if (options.introspection) return \"introspection\";\n  throw accessiAuthError(\n    500,\n    \"AUTH_CONFIG_INVALID\",\n    \"Configurare jwt o introspection nel resource server Accessi.\",\n  );\n}\n\n/** Valida la configurazione e prepara verificatore e client di introspection. */\nexport function createAccessiResourceServer(\n  options: AccessiResourceServerOptions,\n): AccessiResourceServerRuntime {\n  const mode = resolveMode(options);\n  if (mode === \"local\" && !options.jwt) {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"mode local richiede jwt.\");\n  }\n  if (mode === \"introspection\" && !options.introspection) {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"mode introspection richiede introspection.\");\n  }\n\n  return {\n    options: { ...options, mode },\n    ...(options.jwt ? { verifier: createAccessiTokenVerifier(options.jwt) } : {}),\n    ...(options.introspection\n      ? { introspectionClient: createAccessiIntrospectionClient(options.introspection) }\n      : {}),\n  };\n}\n\nfunction mergeIntrospectionUser(\n  payload: AccessiAccessTokenPayload | undefined,\n  user: Record<string, unknown>,\n): AccessiAccessTokenPayload {\n  return {\n    ...(payload ?? { typ: \"access\" }),\n    ...user,\n    typ: \"access\",\n    utente: user,\n  };\n}\n\n/** Issued-at in millisecondi, con fallback su `iat` per i token legacy. */\nfunction resolveIssuedAtMs(payload: Record<string, unknown> | undefined): number | null {\n  const issuedAtMs = Number(payload?.iatMs);\n  if (Number.isFinite(issuedAtMs) && issuedAtMs > 0) return issuedAtMs;\n  const issuedAt = Number(payload?.iat);\n  if (!Number.isFinite(issuedAt)) return null;\n  return issuedAt * 1000;\n}\n\n/**\n * Applica gli store di revoca configurati: famiglia refresh, singolo `jti` e\n * cutoff per utente. Il resource server non interroga mai il database Accessi.\n */\nasync function assertTokenNotRevoked(\n  payload: AccessiAccessTokenPayload,\n  codiceUtente: number,\n  options: AccessiResourceServerOptions,\n): Promise<void> {\n  const revocation = options.revocation;\n  if (!revocation) return;\n\n  const familyId = typeof payload.fid === \"string\" ? payload.fid : undefined;\n  if (familyId && revocation.familyStore?.isFamilyRevoked) {\n    if (await revocation.familyStore.isFamilyRevoked(familyId)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_REVOKED\", \"Sessione revocata per riuso sospetto del refresh token.\");\n    }\n  }\n\n  const jti = typeof payload.jti === \"string\" ? payload.jti : undefined;\n  if (jti && revocation.accessTokenStore) {\n    if (await revocation.accessTokenStore.isRevoked(jti)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_REVOKED\", \"Token revocato.\");\n    }\n  }\n\n  if (revocation.store) {\n    const issuedAtMs = resolveIssuedAtMs(payload as Record<string, unknown>);\n    if (issuedAtMs === null) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token privo di iat.\");\n    }\n    const revokedAt = await revocation.store.getUserRevocation(codiceUtente);\n    const preciseIssuedAtMs = Number(payload.iatMs);\n    const isRevoked = revokedAt !== null && (\n      Number.isFinite(preciseIssuedAtMs) && preciseIssuedAtMs > 0\n        ? issuedAtMs <= revokedAt\n        : issuedAtMs < Math.floor(revokedAt / 1000) * 1000\n    );\n    if (isRevoked) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_REVOKED\", \"Sessione revocata.\");\n    }\n  }\n}\n\n/**\n * Autentica la request e applica l'eventuale policy di autorizzazione.\n *\n * Non accede mai al database Accessi: la verifica e locale oppure delegata\n * all'introspection di Accessi Service.\n */\nexport async function authenticateAccessiRequest(\n  request: Request,\n  runtime: AccessiResourceServerRuntime,\n): Promise<AccessiRequestContext> {\n  const token = extractAccessiBearerToken(request.headers.authorization);\n  if (!token) {\n    throw accessiAuthError(401, \"AUTH_TOKEN_MISSING\", \"Token Bearer mancante o malformato.\");\n  }\n\n  const mode = runtime.options.mode ?? \"local\";\n  let payload: AccessiAccessTokenPayload | undefined;\n  let user: Record<string, unknown> = {};\n  let codiceUtente: number | undefined;\n  let grants: GrantsResult | undefined;\n\n  if (mode === \"local\") {\n    if (!runtime.verifier) {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"Verificatore JWT non configurato.\");\n    }\n    const verification = await runtime.verifier.verify(token);\n    payload = verification.payload;\n    user = verification.user;\n    codiceUtente = verification.codiceUtente;\n  } else {\n    if (!runtime.introspectionClient) {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"Client introspection non configurato.\");\n    }\n    const introspection = await runtime.introspectionClient.introspect(token);\n    if (!introspection.active) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido, scaduto o revocato.\");\n    }\n    user = introspection.user ?? {};\n    codiceUtente = introspection.codiceUtente;\n    grants = introspection.grants;\n    payload = mergeIntrospectionUser(undefined, user);\n  }\n\n  if (!codiceUtente) {\n    throw accessiAuthError(401, \"AUTH_USER_CODE_MISSING\", \"Token privo di un utente valido.\");\n  }\n\n  if (mode === \"local\" && runtime.options.revocation) {\n    await assertTokenNotRevoked(payload as AccessiAccessTokenPayload, codiceUtente, runtime.options);\n  }\n\n  const requirementTree = buildRequirementTree(runtime.options.authorization);\n  if (requirementTree) {\n    if (!grants) {\n      if (!runtime.introspectionClient) {\n        throw accessiAuthError(\n          500,\n          \"AUTH_GRANTS_SOURCE_MISSING\",\n          \"La policy richiede grant ma introspection non e configurata.\",\n        );\n      }\n      const introspection = await runtime.introspectionClient.introspect(token);\n      if (!introspection.active) {\n        throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido, scaduto o revocato.\");\n      }\n      grants = introspection.grants;\n      if (introspection.user) {\n        user = introspection.user;\n        payload = mergeIntrospectionUser(payload, user);\n      }\n    }\n\n    const hasPermissions = await evaluateRequirement(\n      requirementTree,\n      {\n        req: request,\n        decodedToken: payload,\n        userCode: codiceUtente,\n        getGrantsResult: async () => grants ?? {},\n      },\n      runtime.options.authorization,\n    );\n    if (!hasPermissions) {\n      throw accessiAuthError(\n        403,\n        \"AUTH_INSUFFICIENT_PERMISSIONS\",\n        \"Permessi insufficienti per questa operazione.\",\n      );\n    }\n  }\n\n  const authenticatedRequest = request as AccessiAuthenticatedRequest;\n  const authPayload: Record<string, unknown> = payload ?? {\n    typ: \"access\",\n    codiceUtente,\n    utente: user,\n  };\n  authenticatedRequest.user = authPayload;\n  authenticatedRequest.data = authPayload;\n  if (grants) authenticatedRequest.userGrants = grants;\n  authenticatedRequest.accessi = {\n    token,\n    user,\n    codiceUtente,\n    ...(grants ? { grants } : {}),\n    payload: authPayload,\n  };\n  return authenticatedRequest.accessi;\n}\n"]}

package/dist/accessi/resource-server/token.d.ts

@@ -0,0 +1,23 @@
+import type { AccessiAccessTokenPayload } from "../contracts";
+import type { AccessiResourceServerJwtOptions } from "./types";
+/** Esito della verifica locale di un access token. */
+export interface AccessiTokenVerification {
+    token: string;
+    payload: AccessiAccessTokenPayload;
+    codiceUtente: number;
+    user: Record<string, unknown>;
+}
+/** Verificatore riutilizzabile: conserva la cache JWKS tra una richiesta e l'altra. */
+export interface AccessiTokenVerifier {
+    verify(token: string): Promise<AccessiTokenVerification>;
+    verifyAuthorizationHeader(header: unknown): Promise<AccessiTokenVerification>;
+}
+/**
+ * Crea un verificatore locale riutilizzabile.
