emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.81

package/dist/accessi/server/standalone.js

@@ -0,0 +1,191 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiService = createAccessiService;
+exports.startAccessiService = startAccessiService;
+const express_1 = __importDefault(require("express"));
+const Logger_1 = require("../../Logger");
+const Orm_1 = require("../../Orm");
+const accessi_module_1 = require("../../accessi-module");
+const accessiOptionsFromEnv_1 = require("../../accessi-module/database-updates/accessiOptionsFromEnv");
+const readiness_1 = require("../../accessi-module/health/readiness");
+const validateOptions_1 = require("../../accessi-module/security/validateOptions");
+const metrics_1 = require("../../accessi-module/observability/metrics");
+function normalizePath(value) {
+    return `/${value.replace(/^\/+|\/+$/g, '')}`;
+}
+function createMetrics() {
+    const startedAt = Date.now();
+    let requests = 0;
+    let inFlight = 0;
+    const statuses = new Map();
+    const middleware = (_req, res, next) => {
+        requests += 1;
+        inFlight += 1;
+        res.on('finish', () => {
+            var _a;
+            inFlight = Math.max(0, inFlight - 1);
+            const status = String(res.statusCode);
+            statuses.set(status, ((_a = statuses.get(status)) !== null && _a !== void 0 ? _a : 0) + 1);
+        });
+        next();
+    };
+    const render = () => {
+        const memory = process.memoryUsage();
+        const lines = [
+            '# HELP accessi_http_requests_total Richieste HTTP totali.',
+            '# TYPE accessi_http_requests_total counter',
+            ...[...statuses.entries()].map(([status, count]) => `accessi_http_requests_total{status="${status}"} ${count}`),
+            '# HELP accessi_http_in_flight Richieste HTTP in corso.',
+            '# TYPE accessi_http_in_flight gauge',
+            `accessi_http_in_flight ${inFlight}`,
+            '# HELP accessi_process_uptime_seconds Uptime del processo.',
+            '# TYPE accessi_process_uptime_seconds gauge',
+            `accessi_process_uptime_seconds ${Math.floor((Date.now() - startedAt) / 1000)}`,
+            '# HELP accessi_process_memory_bytes Memoria del processo.',
+            '# TYPE accessi_process_memory_bytes gauge',
+            `accessi_process_memory_bytes{type="rss"} ${memory.rss}`,
+            `accessi_process_memory_bytes{type="heapUsed"} ${memory.heapUsed}`,
+            `accessi_process_memory_bytes{type="heapTotal"} ${memory.heapTotal}`,
+            '# HELP accessi_http_requests_started_total Richieste HTTP avviate.',
+            '# TYPE accessi_http_requests_started_total counter',
+            `accessi_http_requests_started_total ${requests}`,
+        ];
+        return `${lines.join('\n')}\n`;
+    };
+    return { middleware, render };
+}
+/**
+ * Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.
+ *
+ * Non apre la porta finche non viene chiamato `start()`.
+ */
+function createAccessiService() {
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        var _a, _b, _c, _d;
+        const logger = new Logger_1.Logger('AccessiService');
+        const accessiOptions = (_a = options.accessiOptions) !== null && _a !== void 0 ? _a : (0, accessiOptionsFromEnv_1.createAccessiOptionsFromEnv)();
+        (0, validateOptions_1.assertValidAccessiOptions)(accessiOptions);
+        for (const warning of (0, validateOptions_1.validateAccessiOptions)(accessiOptions).warnings) {
+            logger.warning(`Configurazione Accessi: ${warning.code} - ${warning.message}`);
+        }
+        const app = (_b = options.app) !== null && _b !== void 0 ? _b : (0, express_1.default)();
+        const healthPath = normalizePath((_c = options.healthPath) !== null && _c !== void 0 ? _c : '/health');
+        const metrics = createMetrics();
+        const readinessChecks = (_d = options.readinessChecks) !== null && _d !== void 0 ? _d : [];
+        let initialized = false;
+        let nestApp;
+        let document;
+        let server;
+        let stopping = false;
+        app.use(metrics.middleware);
+        app.get(`${healthPath}/live`, (_req, res) => {
+            res.status(200).json((0, readiness_1.createAccessiLiveReport)());
+        });
+        app.get(`${healthPath}/ready`, (_req, res) => __awaiter(this, void 0, void 0, function* () {
+            if (!initialized || !nestApp) {
+                res.status(503).json({
+                    status: 'error',
+                    checks: { bootstrap: { ok: false, detail: 'bootstrap non completato' } },
+                });
+                return;
+            }
+            const report = yield (0, readiness_1.checkAccessiReadiness)(accessiOptions, readinessChecks);
+            res.status((0, readiness_1.readinessHttpStatus)(report)).json(report);
+        }));
+        if (options.metrics !== false) {
+            app.get(`${healthPath}/metrics`, (_req, res) => {
+                res.setHeader('Content-Type', 'text/plain; version=0.0.4');
+                res.status(200).send(`${metrics.render()}${(0, metrics_1.renderAccessiMetrics)()}`);
+            });
+        }
+        const result = yield (0, accessi_module_1.initializeAccessiModule)(app, accessiOptions);
+        nestApp = result.nestApp;
+        document = result.document;
+        initialized = true;
+        const stop = () => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (stopping)
+                return;
+            stopping = true;
+            const timeout = Math.max(1000, (_a = options.shutdownTimeoutMs) !== null && _a !== void 0 ? _a : 10000);
+            yield Promise.race([
+                new Promise((resolve) => {
+                    if (!server)
+                        return resolve();
+                    server.close(() => resolve());
+                }),
+                new Promise((resolve) => setTimeout(resolve, timeout)),
+            ]);
+            try {
+                yield (nestApp === null || nestApp === void 0 ? void 0 : nestApp.close());
+            }
+            finally {
+                yield Orm_1.Orm.closePools();
+            }
+        });
+        const start = () => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            if (server)
+                return server;
+            const port = (_a = options.port) !== null && _a !== void 0 ? _a : Number((_b = process.env.PORT) !== null && _b !== void 0 ? _b : 3000);
+            server = yield new Promise((resolve, reject) => {
+                const listener = options.host
+                    ? app.listen(port, options.host, () => resolve(listener))
+                    : app.listen(port, () => resolve(listener));
+                listener.once('error', reject);
+            });
+            const address = server.address();
+            const actualPort = typeof address === 'object' && address ? address.port : port;
+            logger.info(`Accessi Service in ascolto su http://${(_c = options.host) !== null && _c !== void 0 ? _c : '0.0.0.0'}:${actualPort}`);
+            return server;
+        });
+        return {
+            app,
+            get nestApp() {
+                if (!nestApp)
+                    throw new Error('Accessi Service non inizializzato.');
+                return nestApp;
+            },
+            get document() {
+                if (!document)
+                    throw new Error('Documento OpenAPI non disponibile.');
+                return document;
+            },
+            start,
+            stop,
+        };
+    });
+}
+/**
+ * Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.
