emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.81

package/dist/accessi-module/Controllers/AuthController.js

@@ -1,43 +1,10 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
@@ -57,27 +24,51 @@ var AuthController_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthController = void 0;
 const common_1 = require("@nestjs/common");
+const TwoFactorDtos_1 = require("../Dtos/TwoFactorDtos");
 const swagger_1 = require("@nestjs/swagger");
-const jwt = __importStar(require("jsonwebtoken"));
+const crypto_1 = require("crypto");
+const Logger_1 = require("../../Logger");
 const Utilities_1 = require("../../Utilities");
-const AuthService_1 = require("../Services/AuthService/AuthService");
 const Dtos_1 = require("../Dtos");
-const Logger_1 = require("../../Logger");
+const AuthService_1 = require("../Services/AuthService/AuthService");
+const AdminBootstrapService_1 = require("../Services/AdminBootstrapService/AdminBootstrapService");
+const jwt_strategy_1 = require("../jwt/jwt.strategy");
+const accessControl_1 = require("../security/accessControl");
+const authenticatedToken_1 = require("../security/authenticatedToken");
+const authCookies_1 = require("../security/authCookies");
+const metrics_1 = require("../observability/metrics");
+const sessionRevocation_1 = require("../security/sessionRevocation");
+const accessTokenRevocation_1 = require("../security/accessTokenRevocation");
+const audit_1 = require("../security/audit");
 const publicAuthRateLimit_1 = require("../security/publicAuthRateLimit");
+/** Estrae il codice stabile di un errore Nest `{ code, message }`. */
+function authErrorCode(error) {
+    if (!error || typeof error !== 'object')
+        return undefined;
+    const response = typeof error.getResponse === 'function'
+        ? error.getResponse()
+        : error.response;
+    if (response && typeof response === 'object') {
+        const code = response.code;
+        return typeof code === 'string' ? code : undefined;
+    }
+    return undefined;
+}
 let AuthController = AuthController_1 = class AuthController {
-    constructor(authService, options) {
+    constructor(authService, adminBootstrapService, options) {
         this.authService = authService;
+        this.adminBootstrapService = adminBootstrapService;
         this.options = options;
         this.logger = new Logger_1.Logger(AuthController_1.name);
     }
-    resetPassword(request, res, token, newPassword) {
+    resetPassword(request, res, token, body) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const rateLimitDecision = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'passwordResetConfirm', request);
+                const rateLimitDecision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'passwordResetConfirm', request);
                 if (!rateLimitDecision.allowed) {
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
                 }
-                yield this.authService.confirmResetPassword(token, newPassword);
+                yield this.authService.confirmResetPassword(token, body.newPassword);
                 return Utilities_1.RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');
             }
             catch (error) {
@@ -85,92 +76,375 @@ let AuthController = AuthController_1 = class AuthController {
             }
         });
     }
-    getUserByToken(request, token, res) {
+    getUserByToken(request, body, res) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const rateLimitDecision = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'getUserByToken', request);
+                const rateLimitDecision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'getUserByToken', request);
                 if (!rateLimitDecision.allowed) {
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
                 }
-                if (!token) {
+                const requestToken = typeof (body === null || body === void 0 ? void 0 : body.token) === 'string' && body.token.trim() !== ''
+                    ? body.token
+                    : (0, authenticatedToken_1.extractAccessiBearerToken)(request.headers.authorization);
+                if (!requestToken) {
                     return Utilities_1.RestUtilities.sendErrorMessage(res, 'Token non fornito', AuthController_1.name, common_1.HttpStatus.BAD_REQUEST);
                 }
-                const authenticatedPayload = yield this.authService.getAuthenticatedTokenPayload(token);
-                return Utilities_1.RestUtilities.sendBaseResponse(res, { userData: authenticatedPayload });
+                const authenticatedPayload = yield this.authService.getAuthenticatedTokenPayload(requestToken);
+                const userData = authenticatedPayload === null || authenticatedPayload === void 0 ? void 0 : authenticatedPayload.utente;
+                if (!userData) {
+                    throw new Error('Il token non contiene un utente Accessi valido.');
+                }
+                // Keep the runtime response aligned with GetUserByTokenResponse and Orval:
+                // Result.userData contains the authenticated user directly, not a nested JWT payload.