+ *
+ * Supporta HMAC, chiavi pubbliche PEM (RS ed ES) e JWKS remoto. La cache
+ * JWKS e legata all'istanza del verificatore.
+ */
+export declare function createAccessiTokenVerifier(options: AccessiResourceServerJwtOptions): AccessiTokenVerifier;
+/** Converte un header `Authorization` in verifica del token, senza cache JWKS condivisa. */
+export declare function verifyAccessiAccessToken(header: unknown, options: AccessiResourceServerJwtOptions): Promise<AccessiTokenVerification>;

package/dist/accessi/resource-server/token.js

@@ -0,0 +1,276 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiTokenVerifier = createAccessiTokenVerifier;
+exports.verifyAccessiAccessToken = verifyAccessiAccessToken;
+const crypto_1 = require("crypto");
+const jwt = __importStar(require("jsonwebtoken"));
+const contracts_1 = require("../contracts");
+const errors_1 = require("./errors");
+const keys_1 = require("./keys");
+const metrics_1 = require("../../accessi-module/observability/metrics");
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function extractUser(payload) {
+    const userData = isRecord(payload.userData) ? payload.userData : undefined;
+    const utente = isRecord(payload.utente)
+        ? payload.utente
+        : isRecord(userData === null || userData === void 0 ? void 0 : userData.utente)
+            ? userData.utente
+            : undefined;
+    return utente !== null && utente !== void 0 ? utente : {};
+}
+function defaultAlgorithms(options) {
+    if (options.algorithms && options.algorithms.length > 0)
+        return options.algorithms;
+    const algorithms = [];
+    if (options.secret || options.serverSecret)
+        algorithms.push("HS256");
+    if (options.publicKey || options.jwks) {
+        algorithms.push("RS256", "RS384", "RS512", "ES256", "ES384", "ES512");
+    }
+    return algorithms;
+}
+function algorithmFamily(algorithm) {
+    return algorithm.startsWith("HS") ? "hmac" : "asymmetric";
+}
+function fetchJwks(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const fetchImpl = (_a = options.fetch) !== null && _a !== void 0 ? _a : globalThis.fetch;
+        if (typeof fetchImpl !== "function") {
+            throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "fetch non disponibile per caricare la JWKS.");
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), (_b = options.timeoutMs) !== null && _b !== void 0 ? _b : 3000);
+        try {
+            const response = yield fetchImpl(options.url, {
+                method: "GET",
+                headers: { Accept: "application/json" },
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                throw (0, errors_1.accessiAuthError)(503, "AUTH_JWKS_UNAVAILABLE", `JWKS non disponibile (HTTP ${response.status}).`);
+            }
+            const payload = yield response.json();
+            if (!isRecord(payload) || !Array.isArray(payload.keys)) {
+                throw (0, errors_1.accessiAuthError)(503, "AUTH_JWKS_UNAVAILABLE", "Risposta JWKS non valida.");
+            }
+            return payload.keys.filter(isRecord);
+        }
+        catch (error) {
+            if (error && typeof error === "object" && "code" in error && "status" in error) {
+                throw error;
+            }
+            throw (0, errors_1.accessiAuthError)(503, "AUTH_JWKS_UNAVAILABLE", "JWKS non raggiungibile.");
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    });
+}
+function selectJwk(keys, kid, algorithm) {
+    return keys.find((key) => {
+        const keyAlg = typeof key.alg === "string" ? key.alg : undefined;
+        if (keyAlg && keyAlg !== algorithm)
+            return false;
+        if (!kid)
+            return true;
+        return typeof key.kid === "string" && key.kid === kid;
+    });
+}
+/** Fingerprint della chiave pubblica, identico a quello usato dalla JWKS Accessi. */
+function fingerprintPublicKey(publicKey) {
+    const der = (0, crypto_1.createPublicKey)(publicKey).export({ type: "spki", format: "der" });
+    return (0, crypto_1.createHash)("sha256").update(der).digest("base64url").slice(0, 16);
+}
+function jwkToPem(jwk) {
+    return (0, crypto_1.createPublicKey)({ key: jwk, format: "jwk" })
+        .export({ type: "spki", format: "pem" })
+        .toString();
+}
+/** L'alert non deve mai cambiare l'esito dell'autenticazione. */
+function notifyUnknownKeyId(options, event) {
+    var _a;
+    (0, metrics_1.recordAccessiMetric)('accessi_jwt_unknown_key_id_total', 1, Object.assign({ purpose: 'access', source: event.source }, (event.algorithm ? { algorithm: event.algorithm } : {})));
+    try {
+        (_a = options.onUnknownKeyId) === null || _a === void 0 ? void 0 : _a.call(options, event);
+    }
+    catch (_b) {
+        // Un logger o webhook guasto non trasforma un 401 in un 500.