+ */
+function startAccessiService() {
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        const service = yield createAccessiService(options);
+        yield service.start();
+        let shuttingDown = false;
+        const shutdown = (signal) => __awaiter(this, void 0, void 0, function* () {
+            if (shuttingDown)
+                return;
+            shuttingDown = true;
+            new Logger_1.Logger('AccessiService').info(`Ricevuto ${signal}: arresto in corso.`);
+            yield service.stop();
+        });
+        process.once('SIGTERM', () => { void shutdown('SIGTERM'); });
+        process.once('SIGINT', () => { void shutdown('SIGINT'); });
+        return service;
+    });
+}
+//# sourceMappingURL=standalone.js.map

package/dist/accessi/server/standalone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone.js","sourceRoot":"","sources":["../../../src/accessi/server/standalone.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAuGA,oDAiGC;AAKD,kDAeC;AA5ND,sDAA8B;AAG9B,yCAAsC;AACtC,mCAAgC;AAChC,yDAA+D;AAK/D,uGAA0G;AAC1G,qEAI+C;AAE/C,mFAAkH;AAClH,wEAAkF;AA8BlF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB,EAAQ,EAAE;QAC1E,QAAQ,IAAI,CAAC,CAAC;QACd,QAAQ,IAAI,CAAC,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;;YACpB,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAW,EAAE;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG;YACZ,2DAA2D;YAC3D,4CAA4C;YAC5C,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC5B,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,uCAAuC,MAAM,MAAM,KAAK,EAAE,CAChF;YACD,wDAAwD;YACxD,qCAAqC;YACrC,0BAA0B,QAAQ,EAAE;YACpC,4DAA4D;YAC5D,6CAA6C;YAC7C,kCAAkC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,EAAE;YAC/E,2DAA2D;YAC3D,2CAA2C;YAC3C,4CAA4C,MAAM,CAAC,GAAG,EAAE;YACxD,iDAAiD,MAAM,CAAC,QAAQ,EAAE;YAClE,kDAAkD,MAAM,CAAC,SAAS,EAAE;YACpE,oEAAoE;YACpE,oDAAoD;YACpD,uCAAuC,QAAQ,EAAE;SAClD,CAAC;QACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAsB,oBAAoB;yDACxC,UAAiC,EAAE;;QAEnC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,cAAc,mCAAI,IAAA,mDAA2B,GAAE,CAAC;QAC/E,IAAA,2CAAyB,EAAC,cAAc,CAAC,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,IAAA,wCAAsB,EAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtE,MAAM,CAAC,OAAO,CAAC,2BAA2B,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAA,iBAAO,GAAE,CAAC;QACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,SAAS,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,EAAE,CAAC;QACtD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,OAAiE,CAAC;QACtE,IAAI,QAAmE,CAAC;QACxE,IAAI,MAA0B,CAAC;QAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,mCAAuB,GAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,QAAQ,EAAE,CAAO,IAAa,EAAE,GAAa,EAAE,EAAE;YACpE,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE;iBACzE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAqB,EAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,IAAA,+BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAA,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;gBAChE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAA,8BAAoB,GAAE,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAuB,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAClE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACzB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,WAAW,GAAG,IAAI,CAAC;QAEnB,MAAM,IAAI,GAAG,GAAwB,EAAE;;YACrC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,iBAAiB,mCAAI,KAAM,CAAC,CAAC;YACrE,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC5B,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,EAAE,CAAC;oBAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChC,CAAC,CAAC;gBACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,CAAA,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAG,CAAC,UAAU,EAAE,CAAC;YACzB,CAAC;QACH,CAAC,CAAA,CAAC;QAEF,MAAM,KAAK,GAAG,GAA0B,EAAE;;YACxC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,IAAI,mCAAI,IAAI,CAAC,CAAC;YAC9D,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI;oBAC3B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACzD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,wCAAwC,MAAA,OAAO,CAAC,IAAI,mCAAI,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC/F,OAAO,MAAM,CAAC;QAChB,CAAC,CAAA,CAAC;QAEF,OAAO;YACL,GAAG;YACH,IAAI,OAAO;gBACT,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACpE,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,QAAQ;gBACV,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACrE,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,KAAK;YACL,IAAI;SACL,CAAC;IACJ,CAAC;CAAA;AAED;;GAEG;AACH,SAAsB,mBAAmB;yDAAC,UAAiC,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QAEtB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAO,MAAc,EAAiB,EAAE;YACvD,IAAI,YAAY;gBAAE,OAAO;YACzB,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,MAAM,qBAAqB,CAAC,CAAC;YAC3E,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAA,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC;CAAA","sourcesContent":["import express from 'express';\nimport type { Application, Request, Response } from 'express';\nimport type { Server } from 'http';\nimport { Logger } from '../../Logger';\nimport { Orm } from '../../Orm';\nimport { initializeAccessiModule } from '../../accessi-module';\nimport type {\n  AccessiModuleInitializationResult,\n} from '../../accessi-module';\nimport type { AccessiOptions } from '../../accessi-module/AccessiModule';\nimport { createAccessiOptionsFromEnv } from '../../accessi-module/database-updates/accessiOptionsFromEnv';\nimport {\n  checkAccessiReadiness,\n  createAccessiLiveReport,\n  readinessHttpStatus,\n} from '../../accessi-module/health/readiness';\nimport type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';\nimport { assertValidAccessiOptions, validateAccessiOptions } from '../../accessi-module/security/validateOptions';\nimport { renderAccessiMetrics } from '../../accessi-module/observability/metrics';\n\nexport type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';\n\n\nexport interface AccessiServiceOptions {\n  /** Applicazione Express gia esistente. Default: nuova app. */\n  app?: Application;\n  /** Configurazione completa. Default: `createAccessiOptionsFromEnv()`. */\n  