+                return Utilities_1.RestUtilities.sendBaseResponse(res, { userData });
             }
             catch (error) {
                 return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, common_1.HttpStatus.UNAUTHORIZED);
             }
         });
     }
+    revokeSessions(request, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const user = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                if (!(0, sessionRevocation_1.getSessionRevocationStore)(this.options)) {
+                    throw new common_1.HttpException({
+                        code: 'ACCESSI_SESSION_REVOCATION_DISABLED',
+                        message: 'La revoca sessioni non e configurata su questa istanza.',
+                    }, common_1.HttpStatus.NOT_IMPLEMENTED);
+                }
+                yield (0, sessionRevocation_1.revokeAccessiUserSessions)(this.options, user.codiceUtente);
+                const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
+                if (cookieConfig)
+                    (0, authCookies_1.clearAccessiAuthCookies)(res, cookieConfig);
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Sessioni revocate con successo.');
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.BAD_REQUEST);
+            }
+        });
+    }
+    revokeToken(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const user = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                if (!(0, accessTokenRevocation_1.getAccessTokenRevocationStore)(this.options)) {
+                    throw new common_1.HttpException({
+                        code: 'ACCESSI_ACCESS_TOKEN_REVOCATION_DISABLED',
+                        message: 'La revoca dei singoli token non e configurata su questa istanza.',
+                    }, common_1.HttpStatus.NOT_IMPLEMENTED);
+                }
+                const payload = ((_a = request.user) !== null && _a !== void 0 ? _a : {});
+                const currentJti = typeof payload.jti === 'string' ? payload.jti : undefined;
+                const requestedJti = typeof (body === null || body === void 0 ? void 0 : body.jti) === 'string' ? body.jti.trim() : '';
+                const targetJti = requestedJti !== '' ? requestedJti : currentJti;
+                if (!targetJti) {
+                    throw new common_1.HttpException({ code: 'ACCESSI_TOKEN_JTI_MISSING', message: 'Il token non contiene un jti revocabile.' }, common_1.HttpStatus.BAD_REQUEST);
+                }
+                const isCurrentToken = targetJti === currentJti;
+                if (!isCurrentToken && !user.flagAdmin && !user.flagSuper) {
+                    throw new common_1.HttpException({
+                        code: 'ACCESSI_TOKEN_REVOKE_FORBIDDEN',
+                        message: 'Solo gli amministratori possono revocare il token di un altro utente.',
+                    }, common_1.HttpStatus.FORBIDDEN);
+                }
+                const expiresAt = Number(payload.exp);
+                yield (0, accessTokenRevocation_1.revokeAccessiAccessToken)(this.options, targetJti, isCurrentToken && Number.isFinite(expiresAt) ? expiresAt * 1000 : undefined);
+                (0, audit_1.auditAccessi)('access_token_revoked', {
+                    codiceUtente: user.codiceUtente,
+                    actor: user.codiceUtente,
+                    jti: targetJti,
+                    self: isCurrentToken,
+                });
+                if (isCurrentToken) {
+                    const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
+                    if (cookieConfig)
+                        (0, authCookies_1.clearAccessiAuthCookies)(res, cookieConfig);
+                }
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Token revocato con successo.');
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.BAD_REQUEST);
+            }
+        });
+    }
     login(request, loginRequest, res) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const startedAt = Date.now();
             try {
-                const rateLimitDecision = (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'login', request, [loginRequest === null || loginRequest === void 0 ? void 0 : loginRequest.email]);
+                const rateLimitDecision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'login', request, [loginRequest === null || loginRequest === void 0 ? void 0 : loginRequest.email]);
                 if (!rateLimitDecision.allowed) {
+                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result: 'rate_limited' });
                     return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
                 }
                 const userData = yield this.authService.login(loginRequest);
                 if (!userData) {
+                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result: 'failure' });
+                    (0, audit_1.auditAccessi)('login_failed', { result: 'failure', ip: request.ip, emailProvided: Boolean(loginRequest === null || loginRequest === void 0 ? void 0 : loginRequest.email) });