+    }
+}
+/**
+ * Crea un verificatore locale riutilizzabile.
+ *
+ * Supporta HMAC, chiavi pubbliche PEM (RS ed ES) e JWKS remoto. La cache
+ * JWKS e legata all'istanza del verificatore.
+ */
+function createAccessiTokenVerifier(options) {
+    var _a, _b, _c, _d;
+    const algorithms = defaultAlgorithms(options);
+    if (algorithms.length === 0) {
+        throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "Configurare almeno una tra jwt.secret, jwt.serverSecret, jwt.publicKey e jwt.jwks.");
+    }
+    const clockTolerance = (_a = options.clockToleranceSeconds) !== null && _a !== void 0 ? _a : 5;
+    const hmacSecret = (_b = options.secret) !== null && _b !== void 0 ? _b : (options.serverSecret ? (0, keys_1.deriveAccessiAccessSecret)(options.serverSecret) : undefined);
+    let jwksCache;
+    const jwksMinRefreshInterval = Math.max(0, (_d = (_c = options.jwks) === null || _c === void 0 ? void 0 : _c.minRefreshIntervalMs) !== null && _d !== void 0 ? _d : 5000);
+    const getJwksKeys = (...args_1) => __awaiter(this, [...args_1], void 0, function* (forceRefresh = false) {
+        var _a;
+        if (!options.jwks)
+            return [];
+        const now = Date.now();
+        if (!forceRefresh && jwksCache && jwksCache.expiresAt > now)
+            return jwksCache.keys;
+        // Refresh forzato ma troppo ravvicinato: riusa la cache per non martellare la JWKS.
+        if (forceRefresh && jwksCache && now - jwksCache.fetchedAt < jwksMinRefreshInterval) {
+            return jwksCache.keys;
+        }
+        const keys = yield fetchJwks(options.jwks);
+        jwksCache = {
+            keys,
+            expiresAt: now + Math.max(1000, (_a = options.jwks.cacheTtlMs) !== null && _a !== void 0 ? _a : 300000),
+            fetchedAt: now,
+        };
+        return keys;
+    });
+    const verify = (token) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const decoded = jwt.decode(token, { complete: true });
+        if (!decoded || typeof decoded === "string" || !isRecord(decoded.header)) {
+            throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_INVALID", "Token JWT non valido.");
+        }
+        const algorithm = typeof decoded.header.alg === "string" ? decoded.header.alg : undefined;
+        if (!algorithm || !algorithms.includes(algorithm)) {
+            throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_INVALID", "Algoritmo JWT non consentito.");
+        }
+        const kid = typeof decoded.header.kid === "string" && decoded.header.kid !== ""
+            ? decoded.header.kid
+            : undefined;
+        let key;
+        let kidMismatch = false;
+        if (algorithmFamily(algorithm) === "hmac") {
+            if (!hmacSecret) {
+                throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "jwt.secret o jwt.serverSecret non configurato per token HS*.");
+            }
+            key = hmacSecret;
+        }
+        else if (options.publicKey) {
+            key = options.publicKey;
+            if (kid) {
+                const expectedKeyId = (_a = options.keyId) !== null && _a !== void 0 ? _a : fingerprintPublicKey(options.publicKey);
+                kidMismatch = kid !== expectedKeyId;
+            }
+        }
+        else if (options.jwks) {
+            let keys = yield getJwksKeys();
+            let selected = selectJwk(keys, kid, algorithm);
+            if (!selected && kid) {
+                // La JWKS in cache potrebbe precedere una rotazione appena avvenuta.
+                keys = yield getJwksKeys(true);
+                selected = selectJwk(keys, kid, algorithm);
+            }
+            if (!selected) {
+                if (kid) {
+                    notifyUnknownKeyId(options, { kid, algorithm, source: "jwks" });
+                    throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_INVALID", `Chiave JWKS non trovata per kid "${kid}".`);
+                }
+                throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_INVALID", "Chiave JWKS non trovata per il token.");
+            }
+            key = jwkToPem(selected);
+        }
+        else {
+            throw (0, errors_1.accessiAuthError)(500, "AUTH_CONFIG_INVALID", "jwt.publicKey/jwt.jwks non configurati.");
+        }
+        let verified;
+        try {
+            verified = jwt.verify(token, key, Object.assign(Object.assign(Object.assign({ algorithms: [algorithm] }, (options.issuer ? { issuer: options.issuer } : {})), (options.audience
+                ? { audience: options.audience }
+                : {})), { clockTolerance }));
+        }
+        catch (_b) {
+            if (kidMismatch && kid) {
+                notifyUnknownKeyId(options, { kid, algorithm, source: "publicKey" });
+            }
+            throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_INVALID", "Token non valido o scaduto.");
+        }
+        if (!isRecord(verified)) {
+            throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_INVALID", "Payload JWT non valido.");
+        }
+        if (verified.typ !== "access") {
+            throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_INVALID", "Il token non e un access token Accessi.");
+        }
+        const codiceUtente = (0, contracts_1.resolveCodiceUtenteFromTokenPayload)(verified);
+        if (!codiceUtente) {
+            throw (0, errors_1.accessiAuthError)(401, "AUTH_USER_CODE_MISSING", "Token privo di un utente valido.");
+        }
+        return {
+            token,
+            payload: verified,
+            codiceUtente,
+            user: extractUser(verified),
+        };
+    });
+    return {
+        verify,
+        verifyAuthorizationHeader(header) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const token = (0, contracts_1.extractAccessiBearerToken)(header);
+                if (!token) {
+                    throw (0, errors_1.accessiAuthError)(401, "AUTH_TOKEN_MISSING", "Token Bearer mancante o malformato.");
+                }
+                return verify(token);
+            });
+        },
+    };
+}