accessiOptions?: AccessiOptions;\n  port?: number;\n  host?: string;\n  /** Path base degli endpoint health. Default: `/health`. */\n  healthPath?: string;\n  /** Espone `/health/metrics` in formato Prometheus. Default: true. */\n  metrics?: boolean;\n  /** Check aggiuntivi per la readiness. */\n  readinessChecks?: AccessiReadinessCheck[];\n  /** Timeout chiusura server. Default: 10000 ms. */\n  shutdownTimeoutMs?: number;\n}\n\nexport interface AccessiService {\n  app: Application;\n  nestApp: AccessiModuleInitializationResult['nestApp'];\n  document: AccessiModuleInitializationResult['document'];\n  start(): Promise<Server>;\n  stop(): Promise<void>;\n}\n\nfunction normalizePath(value: string): string {\n  return `/${value.replace(/^\\/+|\\/+$/g, '')}`;\n}\n\nfunction createMetrics() {\n  const startedAt = Date.now();\n  let requests = 0;\n  let inFlight = 0;\n  const statuses = new Map<string, number>();\n\n  const middleware = (_req: Request, res: Response, next: () => void): void => {\n    requests += 1;\n    inFlight += 1;\n    res.on('finish', () => {\n      inFlight = Math.max(0, inFlight - 1);\n      const status = String(res.statusCode);\n      statuses.set(status, (statuses.get(status) ?? 0) + 1);\n    });\n    next();\n  };\n\n  const render = (): string => {\n    const memory = process.memoryUsage();\n    const lines = [\n      '# HELP accessi_http_requests_total Richieste HTTP totali.',\n      '# TYPE accessi_http_requests_total counter',\n      ...[...statuses.entries()].map(\n        ([status, count]) => `accessi_http_requests_total{status=\"${status}\"} ${count}`,\n      ),\n      '# HELP accessi_http_in_flight Richieste HTTP in corso.',\n      '# TYPE accessi_http_in_flight gauge',\n      `accessi_http_in_flight ${inFlight}`,\n      '# HELP accessi_process_uptime_seconds Uptime del processo.',\n      '# TYPE accessi_process_uptime_seconds gauge',\n      `accessi_process_uptime_seconds ${Math.floor((Date.now() - startedAt) / 1000)}`,\n      '# HELP accessi_process_memory_bytes Memoria del processo.',\n      '# TYPE accessi_process_memory_bytes gauge',\n      `accessi_process_memory_bytes{type=\"rss\"} ${memory.rss}`,\n      `accessi_process_memory_bytes{type=\"heapUsed\"} ${memory.heapUsed}`,\n      `accessi_process_memory_bytes{type=\"heapTotal\"} ${memory.heapTotal}`,\n      '# HELP accessi_http_requests_started_total Richieste HTTP avviate.',\n      '# TYPE accessi_http_requests_started_total counter',\n      `accessi_http_requests_started_total ${requests}`,\n    ];\n    return `${lines.join('\\n')}\\n`;\n  };\n\n  return { middleware, render };\n}\n\n/**\n * Crea un servizio Accessi standalone con health, readiness, metriche e shutdown.\n *\n * Non apre la porta finche non viene chiamato `start()`.\n */\nexport async function createAccessiService(\n  options: AccessiServiceOptions = {},\n): Promise<AccessiService> {\n  const logger = new Logger('AccessiService');\n  const accessiOptions = options.accessiOptions ?? createAccessiOptionsFromEnv();\n  assertValidAccessiOptions(accessiOptions);\n  for (const warning of validateAccessiOptions(accessiOptions).warnings) {\n    logger.warning(`Configurazione Accessi: ${warning.code} - ${warning.message}`);\n  }\n\n  const app = options.app ?? express();\n  const healthPath = normalizePath(options.healthPath ?? '/health');\n  const metrics = createMetrics();\n  const readinessChecks = options.readinessChecks ?? [];\n  let initialized = false;\n  let nestApp: AccessiModuleInitializationResult['nestApp'] | undefined;\n  let document: AccessiModuleInitializationResult['document'] | undefined;\n  let server: Server | undefined;\n  let stopping = false;\n\n  app.use(metrics.middleware);\n\n  app.get(`${healthPath}/live`, (_req: Request, res: Response) => {\n    res.status(200).json(createAccessiLiveReport());\n  });\n\n  app.get(`${healthPath}/ready`, async (_req: Request, res: Response) => {\n    if (!initialized || !nestApp) {\n      res.status(503).json({\n        status: 'error',\n        checks: { bootstrap: { ok: false, detail: 'bootstrap non completato' } },\n      });\n      return;\n    }\n\n    const report = await checkAccessiReadiness(accessiOptions, readinessChecks);\n    res.status(readinessHttpStatus(report)).json(report);\n  });\n\n  if (options.metrics !== false) {\n    app.get(`${healthPath}/metrics`, (_req: Request, res: Response) => {\n      res.setHeader('Content-Type', 'text/plain; version=0.0.4');\n      res.status(200).send(`${metrics.render()}${renderAccessiMetrics()}`);\n    });\n  }\n\n  const result = await initializeAccessiModule(app, accessiOptions);\n  nestApp = result.nestApp;\n  document = result.document;\n  initialized = true;\n\n  const stop = async (): Promise<void> => {\n    if (stopping) return;\n    stopping = true;\n    const timeout = Math.max(1_000, options.shutdownTimeoutMs ?? 10_000);\n    await Promise.race([\n      new Promise<void>((resolve) => {\n        if (!server) return resolve();\n        server.close(() => resolve());\n      }),\n      new Promise<void>((resolve) => setTimeout(resolve, timeout)),\n    ]);\n    try {\n      await nestApp?.close();\n    } finally {\n      await Orm.closePools();\n    }\n  };\n\n  const start = async (): Promise<Server> => {\n    if (server) return server;\n    const port = options.port ?? Number(process.env.PORT ?? 3000);\n    server = await new Promise<Server>((resolve, reject) => {\n      const listener = options.host\n        ? app.listen(port, options.host, () => resolve(listener))\n        : app.listen(port, () => resolve(listener));\n      listener.once('error', reject);\n    });\n    const address = server.address();\n    const actualPort = typeof address === 'object' && address ? address.port : port;\n    logger.info(`Accessi Service in ascolto su http://${options.host ?? '0.0.0.0'}:${actualPort}`);\n    return server;\n  };\n\n  return {\n    app,\n    get nestApp() {\n      if (!nestApp) throw new Error('Accessi Service non inizializzato.');\n      return nestApp;\n    },\n    get document() {\n      if (!document) throw new Error('Documento OpenAPI non disponibile.');\n      return document;\n    },\n    start,\n    stop,\n  };\n}\n\n/**\n * Avvia Accessi Service e registra SIGTERM/SIGINT per lo shutdown graceful.\n */\nexport async function startAccessiService(options: AccessiServiceOptions = {}): Promise<AccessiService> {\n  const service = await createAccessiService(options);\n  await service.start();\n\n  let shuttingDown = false;\n  const shutdown = async (signal: string): Promise<void> => {\n    if (shuttingDown) return;\n    shuttingDown = true;\n    new Logger('AccessiService').info(`Ricevuto ${signal}: arresto in corso.`);\n    await service.stop();\n  };\n\n  process.once('SIGTERM', () => { void shutdown('SIGTERM'); });\n  process.once('SIGINT', () => { void shutdown('SIGINT'); });\n  return service;\n}\n"]}