                     return Utilities_1.RestUtilities.sendInvalidCredentials(res);
                 }
-                // Generazione del token JWT
-                const tokenData = {
-                    utente: userData === null || userData === void 0 ? void 0 : userData.utente,
-                };
-                userData.token = {
-                    expiresIn: this.options.jwtOptions.expiresIn,
-                    value: jwt.sign(tokenData, this.options.jwtOptions.secret, {
-                        expiresIn: this.options.jwtOptions.expiresIn,
-                    }),
-                    type: 'Bearer',
-                };
+                if (!userData.challenge && !userData.passwordRequired) {
+                    const tokens = this.authService.createTokenPair(userData.utente, ['password']);
+                    userData.token = tokens.access;
+                    if (tokens.refresh)
+                        userData.refreshToken = tokens.refresh;
+                    (0, authCookies_1.applyAccessiAuthCookies)(res, (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options), userData);
+                }
+                const result = userData.challenge
+                    ? 'challenge'
+                    : userData.passwordRequired
+                        ? 'password_required'
+                        : 'success';
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result });
+                if (result === 'success') {
+                    (0, audit_1.auditAccessi)('login_succeeded', {
+                        codiceUtente: (_a = userData.utente) === null || _a === void 0 ? void 0 : _a.codiceUtente,
+                        ip: request.ip,
+                    });
+                }
                 return Utilities_1.RestUtilities.sendBaseResponse(res, userData);
             }
             catch (error) {
-                if (error.message === 'PASSWORD_EXPIRED') {
+                const message = error === null || error === void 0 ? void 0 : error.message;
+                const result = message === 'PASSWORD_EXPIRED'
+                    ? 'password_expired'
+                    : message === AuthService_1.PASSWORD_LOGIN_DISABLED
+                        ? 'sso_only'
+                        : 'error';
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result });
+                (0, audit_1.auditAccessi)('login_failed', { result, ip: request.ip, emailProvided: Boolean(loginRequest === null || loginRequest === void 0 ? void 0 : loginRequest.email) });
+                if (message === 'PASSWORD_EXPIRED') {
                     this.logger.warning('Password scaduta, cambiare password ', error);
                     return Utilities_1.RestUtilities.sendPasswordExpired(res);
                 }
+                if (error instanceof common_1.HttpException) {
+                    return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error.getStatus());
+                }
+                if ((error === null || error === void 0 ? void 0 : error.message) === AuthService_1.PASSWORD_LOGIN_DISABLED) {
+                    return res.status(common_1.HttpStatus.FORBIDDEN).json({
+                        severity: 'error', status: common_1.HttpStatus.FORBIDDEN, statusCode: 2,
+                        code: AuthService_1.PASSWORD_LOGIN_DISABLED,
+                        error: AuthService_1.PASSWORD_LOGIN_DISABLED,
+                        message: 'Questo utente e abilitato solo tramite SSO. Accedi con un provider collegato.',
+                    });
+                }
                 this.logger.error('Errore durante il login', error);
+                if (Utilities_1.RestUtilities.isDatabaseSchemaError(error)) {
+                    return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+                }
                 return Utilities_1.RestUtilities.sendInvalidCredentials(res);
             }
+            finally {
+                (0, metrics_1.observeAccessiMetric)(this.options, 'auth_login_duration_ms', Date.now() - startedAt);
+            }
+        });
+    }
+    refresh(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const startedAt = Date.now();
+            try {
+                const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
+                const cookieRefreshToken = (cookieConfig === null || cookieConfig === void 0 ? void 0 : cookieConfig.refreshFromCookie)
+                    ? (0, authCookies_1.getAccessiRefreshTokenFromCookie)(request.headers.cookie, cookieConfig)
+                    : undefined;
+                const refreshToken = typeof (body === null || body === void 0 ? void 0 : body.refreshToken) === 'string' && body.refreshToken.trim() !== ''
+                    ? body.refreshToken
+                    : cookieRefreshToken;
+                const tokenKey = typeof refreshToken === 'string'
+                    ? (0, crypto_1.createHash)('sha256').update(refreshToken).digest('hex').slice(0, 32)
+                    : undefined;
+                const decision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'refresh', request, tokenKey ? [tokenKey] : []);