+/** Converte un header `Authorization` in verifica del token, senza cache JWKS condivisa. */
+function verifyAccessiAccessToken(header, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return createAccessiTokenVerifier(options).verifyAuthorizationHeader(header);
+    });
+}
+//# sourceMappingURL=token.js.map

package/dist/accessi/resource-server/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/token.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiJA,gEAuIC;AAGD,4DAKC;AAhSD,mCAAqD;AAErD,kDAAoC;AAEpC,4CAA8F;AAC9F,qCAA4C;AAC5C,iCAAmD;AACnD,wEAAiF;AAuBjF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,OAAgC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,QAAQ,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwC;IACjE,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IAEnF,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY;QAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;AAC5D,CAAC;AAED,SAAe,SAAS,CACtB,OAA6D;;;QAE7D,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,UAAU,CAAC,KAAK,CAAC;QACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,6CAA6C,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAA,OAAO,CAAC,SAAS,mCAAI,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC5C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,uBAAuB,EACvB,8BAA8B,QAAQ,CAAC,MAAM,IAAI,CAClD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC/E,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,uBAAuB,EAAE,yBAAyB,CAAC,CAAC;QAClF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CAAA;AAED,SAAS,SAAS,CAChB,IAAoC,EACpC,GAAuB,EACvB,SAAiB;IAEjB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,MAAM,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAS,oBAAoB,CAAC,SAA0B;IACtD,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,GAA4B;IAC5C,OAAO,IAAA,wBAAe,EAAC,EAAE,GAAG,EAAE,GAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACzE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACvC,QAAQ,EAAE,CAAC;AAChB,CAAC;AAED,iEAAiE;AACjE,SAAS,kBAAkB,CACzB,OAAwC,EACxC,KAA+B;;IAE/B,IAAA,6BAAmB,EAAC,kCAAkC,EAAE,CAAC,kBACvD,OAAO,EAAE,QAAQ,EACjB,MAAM,EAAE,KAAK,CAAC,MAAM,IACjB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1D,CAAC;IACH,IAAI,CAAC;QACH,MAAA,OAAO,CAAC,cAAc,wDAAG,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,WAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,OAAwC;;IACjF,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,qBAAqB,mCAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,MAAM,mCAC5B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAA,gCAAyB,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1F,IAAI,SAAqC,CAAC;IAC1C,MAAM,sBAAsB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,oBAAoB,mCAAI,IAAK,CAAC,CAAC;IAExF,MAAM,WAAW,GAAG,YAAsE,EAAE,iDAAjE,YAAY,GAAG,KAAK;;QAC7C,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC;QACnF,oFAAoF;QACpF,IAAI,YAAY,IAAI,SAAS,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,GAAG,sBAAsB,EAAE,CAAC;YACpF,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,SAAS,GAAG;YACV,IAAI;YACJ,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,IAAI,CAAC,UAAU,mCAAI,MAAO,CAAC;YACpE,SAAS,EAAE,GAAG;SACf,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAA,CAAC;IAEF,MAAM,MAAM,GAAG,CAAO,KAAa,EAAqC,EAAE;;QACxE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAgC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE;YAC7E,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;YACpB,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,GAAe,CAAC;QACpB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,eAAe,CAAC,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC;aAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7B,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;YACxB,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,aAAa,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC/E,WAAW,GAAG,GAAG,KAAK,aAAa,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;YAC/B,IAAI,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;gBACrB,qEAAqE;gBACrE,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC/B,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,GAAG,EAAE,CAAC;oBACR,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;oBAChE,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,oBAAoB,EACpB,oCAAoC,GAAG,IAAI,CAC5C,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;YAC7F,CAAC;YACD,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,8CAC9B,UAAU,EAAE,CAAC,SAA0B,CAAC,IACrC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClD,CAAC,OAAO,CAAC,QAAQ;gBAClB,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAyC,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC,KACP,cAAc,IACd,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;gBACvB,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,6BAA6B,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,yCAAyC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,+CAAmC,EAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO;YACL,KAAK;YACL,OAAO,EAAE,QAAqC;YAC9C,YAAY;YACZ,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC;SAC5B,CAAC;IACJ,CAAC,CAAA,CAAC;IAEF,OAAO;QACL,MAAM;QACA,yBAAyB,CAAC,MAAe;;gBAC7C,MAAM,KAAK,GAAG,IAAA,qCAAyB,EAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,qCAAqC,CAAC,CAAC;gBAC3F,CAAC;gBACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAsB,wBAAwB,CAC5C,MAAe,EACf,OAAwC;;QAExC,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC/E,CAAC;CAAA","sourcesContent":["import { createHash, createPublicKey } from \"crypto\";\nimport type { JsonWebKey } from \"crypto\";\nimport * as jwt from \"jsonwebtoken\";\nimport type { AccessiAccessTokenPayload } from \"../contracts\";\nimport { extractAccessiBearerToken, resolveCodiceUtenteFromTokenPayload } from \"../contracts\";\nimport { accessiAuthError } from \"./errors\";\nimport { deriveAccessiAccessSecret } from \"./keys\";\nimport { recordAccessiMetric } from \"../../accessi-module/observability/metrics\";\nimport type { AccessiJwtAlgorithm, AccessiResourceServerJwtOptions, AccessiUnknownKeyIdEvent } from \"./types\";\n\n/** Esito della verifica locale di un access