package/dist/accessi/server/tenantStores.d.ts

@@ -0,0 +1,74 @@
+import type { AccessiOptions } from '../../accessi-module/AccessiModule';
+import type { RateLimitStore } from '../../accessi-module/security/rateLimitStore';
+import type { ConsoleEntryStore } from '../../accessi-module/security/consoleEntry';
+import type { SessionRevocationStore } from '../../accessi-module/security/sessionRevocation';
+import type { AccessTokenRevocationStore } from '../../accessi-module/security/accessTokenRevocation';
+import type { RefreshTokenRotationStore } from '../../accessi-module/security/refreshTokenRotation';
+/** Client Redis minimo accettato dagli store Accessi. */
+export interface AccessiTenantRedisClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+/** Prefissi Redis per singolo store, tutti relativi al tenant. */
+export interface AccessiTenantStorePrefixes {
+    base?: string;
+    rateLimit?: string;
+    serviceTokenRateLimit?: string;
+    sessionRevocation?: string;
+    accessTokenRevocation?: string;
+    refreshTokenRotation?: string;
+    refreshTokenFamily?: string;
+    consoleEntry?: string;
+}
+export interface ResolvedAccessiTenantStorePrefixes {
+    base: string;
+    rateLimit: string;
+    serviceTokenRateLimit: string;
+    sessionRevocation: string;
+    accessTokenRevocation: string;
+    refreshTokenRotation: string;
+    refreshTokenFamily: string;
+    consoleEntry: string;
+}
+export interface CreateAccessiTenantStoresOptions {
+    tenantId: string;
+    client: AccessiTenantRedisClient;
+    /** Segreto per cifrare i ticket console a riposo. Usare un segreto del tenant. */
+    encryptionKey: string | Buffer;
+    /** Base prefix. Default: `accessi:<tenantId>:`. */
+    prefix?: string;
+    prefixes?: AccessiTenantStorePrefixes;
+    /** TTL revoca sessioni. Default dello store (365 giorni). */
+    sessionRevocationTtlMs?: number;
+    /** TTL revoca jti. Default dello store (24 ore). */
+    accessTokenRevocationTtlMs?: number;
+    consoleEntryMaxIssueAttempts?: number;
+    /** Attiva la rotazione refresh token nell'options risultante. Default: true. */
+    enableRefreshTokenRotation?: boolean;
+}
+export interface AccessiTenantStores {
+    tenantId: string;
+    prefixes: ResolvedAccessiTenantStorePrefixes;
+    rateLimit: RateLimitStore;
+    serviceTokenRateLimit: RateLimitStore;
+    sessionRevocation: SessionRevocationStore;
+    accessTokenRevocation: AccessTokenRevocationStore;
+    refreshTokenRotation: RefreshTokenRotationStore;
+    consoleEntry: ConsoleEntryStore;
+    /** Collega tutti gli store alle opzioni Accessi del tenant. */
+    applyTo(options: AccessiOptions): AccessiOptions;
+}
+/**
+ * Prefissi Redis isolati per tenant.
+ *
+ * Ogni store ha un namespace distinto: condividere un prefisso tra tenant
+ * significherebbe condividere rate limit, revoche o refresh token.
+ */
+export declare function getAccessiTenantStorePrefixes(tenantId: string, overrides?: AccessiTenantStorePrefixes): ResolvedAccessiTenantStorePrefixes;
+/**
+ * Crea tutti gli store Redis di un tenant con prefissi gia isolati.
+ *
+ * `applyTo` restituisce una copia delle opzioni con gli store collegati:
+ * `publicAuthRateLimit`, `serviceTokens`, `sessionRevocation`,
+ * `accessTokenRevocation`, `refreshTokenRotation` e `consoleEntry`.
+ */
+export declare function createAccessiTenantStores(options: CreateAccessiTenantStoresOptions): AccessiTenantStores;

package/dist/accessi/server/tenantStores.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAccessiTenantStorePrefixes = getAccessiTenantStorePrefixes;
+exports.createAccessiTenantStores = createAccessiTenantStores;
+const tenants_1 = require("./tenants");
+const rateLimitStore_1 = require("../../accessi-module/security/rateLimitStore");
+const consoleEntry_1 = require("../../accessi-module/security/consoleEntry");
+const sessionRevocation_1 = require("../../accessi-module/security/sessionRevocation");
+const accessTokenRevocation_1 = require("../../accessi-module/security/accessTokenRevocation");
+const refreshTokenRotation_1 = require("../../accessi-module/security/refreshTokenRotation");
+/**
+ * Prefissi Redis isolati per tenant.
+ *
+ * Ogni store ha un namespace distinto: condividere un prefisso tra tenant
+ * significherebbe condividere rate limit, revoche o refresh token.
+ */
+function getAccessiTenantStorePrefixes(tenantId, overrides = {}) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    const base = (_a = overrides.base) !== null && _a !== void 0 ? _a : (0, tenants_1.getAccessiTenantRedisPrefix)(tenantId);
+    return {
+        base,
+        rateLimit: (_b = overrides.rateLimit) !== null && _b !== void 0 ? _b : `${base}rate:`,
+        serviceTokenRateLimit: (_c = overrides.serviceTokenRateLimit) !== null && _c !== void 0 ? _c : `${base}service-token-rate:`,
+        sessionRevocation: (_d = overrides.sessionRevocation) !== null && _d !== void 0 ? _d : `${base}session:`,
+        accessTokenRevocation: (_e = overrides.accessTokenRevocation) !== null && _e !== void 0 ? _e : `${base}jti:`,
+        refreshTokenRotation: (_f = overrides.refreshTokenRotation) !== null && _f !== void 0 ? _f : `${base}refresh:`,
+        refreshTokenFamily: (_g = overrides.refreshTokenFamily) !== null && _g !== void 0 ? _g : `${base}refresh-family:`,
+        consoleEntry: (_h = overrides.consoleEntry) !== null && _h !== void 0 ? _h : `${base}console-entry:`,
+    };
+}
+/**
+ * Crea tutti gli store Redis di un tenant con prefissi gia isolati.