+                if (!decision.allowed) {
+                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_refresh_total', { result: 'rate_limited' });
+                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, decision.retryAfterSeconds);
+                }
+                if (!refreshToken) {
+                    throw new common_1.HttpException('Refresh token mancante.', common_1.HttpStatus.UNAUTHORIZED);
+                }
+                const result = yield this.authService.refreshAccessToken(refreshToken);
+                if (!result.token) {
+                    throw new common_1.HttpException('Refresh token non valido.', common_1.HttpStatus.UNAUTHORIZED);
+                }
+                const response = Object.assign({ token: result.token }, (result.refreshToken ? { refreshToken: result.refreshToken } : {}));
+                (0, authCookies_1.applyAccessiAuthCookies)(res, cookieConfig, response);
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_refresh_total', { result: 'success' });
+                (0, audit_1.auditAccessi)('refresh_succeeded', { ip: request.ip });
+                return Utilities_1.RestUtilities.sendBaseResponse(res, response);
+            }
+            catch (error) {
+                const code = authErrorCode(error);
+                const result = code === 'ACCESSI_REFRESH_TOKEN_REUSE'
+                    ? 'reuse'
+                    : code === 'ACCESSI_REFRESH_FAMILY_REVOKED'
+                        ? 'family_revoked'
+                        : code === 'ACCESSI_REFRESH_ROTATION_UNAVAILABLE'
+                            ? 'store_unavailable'
+                            : 'invalid';
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_refresh_total', { result });
+                if (result !== 'reuse')
+                    (0, audit_1.auditAccessi)('refresh_failed', { result, ip: request.ip });
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.UNAUTHORIZED);
+            }
+            finally {
+                (0, metrics_1.observeAccessiMetric)(this.options, 'auth_refresh_duration_ms', Date.now() - startedAt);
+            }
+        });
+    }
+    verifyTwoFactor(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const startedAt = Date.now();
+            try {
+                const limit = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'twoFactorVerify', request, [body.challengeId]);
+                if (!limit.allowed) {
+                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'verify', result: 'rate_limited' });
+                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
+                }
+                const result = yield this.authService.verifyTwoFactor(body.challengeId, body.code, body.scope);
+                (0, authCookies_1.applyAccessiAuthCookies)(res, (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options), result);
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'verify', result: 'success' });
+                (0, audit_1.auditAccessi)('two_factor_succeeded', { codiceUtente: (_a = result.utente) === null || _a === void 0 ? void 0 : _a.codiceUtente, ip: request.ip });
+                return Utilities_1.RestUtilities.sendBaseResponse(res, result);
+            }
+            catch (error) {
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'verify', result: 'failure' });
+                (0, audit_1.auditAccessi)('two_factor_failed', { ip: request.ip });
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
+            }
+            finally {
+                (0, metrics_1.observeAccessiMetric)(this.options, 'auth_two_factor_duration_ms', Date.now() - startedAt, { action: 'verify' });
+            }
+        });
+    }
+    resendTwoFactor(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const limit = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'twoFactorResend', request, [body.challengeId]);
+                if (!limit.allowed) {
+                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'resend', result: 'rate_limited' });
+                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
+                }
+                const result = yield this.authService.resendTwoFactor(body.challengeId);
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'resend', result: 'success' });
+                return Utilities_1.RestUtilities.sendBaseResponse(res, result);
+            }
+            catch (error) {
+                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'resend', result: 'failure' });
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
+            }
+        });
+    }
+    bootstrapAdmin(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const limit = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'adminBootstrap', request);
+                if (!limit.allowed)
+                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.adminBootstrapService.bootstrap(body));
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
+            }
+        });
+    }