token. */\nexport interface AccessiTokenVerification {\n  token: string;\n  payload: AccessiAccessTokenPayload;\n  codiceUtente: number;\n  user: Record<string, unknown>;\n}\n\n/** Verificatore riutilizzabile: conserva la cache JWKS tra una richiesta e l'altra. */\nexport interface AccessiTokenVerifier {\n  verify(token: string): Promise<AccessiTokenVerification>;\n  verifyAuthorizationHeader(header: unknown): Promise<AccessiTokenVerification>;\n}\n\ninterface JwksCacheEntry {\n  keys: Array<Record<string, unknown>>;\n  expiresAt: number;\n  fetchedAt: number;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction extractUser(payload: Record<string, unknown>): Record<string, unknown> {\n  const userData = isRecord(payload.userData) ? payload.userData : undefined;\n  const utente = isRecord(payload.utente)\n    ? payload.utente\n    : isRecord(userData?.utente)\n      ? userData.utente\n      : undefined;\n  return utente ?? {};\n}\n\nfunction defaultAlgorithms(options: AccessiResourceServerJwtOptions): AccessiJwtAlgorithm[] {\n  if (options.algorithms && options.algorithms.length > 0) return options.algorithms;\n\n  const algorithms: AccessiJwtAlgorithm[] = [];\n  if (options.secret || options.serverSecret) algorithms.push(\"HS256\");\n  if (options.publicKey || options.jwks) {\n    algorithms.push(\"RS256\", \"RS384\", \"RS512\", \"ES256\", \"ES384\", \"ES512\");\n  }\n  return algorithms;\n}\n\nfunction algorithmFamily(algorithm: string): \"hmac\" | \"asymmetric\" {\n  return algorithm.startsWith(\"HS\") ? \"hmac\" : \"asymmetric\";\n}\n\nasync function fetchJwks(\n  options: NonNullable<AccessiResourceServerJwtOptions[\"jwks\"]>,\n): Promise<Array<Record<string, unknown>>> {\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"fetch non disponibile per caricare la JWKS.\");\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 3000);\n  try {\n    const response = await fetchImpl(options.url, {\n      method: \"GET\",\n      headers: { Accept: \"application/json\" },\n      signal: controller.signal,\n    });\n    if (!response.ok) {\n      throw accessiAuthError(\n        503,\n        \"AUTH_JWKS_UNAVAILABLE\",\n        `JWKS non disponibile (HTTP ${response.status}).`,\n      );\n    }\n    const payload: unknown = await response.json();\n    if (!isRecord(payload) || !Array.isArray(payload.keys)) {\n      throw accessiAuthError(503, \"AUTH_JWKS_UNAVAILABLE\", \"Risposta JWKS non valida.\");\n    }\n    return payload.keys.filter(isRecord);\n  } catch (error) {\n    if (error && typeof error === \"object\" && \"code\" in error && \"status\" in error) {\n      throw error;\n    }\n    throw accessiAuthError(503, \"AUTH_JWKS_UNAVAILABLE\", \"JWKS non raggiungibile.\");\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nfunction selectJwk(\n  keys: Array<Record<string, unknown>>,\n  kid: string | undefined,\n  algorithm: string,\n): Record<string, unknown> | undefined {\n  return keys.find((key) => {\n    const keyAlg = typeof key.alg === \"string\" ? key.alg : undefined;\n    if (keyAlg && keyAlg !== algorithm) return false;\n    if (!kid) return true;\n    return typeof key.kid === \"string\" && key.kid === kid;\n  });\n}\n\n/** Fingerprint della chiave pubblica, identico a quello usato dalla JWKS Accessi. */\nfunction fingerprintPublicKey(publicKey: string | Buffer): string {\n  const der = createPublicKey(publicKey).export({ type: \"spki\", format: \"der\" });\n  return createHash(\"sha256\").update(der).digest(\"base64url\").slice(0, 16);\n}\n\nfunction jwkToPem(jwk: Record<string, unknown>): string {\n  return createPublicKey({ key: jwk as unknown as JsonWebKey, format: \"jwk\" })\n    .export({ type: \"spki\", format: \"pem\" })\n    .toString();\n}\n\n/** L'alert non deve mai cambiare l'esito dell'autenticazione. */\nfunction notifyUnknownKeyId(\n  options: AccessiResourceServerJwtOptions,\n  event: AccessiUnknownKeyIdEvent,\n): void {\n  recordAccessiMetric('accessi_jwt_unknown_key_id_total', 1, {\n    purpose: 'access',\n    source: event.source,\n    ...(event.algorithm ? { algorithm: event.algorithm } : {}),\n  });\n  try {\n    options.onUnknownKeyId?.(event);\n  } catch {\n    // Un logger o webhook guasto non trasforma un 401 in un 500.\n  }\n}\n\n/**\n * Crea un verificatore locale riutilizzabile.\n *\n * Supporta HMAC, chiavi pubbliche PEM (RS ed ES) e JWKS remoto. La cache\n * JWKS e legata all'istanza del verificatore.\n */\nexport function createAccessiTokenVerifier(options: AccessiResourceServerJwtOptions): AccessiTokenVerifier {\n  const algorithms = defaultAlgorithms(options);\n  if (algorithms.length === 0) {\n    throw accessiAuthError(\n      500,\n      \"AUTH_CONFIG_INVALID\",\n      \"Configurare almeno una tra jwt.secret, jwt.serverSecret, jwt.publicKey e jwt.jwks.\",\n    );\n  }\n\n  const clockTolerance = options.clockToleranceSeconds ?? 5;\n  const hmacSecret = options.secret\n    ?? (options.serverSecret ? deriveAccessiAccessSecret(options.serverSecret) : undefined);\n  let jwksCache: JwksCacheEntry | undefined;\n  const jwksMinRefreshInterval = Math.max(0, options.jwks?.minRefreshIntervalMs ?? 5_000);\n\n  const getJwksKeys = async (forceRefresh = false): Promise<Array<Record<string, unknown>>> => {\n    if (!options.jwks) return [];\n    const now = Date.now();\n    if (!forceRefresh && jwksCache && jwksCache.expiresAt > now) return jwksCache.keys;\n    // Refresh forzato ma troppo ravvicinato: riusa la cache per non martellare la JWKS.\n    if (forceRefresh && jwksCache && now - jwksCache.fetchedAt < jwksMinRefreshInterval) {\n      return jwksCache.keys;\n    }\n    const keys = await fetchJwks(options.jwks);\n    jwksCache = {\n      keys,\n      expiresAt: now + Math.max(1_000, options.jwks.cacheTtlMs ?? 300_000),\n      fetchedAt: now,\n    };\n    return keys;\n  };\n\n  const verify = async (token: string): Promise<AccessiTokenVerification> => {\n    const decoded = jwt.decode(token, { complete: true });\n    if (!decoded || typeof decoded === \"string\" || !isRecord(decoded.header)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token JWT non valido.