+ *
+ * `applyTo` restituisce una copia delle opzioni con gli store collegati:
+ * `publicAuthRateLimit`, `serviceTokens`, `sessionRevocation`,
+ * `accessTokenRevocation`, `refreshTokenRotation` e `consoleEntry`.
+ */
+function createAccessiTenantStores(options) {
+    var _a;
+    if (!(options === null || options === void 0 ? void 0 : options.tenantId) || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(options.tenantId)) {
+        throw new Error('createAccessiTenantStores: tenantId non valido.');
+    }
+    if (!options.client || typeof options.client.eval !== 'function') {
+        throw new Error('createAccessiTenantStores: client.eval non configurato.');
+    }
+    const encryptionKey = options.encryptionKey;
+    if (encryptionKey === undefined || encryptionKey === null || encryptionKey.length === 0) {
+        throw new Error('createAccessiTenantStores: encryptionKey obbligatoria per i ticket console.');
+    }
+    const prefixes = getAccessiTenantStorePrefixes(options.tenantId, Object.assign(Object.assign({}, (options.prefix ? { base: options.prefix } : {})), ((_a = options.prefixes) !== null && _a !== void 0 ? _a : {})));
+    const { client } = options;
+    const enableRefreshTokenRotation = options.enableRefreshTokenRotation !== false;
+    const rateLimit = (0, rateLimitStore_1.createRedisRateLimitStore)({ client, keyPrefix: prefixes.rateLimit });
+    const serviceTokenRateLimit = (0, rateLimitStore_1.createRedisRateLimitStore)({
+        client,
+        keyPrefix: prefixes.serviceTokenRateLimit,
+    });
+    const sessionRevocation = (0, sessionRevocation_1.createRedisSessionRevocationStore)(Object.assign({ client, keyPrefix: prefixes.sessionRevocation }, (options.sessionRevocationTtlMs !== undefined ? { ttlMs: options.sessionRevocationTtlMs } : {})));
+    const accessTokenRevocation = (0, accessTokenRevocation_1.createRedisAccessTokenRevocationStore)(Object.assign({ client, keyPrefix: prefixes.accessTokenRevocation }, (options.accessTokenRevocationTtlMs !== undefined ? { ttlMs: options.accessTokenRevocationTtlMs } : {})));
+    const refreshTokenRotation = (0, refreshTokenRotation_1.createRedisRefreshTokenRotationStore)({
+        client,
+        keyPrefix: prefixes.refreshTokenRotation,
+        familyKeyPrefix: prefixes.refreshTokenFamily,
+    });
+    const consoleEntry = (0, consoleEntry_1.createRedisConsoleEntryStore)(Object.assign({ client,
+        encryptionKey, keyPrefix: prefixes.consoleEntry }, (options.consoleEntryMaxIssueAttempts !== undefined
+        ? { maxIssueAttempts: options.consoleEntryMaxIssueAttempts }
+        : {})));
+    return {
+        tenantId: options.tenantId,
+        prefixes,
+        rateLimit,
+        serviceTokenRateLimit,
+        sessionRevocation,
+        accessTokenRevocation,
+        refreshTokenRotation,
+        consoleEntry,
+        applyTo(accessiOptions) {
+            var _a, _b;
+            return Object.assign(Object.assign({}, accessiOptions), { tenantId: options.tenantId, publicAuthRateLimit: Object.assign(Object.assign({}, accessiOptions.publicAuthRateLimit), { store: rateLimit }), serviceTokens: Object.assign(Object.assign({}, accessiOptions.serviceTokens), { rateLimitStore: serviceTokenRateLimit }), sessionRevocation: Object.assign(Object.assign({}, accessiOptions.sessionRevocation), { store: sessionRevocation }), accessTokenRevocation: Object.assign(Object.assign({}, accessiOptions.accessTokenRevocation), { store: accessTokenRevocation }), refreshTokenRotation: Object.assign(Object.assign({}, accessiOptions.refreshTokenRotation), { enabled: (_b = (_a = accessiOptions.refreshTokenRotation) === null || _a === void 0 ? void 0 : _a.enabled) !== null && _b !== void 0 ? _b : enableRefreshTokenRotation, store: refreshTokenRotation }), consoleEntry: Object.assign(Object.assign({}, accessiOptions.consoleEntry), { store: consoleEntry }) });
+        },
+    };
+}
+//# sourceMappingURL=tenantStores.js.map

package/dist/accessi/server/tenantStores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantStores.js","sourceRoot":"","sources":["../../../src/accessi/server/tenantStores.ts"],"names":[],"mappings":";;AA6EA,sEAeC;AASD,8DA2FC;AA/LD,uCAAwD;AACxD,iFAAyF;AAEzF,6EAA0F;AAE1F,uFAAoG;AAEpG,+FAA4G;AAE5G,6FAA0G;AA6D1G;;;;;GAKG;AACH,SAAgB,6BAA6B,CAC3C,QAAgB,EAChB,YAAwC,EAAE;;IAE1C,MAAM,IAAI,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,IAAA,qCAA2B,EAAC,QAAQ,CAAC,CAAC;IACrE,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,MAAA,SAAS,CAAC,SAAS,mCAAI,GAAG,IAAI,OAAO;QAChD,qBAAqB,EAAE,MAAA,SAAS,CAAC,qBAAqB,mCAAI,GAAG,IAAI,qBAAqB;QACtF,iBAAiB,EAAE,MAAA,SAAS,CAAC,iBAAiB,mCAAI,GAAG,IAAI,UAAU;QACnE,qBAAqB,EAAE,MAAA,SAAS,CAAC,qBAAqB,mCAAI,GAAG,IAAI,MAAM;QACvE,oBAAoB,EAAE,MAAA,SAAS,CAAC,oBAAoB,mCAAI,GAAG,IAAI,UAAU;QACzE,kBAAkB,EAAE,MAAA,SAAS,CAAC,kBAAkB,mCAAI,GAAG,IAAI,iBAAiB;QAC5E,YAAY,EAAE,MAAA,SAAS,CAAC,YAAY,mCAAI,GAAG,IAAI,gBAAgB;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CACvC,OAAyC;;IAEzC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,QAAQ,kCAC1D,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChD,CAAC,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE,CAAC,EAC3B,CAAC;IACH,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,KAAK,KAAK,CAAC;IAEhF,MAAM,SAAS,GAAG,IAAA,0CAAyB,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACvF,MAAM,qBAAqB,GAAG,IAAA,0CAAyB,EAAC;QACtD,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,IAAA,qDAAiC,kBACzD,MAAM,EACN,SAAS,EAAE,QAAQ,CAAC,iBAAiB,IAClC,CAAC,OAAO,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAClG,CAAC;IACH,MAAM,qBAAqB,GAAG,IAAA,6DAAqC,kBACjE,MAAM,EACN,SAAS,EAAE,QAAQ,CAAC,qBAAqB,IACtC,CAAC,OAAO,CAAC,0BAA0B,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1G,CAAC;IACH,MAAM,oBAAoB,GAAG,IAAA,2DAAoC,EAAC;QAChE,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,oBAAoB;QACxC,eAAe,EAAE,QAAQ,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAA,2CAA4B,kBAC/C,MAAM;QACN,aAAa,EACb,SAAS,EAAE,QAAQ,CAAC,YAAY,IAC7B,CAAC,OAAO,CAAC,4BAA4B,KAAK,SAAS;QACpD,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,4BAA4B,EAAE;QAC5D,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,SAAS;QACT,qBAAqB;QACrB,iBAAiB;QACjB,qBAAqB;QACrB,oBAAoB;QACpB,YAAY;QACZ,OAAO,CAAC,cAAc;;YACpB,uCACK,cAAc,KACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAC1B,mBAAmB,kCACd,cAAc,CAAC,mBAAmB,KACrC,KAAK,EAAE,SAAS,KAElB,aAAa,kCACR,cAAc,CAAC,aAAa,KAC/B,cAAc,EAAE,qBAAqB,KAEvC,iBAAiB,kCACZ,cAAc,CAAC,iBAAiB,KACnC,KAAK,EAAE,iBAAiB,KAE1B,qBAAqB,kCAChB,cAAc,CAAC,qBAAqB,KACvC,KAAK,EAAE,qBAAqB,KAE9B,oBAAoB,kCACf,cAAc,CAAC,oBAAoB,KACtC,OAAO,EAAE,MAAA,MAAA,cAAc,CAAC,oBAAoB,0CAAE,OAAO,mCAAI,0BAA0B,EACnF,KAAK,EAAE,oBAAoB,KAE7B,YAAY,kCACP,cAAc,CAAC,YAAY,KAC9B,KAAK,EAAE,YAAY,OAErB;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AccessiOptions } from '../../accessi-module/AccessiModule';\nimport { getAccessiTenantRedisPrefix } from './tenants';\nimport { createRedisRateLimitStore } from '../../accessi-module/security/rateLimitStore';\nimport type { RateLimitStore } from '../../accessi-module/security/rateLimitStore';\nimport { createRedisConsoleEntryStore } from '../../accessi-module/security/consoleEntry';\nimport type { ConsoleEntryStore } from '../../accessi-module/security/consoleEntry';\nimport { createRedisSessionRevocationStore } from '../../accessi-module/security/sessionRevocation';\nimport type { SessionRevocationStore } from '../../accessi-module/security/sessionRevocation';\nimport { createRedisAccessTokenRevocationStore } from '../../accessi-module/security/accessTokenRevocation';\nimport type { AccessTokenRevocationStore } from '../../accessi-module/security/accessTokenRevocation';\nimport { createRedisRefreshTokenRotationStore } from '../../accessi-module/security/refreshTokenRotation';\nimport type { RefreshTokenRotationStore } from '../../accessi-module/security/refreshTokenRotation';\n\n/** Client Redis minimo accettato dagli store Accessi. */\nexport interface AccessiTenantRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\n/** Prefissi Redis per singolo store, tutti relativi al tenant. */\nexport interface AccessiTenantStorePrefixes {\n  base?: string;\n  rateLimit?: string;\n  serviceTokenRateLimit?: string;\n  sessionRevocation?: string;\n  accessTokenRevocation?: string;\n  refreshTokenRotation?: string;\n  refreshTokenFamily?: string;\n  consoleEntry?: string;\n}\n\nexport interface ResolvedAccessiTenantStorePrefixes {\n  base: string;\n  rateLimit: string;\n  serviceTokenRateLimit: string;\n  sessionRevocation: string;\n  accessTokenRevocation: string;\n  refreshTokenRotation: string;\n  refreshTokenFamily: string;\n  consoleEntry: string;\n}\n\nexport interface CreateAccessiTenantStoresOptions {\n  tenantId: string;\n  client: AccessiTenantRedisClient;\n  /** Segreto per cifrare i ticket console a riposo. Usare un segreto del tenant. */\n  encryptionKey: string | Buffer;\n  /** Base prefix. Default: `accessi:<tenantId>:`. */\n  prefix?: string;\n  prefixes?: AccessiTenantStorePrefixes;\n  /** TTL revoca sessioni. Default dello store (365 giorni). */\n  sessionRevocationTtlMs?: number;\n  /** TTL revoca jti. Default dello store (24 ore). */\n  accessTokenRevocationTtlMs?: number;\n  consoleEntryMaxIssueAttempts?: number;\n  /** Attiva la rotazione refresh token nell'options risultante. Default: true. */\n  enableRefreshTokenRotation?: boolean;\n}\n\nexport interface AccessiTenantStores {\n  tenantId: string;\n  prefixes: ResolvedAccessiTenantStorePrefixes;\n  rateLimit: RateLimitStore;\n  serviceTokenRateLimit: RateLimitStore;\n  sessionRevocation: SessionRevocationStore;\n  accessTokenRevocation: AccessTokenRevocationStore;\n  refreshTokenRotation: RefreshTokenRotationStore;\n  consoleEntry: ConsoleEntryStore;\n  /** Collega tutti gli store alle opzioni Accessi del tenant. */\n  applyTo(options: AccessiOptions): AccessiOptions;\n}\n\n/**\n * Prefissi Redis isolati per tenant.\n *\n * Ogni store ha un namespace distinto: condividere un prefisso tra tenant\n * significherebbe condividere rate limit, revoche o refresh token.\n */\nexport function getAccessiTenantStorePrefixes(\n  tenantId: string,\n  overrides: AccessiTenantStorePrefixes = {},\n): ResolvedAccessiTenantStorePrefixes {\n  const base = overrides.base ?? getAccessiTenantRedisPrefix(tenantId);\n  return {\n    base,\n    rateLimit: overrides.rateLimit ?? `${base}rate:`,\n    serviceTokenRateLimit: overrides.serviceTokenRateLimit ?? `${base}service-token-rate:`,\n    sessionRevocation: overrides.sessionRevocation ?? `${base}session:`,\n    accessTokenRevocation: overrides.accessTokenRevocation ?? `${base}jti:`,\n    refreshTokenRotation: overrides.refreshTokenRotation ?? `${base}refresh:`,\n    refreshTokenFamily: overrides.refreshTokenFamily ?? `${base}refresh-family:`,\n    consoleEntry: overrides.consoleEntry ?? `${base}console-entry:`,\n  };\n}\n\n/**\n * Crea tutti gli store Redis di un tenant con prefissi gia isolati.