\");\n    }\n\n    const algorithm = typeof decoded.header.alg === \"string\" ? decoded.header.alg : undefined;\n    if (!algorithm || !algorithms.includes(algorithm as AccessiJwtAlgorithm)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Algoritmo JWT non consentito.\");\n    }\n\n    const kid = typeof decoded.header.kid === \"string\" && decoded.header.kid !== \"\"\n      ? decoded.header.kid\n      : undefined;\n    let key: jwt.Secret;\n    let kidMismatch = false;\n    if (algorithmFamily(algorithm) === \"hmac\") {\n      if (!hmacSecret) {\n        throw accessiAuthError(\n          500,\n          \"AUTH_CONFIG_INVALID\",\n          \"jwt.secret o jwt.serverSecret non configurato per token HS*.\",\n        );\n      }\n      key = hmacSecret;\n    } else if (options.publicKey) {\n      key = options.publicKey;\n      if (kid) {\n        const expectedKeyId = options.keyId ?? fingerprintPublicKey(options.publicKey);\n        kidMismatch = kid !== expectedKeyId;\n      }\n    } else if (options.jwks) {\n      let keys = await getJwksKeys();\n      let selected = selectJwk(keys, kid, algorithm);\n      if (!selected && kid) {\n        // La JWKS in cache potrebbe precedere una rotazione appena avvenuta.\n        keys = await getJwksKeys(true);\n        selected = selectJwk(keys, kid, algorithm);\n      }\n      if (!selected) {\n        if (kid) {\n          notifyUnknownKeyId(options, { kid, algorithm, source: \"jwks\" });\n          throw accessiAuthError(\n            401,\n            \"AUTH_TOKEN_INVALID\",\n            `Chiave JWKS non trovata per kid \"${kid}\".`,\n          );\n        }\n        throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Chiave JWKS non trovata per il token.\");\n      }\n      key = jwkToPem(selected);\n    } else {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"jwt.publicKey/jwt.jwks non configurati.\");\n    }\n\n    let verified: unknown;\n    try {\n      verified = jwt.verify(token, key, {\n        algorithms: [algorithm as jwt.Algorithm],\n        ...(options.issuer ? { issuer: options.issuer } : {}),\n        ...(options.audience\n          ? { audience: options.audience as jwt.VerifyOptions[\"audience\"] }\n          : {}),\n        clockTolerance,\n      });\n    } catch {\n      if (kidMismatch && kid) {\n        notifyUnknownKeyId(options, { kid, algorithm, source: \"publicKey\" });\n      }\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido o scaduto.\");\n    }\n\n    if (!isRecord(verified)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Payload JWT non valido.\");\n    }\n    if (verified.typ !== \"access\") {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Il token non e un access token Accessi.\");\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(verified);\n    if (!codiceUtente) {\n      throw accessiAuthError(401, \"AUTH_USER_CODE_MISSING\", \"Token privo di un utente valido.\");\n    }\n\n    return {\n      token,\n      payload: verified as AccessiAccessTokenPayload,\n      codiceUtente,\n      user: extractUser(verified),\n    };\n  };\n\n  return {\n    verify,\n    async verifyAuthorizationHeader(header: unknown): Promise<AccessiTokenVerification> {\n      const token = extractAccessiBearerToken(header);\n      if (!token) {\n        throw accessiAuthError(401, \"AUTH_TOKEN_MISSING\", \"Token Bearer mancante o malformato.\");\n      }\n      return verify(token);\n    },\n  };\n}\n\n/** Converte un header `Authorization` in verifica del token, senza cache JWKS condivisa. */\nexport async function verifyAccessiAccessToken(\n  header: unknown,\n  options: AccessiResourceServerJwtOptions,\n): Promise<AccessiTokenVerification> {\n  return createAccessiTokenVerifier(options).verifyAuthorizationHeader(header);\n}\n"]}

package/dist/accessi/resource-server/types.d.ts

@@ -0,0 +1,114 @@
+import type { AccessiAuthorizationOptions, AccessiGrant, GrantsResult } from "../contracts";
+import type { SessionRevocationStore } from "../../accessi-module/security/sessionRevocation";
+import type { AccessTokenRevocationStore } from "../../accessi-module/security/accessTokenRevocation";
+import type { RefreshTokenRotationStore } from "../../accessi-module/security/refreshTokenRotation";
+/** Algoritmi JWT supportati dal resource server. */
+export type AccessiJwtAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512";
+/** Evento emesso quando un token usa un `kid` assente dalla configurazione. */
+export interface AccessiUnknownKeyIdEvent {
+    kid: string;
+    algorithm?: string;
+    /** Fonte della chiave: JWKS remota o chiave pubblica statica. */
+    source: "jwks" | "publicKey";
+}
+/** Opzioni di verifica locale del JWT. Almeno una tra `secret`, `publicKey` e `jwks` e obbligatoria. */
+export interface AccessiResourceServerJwtOptions {
+    /** Chiave HMAC gia derivata (access key). Alternativa a `serverSecret`. */
+    secret?: string;
+    /**
+     * Segreto Accessi grezzo (`ACCESSI_JWT_SECRET`).
+     *
+     * Il resource server deriva automaticamente la chiave access con la stessa
+     * KDF del server: e il modo consigliato quando si condivide il segreto HS256.
+     */
+    serverSecret?: string;
+    /** Chiave pubblica PEM per algoritmi RS ed ES. */
+    publicKey?: string | Buffer;
+    /** JWKS remoto per verificare token firmati con chiavi asimmetriche. */
+    jwks?: {
+        url: string;
+        cacheTtlMs?: number;
+        timeoutMs?: number;
+        /**
+         * Distanza minima tra due refresh forzati quando arriva un `kid` sconosciuto.
+         * Default: 5000 ms. Evita che token con `kid` inventati martellino la JWKS.
+         */
+        minRefreshIntervalMs?: number;
+        fetch?: typeof fetch;
+    };
+    /**
+     * `kid` della chiave statica in `publicKey`. Se assente si usa il fingerprint
+     * della chiave, lo stesso calcolato dalla JWKS Accessi.
+     */
+    keyId?: string;
+    /**
+     * Alert quando un token non e verificabile per un `kid` non presente nella
+     * chiave configurata o nella JWKS. Utile per intercettare rotazioni incomplete.