\n *\n * `applyTo` restituisce una copia delle opzioni con gli store collegati:\n * `publicAuthRateLimit`, `serviceTokens`, `sessionRevocation`,\n * `accessTokenRevocation`, `refreshTokenRotation` e `consoleEntry`.\n */\nexport function createAccessiTenantStores(\n  options: CreateAccessiTenantStoresOptions,\n): AccessiTenantStores {\n  if (!options?.tenantId || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(options.tenantId)) {\n    throw new Error('createAccessiTenantStores: tenantId non valido.');\n  }\n  if (!options.client || typeof options.client.eval !== 'function') {\n    throw new Error('createAccessiTenantStores: client.eval non configurato.');\n  }\n  const encryptionKey = options.encryptionKey;\n  if (encryptionKey === undefined || encryptionKey === null || encryptionKey.length === 0) {\n    throw new Error('createAccessiTenantStores: encryptionKey obbligatoria per i ticket console.');\n  }\n\n  const prefixes = getAccessiTenantStorePrefixes(options.tenantId, {\n    ...(options.prefix ? { base: options.prefix } : {}),\n    ...(options.prefixes ?? {}),\n  });\n  const { client } = options;\n  const enableRefreshTokenRotation = options.enableRefreshTokenRotation !== false;\n\n  const rateLimit = createRedisRateLimitStore({ client, keyPrefix: prefixes.rateLimit });\n  const serviceTokenRateLimit = createRedisRateLimitStore({\n    client,\n    keyPrefix: prefixes.serviceTokenRateLimit,\n  });\n  const sessionRevocation = createRedisSessionRevocationStore({\n    client,\n    keyPrefix: prefixes.sessionRevocation,\n    ...(options.sessionRevocationTtlMs !== undefined ? { ttlMs: options.sessionRevocationTtlMs } : {}),\n  });\n  const accessTokenRevocation = createRedisAccessTokenRevocationStore({\n    client,\n    keyPrefix: prefixes.accessTokenRevocation,\n    ...(options.accessTokenRevocationTtlMs !== undefined ? { ttlMs: options.accessTokenRevocationTtlMs } : {}),\n  });\n  const refreshTokenRotation = createRedisRefreshTokenRotationStore({\n    client,\n    keyPrefix: prefixes.refreshTokenRotation,\n    familyKeyPrefix: prefixes.refreshTokenFamily,\n  });\n  const consoleEntry = createRedisConsoleEntryStore({\n    client,\n    encryptionKey,\n    keyPrefix: prefixes.consoleEntry,\n    ...(options.consoleEntryMaxIssueAttempts !== undefined\n      ? { maxIssueAttempts: options.consoleEntryMaxIssueAttempts }\n      : {}),\n  });\n\n  return {\n    tenantId: options.tenantId,\n    prefixes,\n    rateLimit,\n    serviceTokenRateLimit,\n    sessionRevocation,\n    accessTokenRevocation,\n    refreshTokenRotation,\n    consoleEntry,\n    applyTo(accessiOptions) {\n      return {\n        ...accessiOptions,\n        tenantId: options.tenantId,\n        publicAuthRateLimit: {\n          ...accessiOptions.publicAuthRateLimit,\n          store: rateLimit,\n        },\n        serviceTokens: {\n          ...accessiOptions.serviceTokens,\n          rateLimitStore: serviceTokenRateLimit,\n        },\n        sessionRevocation: {\n          ...accessiOptions.sessionRevocation,\n          store: sessionRevocation,\n        },\n        accessTokenRevocation: {\n          ...accessiOptions.accessTokenRevocation,\n          store: accessTokenRevocation,\n        },\n        refreshTokenRotation: {\n          ...accessiOptions.refreshTokenRotation,\n          enabled: accessiOptions.refreshTokenRotation?.enabled ?? enableRefreshTokenRotation,\n          store: refreshTokenRotation,\n        },\n        consoleEntry: {\n          ...accessiOptions.consoleEntry,\n          store: consoleEntry,\n        },\n      };\n    },\n  };\n}\n"]}

package/dist/accessi/server/tenants.d.ts

@@ -0,0 +1,186 @@
+import type { AccessiOptions, AccessiHttpOptions, AdminBootstrapOptions, CatalogScriptsOptions, ConsoleEntryOptions, EmailOptions, ExtensionFieldsOptions, FederatedAuthenticationOptions, JwtOptions, PublicAuthRateLimitOptions, PublicRegistrationOptions, ServiceTokenOptions, SystemSeedsOptions } from '../../accessi-module/AccessiModule';
+import type { AccessiEdgeRateLimitOptions } from '../../accessi-module/security/edgeRateLimit';
+import type { AccessiAuthCookieOptions } from '../../accessi-module/security/authCookies';
+import type { AccessiMetricsOptions } from '../../accessi-module/observability/metrics';
+import type { AccessiAuditOptions } from '../../accessi-module/security/audit';
+import type { SessionRevocationOptions } from '../../accessi-module/security/sessionRevocation';
+import type { AccessTokenRevocationOptions } from '../../accessi-module/security/accessTokenRevocation';
+import type { RefreshTokenRotationOptions } from '../../accessi-module/security/refreshTokenRotation';
+import type { OpenApiSetupOptions } from '../../openapi/OpenApiConfig';
+/** Identita e routing del tenant. */
+export interface AccessiTenantSettings {
+    /** Minuscole, numeri, `-` e `_`; max 63 caratteri. */
+    id: string;
+    /** Host esatti o wildcard `*.example.com`. */
+    hosts?: string[];
+    /** Prefisso path, es. `/acme`. */
+    path?: string;
+    /** Porta del processo quando si usa il supervisore. */
+    port?: number;
+    /** Default `true`. */
+    enabled?: boolean;
+    description?: string;
+}
+/** Connessione Firebird del tenant, tipizzata senza callback. */
+export interface AccessiTenantDatabaseOptions {
+    host: string;
+    port?: number;
+    database: string;
+    user?: string;
+    password?: string;
+    /** `disabled`/`optional`; `required` e il default del driver. */
+    wireCrypt?: 'required' | 'optional' | 'disabled';
+    pluginName?: string;
+}
+/**
+ * Configurazione serializzabile di un tenant.