+     */
+    onUnknownKeyId?: (event: AccessiUnknownKeyIdEvent) => void;
+    /** Default: HS256 con `secret`, altrimenti RS/ES con `publicKey`/`jwks`. */
+    algorithms?: AccessiJwtAlgorithm[];
+    /** Issuer atteso (`iss`). */
+    issuer?: string;
+    /** Audience attesa (`aud`). */
+    audience?: string | string[];
+    /** Tolleranza orologio in secondi. Default: 5. */
+    clockToleranceSeconds?: number;
+}
+/** Configurazione del client di introspection verso Accessi Service. */
+export interface AccessiIntrospectionOptions {
+    /** URL completo, es. `https://accessi.example.com/api/accessi/auth/introspect`. */
+    url: string;
+    /** Service token Accessi con scope `accessi:introspect`. */
+    serviceToken: string;
+    /** TTL della cache locale dei risultati attivi. Default: 30000 ms. */
+    cacheTtlMs?: number;
+    /** Timeout HTTP. Default: 3000 ms. */
+    timeoutMs?: number;
+    /** Fetch iniettabile per test o runtime non-Node. */
+    fetch?: typeof fetch;
+}
+/** Risultato dell'introspection. */
+export interface AccessiIntrospectionResult {
+    active: boolean;
+    user?: Record<string, unknown>;
+    codiceUtente?: number;
+    grants?: GrantsResult;
+}
+/** Modalita di autenticazione del resource server. */
+export type AccessiResourceServerMode = "local" | "introspection";
+/**
+ * Configurazione di un backend fratello che non possiede il database Accessi.
+ *
+ * - `mode: "local"` verifica il JWT con chiave locale e, se servono grant, usa
+ *   l'introspection per leggerli.
+ * - `mode: "introspection"` delega la verifica del token ad Accessi Service.
+ */
+export interface AccessiResourceServerOptions {
+    mode?: AccessiResourceServerMode;
+    jwt?: AccessiResourceServerJwtOptions;
+    introspection?: AccessiIntrospectionOptions;
+    /** Policy di autorizzazione opzionale applicata dopo l'autenticazione. */
+    authorization?: AccessiAuthorizationOptions;
+    /** Store condiviso di revoca. Opzionale. */
+    revocation?: {
+        /** Revoca per utente: invalida tutti i token emessi prima del cutoff. */
+        store?: SessionRevocationStore;
+        /** Revoca dei singoli access token tramite `jti`. */
+        accessTokenStore?: AccessTokenRevocationStore;
+        /** Store di rotazione refresh: applica la revoca delle famiglie sospette. */
+        familyStore?: RefreshTokenRotationStore;
+    };
+    /** Audit strutturato degli errori di autenticazione. Default: true. */
+    audit?: boolean;
+}
+/** Dati allegati alla request dopo l'autenticazione. */
+export interface AccessiRequestContext {
+    token: string;
+    user: Record<string, unknown>;
+    codiceUtente?: number;
+    grants?: GrantsResult;
+    payload?: Record<string, unknown>;
+}
+/** Grant esposto per compatibilita con il middleware storico. */
+export type AccessiRequestGrants = AccessiGrant[];

package/dist/accessi/resource-server/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/accessi/resource-server/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AccessiAuthorizationOptions,\n  AccessiGrant,\n  GrantsResult,\n} from \"../contracts\";\nimport type { SessionRevocationStore } from \"../../accessi-module/security/sessionRevocation\";\nimport type { AccessTokenRevocationStore } from \"../../accessi-module/security/accessTokenRevocation\";\nimport type { RefreshTokenRotationStore } from \"../../accessi-module/security/refreshTokenRotation\";\n\n/** Algoritmi JWT supportati dal resource server. */\nexport type AccessiJwtAlgorithm =\n  | \"HS256\"\n  | \"HS384\"\n  | \"HS512\"\n  | \"RS256\"\n  | \"RS384\"\n  | \"RS512\"\n  | \"ES256\"\n  | \"ES384\"\n  | \"ES512\";\n\n/** Evento emesso quando un token usa un `kid` assente dalla configurazione. */\nexport interface AccessiUnknownKeyIdEvent {\n  kid: string;\n  algorithm?: string;\n  /** Fonte della chiave: JWKS remota o chiave pubblica statica. */\n  source: \"jwks\" | \"publicKey\";\n}\n\n/** Opzioni di verifica locale del JWT. Almeno una tra `secret`, `publicKey` e `jwks` e obbligatoria. */\nexport interface AccessiResourceServerJwtOptions {\n  /** Chiave HMAC gia derivata (access key). Alternativa a `serverSecret`. */\n  secret?: string;\n  /**\n   * Segreto Accessi grezzo (`ACCESSI_JWT_SECRET`).\n   *\n   * Il resource server deriva automaticamente la chiave access con la stessa\n   * KDF del server: e il modo consigliato quando si condivide il segreto HS256.\n   */\n  serverSecret?: string;\n  /** Chiave pubblica PEM per algoritmi RS ed ES. */\n  publicKey?: string | Buffer;\n  /** JWKS remoto per verificare token firmati con chiavi asimmetriche. */\n  jwks?: {\n    url: string;\n    cacheTtlMs?: number;\n    timeoutMs?: number;\n    /**\n     * Distanza minima tra due refresh forzati quando arriva un `kid` sconosciuto.\n     * Default: 5000 ms. Evita che token con `kid` inventati martellino la JWKS.\n     */\n    minRefreshIntervalMs?: number;\n    fetch?: typeof fetch;\n  };\n  /**\n   * `kid` della chiave statica in `publicKey`. Se assente si usa il fingerprint\n   * della chiave, lo stesso calcolato dalla JWKS Accessi.\n   */\n  keyId?: string;\n  /**\n   * Alert quando un token non e verificabile per un `kid` non presente nella\n   * chiave configurata o nella JWKS. Utile per intercettare rotazioni incomplete.\n   */\n  onUnknownKeyId?: (event: AccessiUnknownKeyIdEvent) => void;\n  /** Default: HS256 con `secret`, altrimenti RS/ES con `publicKey`/`jwks`. */\n  algorithms?: AccessiJwtAlgorithm[];\n  /** Issuer atteso (`iss`). */\n  issuer?: string;\n  /** Audience attesa (`aud`). */\n  audience?: string | string[];\n  /** Tolleranza orologio in secondi. Default: 5. */\n  clockToleranceSeconds?: number;\n}\n\n/** Configurazione del client di introspection verso Accessi Service. */\nexport interface AccessiIntrospectionOptions {\n  /** URL completo, es. `https://accessi.example.com/api/accessi/auth/introspect`. */\n  url: string;\n  /** Service token Accessi con scope `accessi:introspect`. */\n  serviceToken: string;\n  /** TTL della cache locale dei risultati attivi. Default: 30000 ms. */\n  cacheTtlMs?: number;\n  /** Timeout HTTP. Default: 3000 ms. */\n  timeoutMs?: number;\n  /** Fetch iniettabile per test o runtime non-Node. */\n  fetch?: typeof fetch;\n}\n\n/** Risultato dell'introspection. */\nexport interface AccessiIntrospectionResult {\n  active: boolean;\n  user?: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n}\n\n/** Modalita di autenticazione del resource server. */\nexport type AccessiResourceServerMode = \"local\" | \"introspection\";\n\n/**\n * Configurazione di un backend fratello che non possiede il database Accessi.