+ *
+ * I campi che contengono store, callback o logger (`store`, `sink`, `match`,
+ * `onDocument`, `logger`, ...) sono esclusi: vanno collegati dal backend
+ * ospitante, non da un file di configurazione.
+ */
+export interface AccessiTenantEnvironment {
+    tenant: AccessiTenantSettings;
+    database: AccessiTenantDatabaseOptions;
+    jwt: JwtOptions;
+    email: EmailOptions;
+    encryptionKey: string;
+    confirmationEmailUrl: string;
+    confirmationEmailReturnUrl: string;
+    confirmationEmailPrefix?: string;
+    customResetPage?: string;
+    publicBaseUrl?: string;
+    consoleApiBaseUrl?: string;
+    mockDemoUser?: boolean;
+    passwordExpiration?: boolean;
+    passwordExpirationDays?: number;
+    legacyPasswordMigrationOnStartup?: boolean;
+    autoUpdateDatabase?: boolean;
+    http?: AccessiHttpOptions;
+    authCookie?: AccessiAuthCookieOptions;
+    publicAuthRateLimit?: Omit<PublicAuthRateLimitOptions, 'store'>;
+    publicRegistration?: PublicRegistrationOptions;
+    federatedAuthentication?: FederatedAuthenticationOptions;
+    extensionFieldsOptions?: ExtensionFieldsOptions[];
+    serviceTokens?: Omit<ServiceTokenOptions, 'rateLimitStore'>;
+    catalogScripts?: CatalogScriptsOptions;
+    systemSeeds?: SystemSeedsOptions;
+    adminBootstrap?: AdminBootstrapOptions;
+    openapi?: Omit<OpenApiSetupOptions, 'onDocument'>;
+    consoleEntry?: Omit<ConsoleEntryOptions, 'store'>;
+    edgeRateLimit?: Omit<AccessiEdgeRateLimitOptions, 'store' | 'match'>;
+    sessionRevocation?: Omit<SessionRevocationOptions, 'store'>;
+    accessTokenRevocation?: Omit<AccessTokenRevocationOptions, 'store'>;
+    refreshTokenRotation?: Omit<RefreshTokenRotationOptions, 'store'>;
+    metrics?: Omit<AccessiMetricsOptions, 'sink'>;
+    audit?: Omit<AccessiAuditOptions, 'sinks' | 'store' | 'tenantId'>;
+    bufferLogs?: boolean;
+}
+export interface AccessiTenant {
+    id: string;
+    hosts: string[];
+    path?: string;
+    enabled: boolean;
+    description?: string;
+    port?: number;
+    /** Nome del file `*.environment.ts` di origine (mai il contenuto). */
+    file: string;
+    environmentFile: string;
+    options: AccessiOptions;
+}
+export interface AccessiTenantSummary {
+    id: string;
+    hosts: string[];
+    path?: string;
+    enabled: boolean;
+    description?: string;
+    port?: number;
+    file: string;
+    database: {
+        host?: string;
+        port?: number;
+        database?: string;
+        user?: string;
+    };
+    issuer?: string;
+    audience?: string;
+    jwtAlgorithm: string;
+    refreshEnabled: boolean;
+}
+export interface AccessiTenantResolution {
+    tenant: AccessiTenant;
+    matchedBy: 'host' | 'path' | 'header';
+}
+export interface AccessiTenantRegistry {
+    directory: string;
+    tenants: AccessiTenant[];
+    warnings: string[];
+    allowHeader: boolean;
+    byId: ReadonlyMap<string, AccessiTenant>;
+    resolve(input: {
+        host?: string;
+        path?: string;
+        header?: string;
+    }, options?: {
+        allowHeader?: boolean;
+    }): AccessiTenantResolution | undefined;
+    summary(): AccessiTenantSummary[];
+}
+export interface LoadAccessiTenantsOptions {
+    /** Cartella con `<id>.environment.ts`. */
+    directory: string;
+    /** Abilita la risoluzione via header `x-accessi-tenant`. Default: false. */
+    allowHeader?: boolean;
+    /** Consente issuer/audience uguali tra tenant (sconsigliato). Default: false. */
+    allowSharedIssuer?: boolean;
+}
+/** Errore aggregato di configurazione tenant. */
+export declare class AccessiTenantConfigurationError extends Error {
+    readonly issues: string[];
+    constructor(issues: string[]);
+}
+/**
+ * Helper di tipizzazione per i file tenant.
+ *
+ * ```ts
+ * import type { AccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';
+ * import { defineAccessiTenantEnvironment } from 'emilsoftware-utilities/accessi/server';
+ *
+ * export default defineAccessiTenantEnvironment({
+ *   tenant: { id: 'acme', hosts: ['accessi.acme.example.com'] },
+ *   database: { host: 'db-acme', database: '/data/acme.fdb' },
+ *   jwt: { secret: process.env.ACME_JWT_SECRET!, expiresIn: '1h' },
+ *   email: { ... },
+ *   encryptionKey: process.env.ACME_ENCRYPTION_KEY!,
+ *   confirmationEmailUrl: 'https://accessi.acme.example.com',
+ *   confirmationEmailReturnUrl: 'https://accessi.acme.example.com',
+ * });
+ * ```
+ */
+export declare function defineAccessiTenantEnvironment<const T extends AccessiTenantEnvironment>(environment: T): T;
+/** Prefisso Redis consigliato per isolare gli store del tenant. */
+export declare function getAccessiTenantRedisPrefix(tenantId: string): string;
+/**
+ * Converte la configurazione tipizzata in `AccessiOptions`.
+ *
+ * Applica i default di Firebird e collega `tenantId`; non crea store o sink,
+ * che restano responsabilita del backend ospitante.
+ */
+export declare function accessiOptionsFromTenantEnvironment(environment: AccessiTenantEnvironment): AccessiOptions;
+/**
+ * Carica un singolo file `*.environment.ts`.
+ *
+ * Usa jiti per eseguire TypeScript anche nel pacchetto compilato, senza
+ * richiedere un passo di build separato per i file tenant.
+ */
+export declare function loadAccessiTenantEnvironmentFile(file: string): {
+    tenant: AccessiTenant;
+    environment: AccessiTenantEnvironment;
+};
+/**
+ * Carica i tenant da una cartella di file `<id>.environment.ts`.
+ *
+ * La validazione e aggregata: un errore blocca l'intera cartella, cosi non si
+ * avvia un tenant con configurazione parziale. Nessun segreto viene stampato.
+ */
+export declare function loadAccessiTenants(options: LoadAccessiTenantsOptions): AccessiTenantRegistry;