\n *\n * - `mode: \"local\"` verifica il JWT con chiave locale e, se servono grant, usa\n *   l'introspection per leggerli.\n * - `mode: \"introspection\"` delega la verifica del token ad Accessi Service.\n */\nexport interface AccessiResourceServerOptions {\n  mode?: AccessiResourceServerMode;\n  jwt?: AccessiResourceServerJwtOptions;\n  introspection?: AccessiIntrospectionOptions;\n  /** Policy di autorizzazione opzionale applicata dopo l'autenticazione. */\n  authorization?: AccessiAuthorizationOptions;\n  /** Store condiviso di revoca. Opzionale. */\n  revocation?: {\n    /** Revoca per utente: invalida tutti i token emessi prima del cutoff. */\n    store?: SessionRevocationStore;\n    /** Revoca dei singoli access token tramite `jti`. */\n    accessTokenStore?: AccessTokenRevocationStore;\n    /** Store di rotazione refresh: applica la revoca delle famiglie sospette. */\n    familyStore?: RefreshTokenRotationStore;\n  };\n  /** Audit strutturato degli errori di autenticazione. Default: true. */\n  audit?: boolean;\n}\n\n/** Dati allegati alla request dopo l'autenticazione. */\nexport interface AccessiRequestContext {\n  token: string;\n  user: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n  payload?: Record<string, unknown>;\n}\n\n/** Grant esposto per compatibilita con il middleware storico. */\nexport type AccessiRequestGrants = AccessiGrant[];\n"]}

package/dist/accessi/server/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Entry point server Accessi.
+ *
+ * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,
+ * console e servizi Nest completi. I backend fratelli devono usare
+ * `accessi/resource-server` e `accessi/client`.
+ */
+export * from "../../accessi-module";
+export * from "./standalone";
+export * from "./tenants";
+export * from "./tenantStores";
+export type { AccessiOptions as AccessiServerOptions } from "../../accessi-module";
+export { createAccessiOptionsFromEnv, createCatalogScriptsOptionsFromEnv, parseAccessiPreviousPublicKeys, } from "../../accessi-module/database-updates/accessiOptionsFromEnv";

package/dist/accessi/server/index.js

@@ -0,0 +1,33 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAccessiPreviousPublicKeys = exports.createCatalogScriptsOptionsFromEnv = exports.createAccessiOptionsFromEnv = void 0;
+/**
+ * Entry point server Accessi.
+ *
+ * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,
+ * console e servizi Nest completi. I backend fratelli devono usare
+ * `accessi/resource-server` e `accessi/client`.
+ */
+__exportStar(require("../../accessi-module"), exports);
+__exportStar(require("./standalone"), exports);
+__exportStar(require("./tenants"), exports);
+__exportStar(require("./tenantStores"), exports);
+var accessiOptionsFromEnv_1 = require("../../accessi-module/database-updates/accessiOptionsFromEnv");
+Object.defineProperty(exports, "createAccessiOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createAccessiOptionsFromEnv; } });
+Object.defineProperty(exports, "createCatalogScriptsOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createCatalogScriptsOptionsFromEnv; } });
+Object.defineProperty(exports, "parseAccessiPreviousPublicKeys", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.parseAccessiPreviousPublicKeys; } });
+//# sourceMappingURL=index.js.map

package/dist/accessi/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,uDAAqC;AACrC,+CAA6B;AAC7B,4CAA0B;AAC1B,iDAA+B;AAE/B,qGAIqE;AAHnE,oIAAA,2BAA2B,OAAA;AAC3B,2IAAA,kCAAkC,OAAA;AAClC,uIAAA,8BAA8B,OAAA","sourcesContent":["/**\n * Entry point server Accessi.\n *\n * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,\n * console e servizi Nest completi. I backend fratelli devono usare\n * `accessi/resource-server` e `accessi/client`.\n */\nexport * from \"../../accessi-module\";\nexport * from \"./standalone\";\nexport * from \"./tenants\";\nexport * from \"./tenantStores\";\nexport type { AccessiOptions as AccessiServerOptions } from \"../../accessi-module\";\nexport {\n  createAccessiOptionsFromEnv,\n  createCatalogScriptsOptionsFromEnv,\n  parseAccessiPreviousPublicKeys,\n} from \"../../accessi-module/database-updates/accessiOptionsFromEnv\";\n"]}

package/dist/accessi/server/standalone.d.ts

@@ -0,0 +1,39 @@
+import type { Application } from 'express';
+import type { Server } from 'http';
+import type { AccessiModuleInitializationResult } from '../../accessi-module';
+import type { AccessiOptions } from '../../accessi-module/AccessiModule';
+import type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';
+export type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';
+export interface AccessiServiceOptions {
+    /** Applicazione Express gia esistente. Default: nuova app. */
+    app?: Application;
+    /** Configurazione completa. Default: `createAccessiOptionsFromEnv()`. */
+    accessiOptions?: AccessiOptions;
+    port?: number;
+    host?: string;
+    /** Path base degli endpoint health. Default: `/health`. */
+    healthPath?: string;
+    /** Espone `/health/metrics` in formato Prometheus. Default: true. */
+    metrics?: boolean;
+    /** Check aggiuntivi per la readiness. */
+    readinessChecks?: AccessiReadinessCheck[];
+    /** Timeout chiusura server. Default: 10000 ms. */
+    shutdownTimeoutMs?: number;
+}
+export interface AccessiService {
+    app: Application;
+    nestApp: AccessiModuleInitializationResult['nestApp'];
+    document: AccessiModuleInitializationResult['document'];
+    start(): Promise<Server>;
+    stop(): Promise<void>;
+}
+/**
+ * Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.
+ *
+ * Non apre la porta finche non viene chiamato `start()`.
+ */
+export declare function createAccessiService(options?: AccessiServiceOptions): Promise<AccessiService>;
+/**
+ * Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.
+ */
+export declare function startAccessiService(options?: AccessiServiceOptions): Promise<AccessiService>;