+    adminBootstrapStatus(res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return Utilities_1.RestUtilities.sendBaseResponse(res, { enabled: this.adminBootstrapService.isEnabled() });
         });
     }
 };
 exports.AuthController = AuthController;
 __decorate([
-    (0, swagger_1.ApiOperation)({ summary: 'Conferma il reset della password', operationId: "resetPassword" }),
+    (0, swagger_1.ApiOperation)({ summary: 'Conferma il reset della password', operationId: 'resetPassword' }),
     (0, swagger_1.ApiParam)({ name: 'token', description: 'Token per il reset della password', required: true }),
-    (0, swagger_1.ApiBody)({ schema: { properties: { newPassword: { type: 'string', description: 'Nuova password da impostare' } } } }),
-    (0, swagger_1.ApiResponse)({ status: 200, description: 'Password aggiornata con successo' }),
-    (0, swagger_1.ApiResponse)({ status: 400, description: 'Errore nella richiesta o token non valido' }),
+    (0, swagger_1.ApiBody)({ type: Dtos_1.ConfirmResetPasswordRequest }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Password aggiornata con successo',
+        type: Dtos_1.ActionResponse,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 400,
+        description: 'Errore nella richiesta o token non valido',
+        type: Dtos_1.ErrorResponse,
+    }),
     (0, common_1.Post)('confirm-reset-password/:token'),
     __param(0, (0, common_1.Req)()),
     __param(1, (0, common_1.Res)()),
     __param(2, (0, common_1.Param)('token')),
-    __param(3, (0, common_1.Body)("newPassword")),
+    __param(3, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Object, String, String]),
+    __metadata("design:paramtypes", [Object, Object, String, Dtos_1.ConfirmResetPasswordRequest]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "resetPassword", null);
 __decorate([
-    (0, swagger_1.ApiOperation)({ summary: 'Recupera le informazioni utente dal token JWT', operationId: "getUserByToken" }),
-    (0, swagger_1.ApiBody)({ schema: { properties: { token: { type: 'string', description: 'JWT dell\'utente' } } } }),
-    (0, swagger_1.ApiResponse)({ status: 200, description: 'Informazioni utente recuperate con successo' }),
-    (0, swagger_1.ApiResponse)({ status: 401, description: 'Token non valido o scaduto' }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Recupera le informazioni utente dal token JWT',
+        operationId: 'getUserByToken',
+    }),
+    (0, swagger_1.ApiBody)({ type: Dtos_1.GetUserByTokenRequest }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Informazioni utente recuperate con successo',
+        type: Dtos_1.GetUserByTokenResponse,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Token non valido o scaduto',
+        type: Dtos_1.ErrorResponse,
+    }),
     (0, common_1.Post)('get-user-by-token'),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Body)('token')),
+    __param(1, (0, common_1.Body)()),
     __param(2, (0, common_1.Res)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:paramtypes", [Object, Dtos_1.GetUserByTokenRequest, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "getUserByToken", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Revoca tutte le sessioni dell utente corrente',
+        operationId: 'revokeSessions',
+        description: 'Invalida i token emessi prima di questa chiamata. Richiede sessionRevocation.store configurato. I token emessi dopo la revoca restano validi.',
+    }),
+    (0, swagger_1.ApiOkResponse)({ type: Dtos_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse, description: 'Token Accessi mancante o non valido.' }),
+    (0, swagger_1.ApiResponse)({ status: 501, type: Dtos_1.ErrorResponse, description: 'Revoca sessioni non configurata.' }),
+    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard),
+    (0, common_1.Post)('revoke-sessions'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "revokeSessions", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Revoca un singolo access token tramite jti',
+        operationId: 'revokeToken',
+        description: 'Annulla un solo token (logout del dispositivo corrente o token compromesso) senza toccare le altre sessioni. ' +
+            'Se il body non contiene jti viene revocato il token della richiesta. Richiede accessTokenRevocation.store configurato.',
+    }),
+    (0, swagger_1.ApiBody)({ type: Dtos_1.RevokeTokenRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: Dtos_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse, description: 'Token Accessi mancante o non valido.' }),
+    (0, swagger_1.ApiResponse)({ status: 403, type: Dtos_1.ErrorResponse, description: 'Non autorizzato a revocare il token indicato.' }),
+    (0, swagger_1.ApiResponse)({ status: 501, type: Dtos_1.ErrorResponse, description: 'Revoca token non configurata.' }),
+    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard),
+    (0, common_1.Post)('revoke-token'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Dtos_1.RevokeTokenRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "revokeToken", null);
 __decorate([
     (0, swagger_1.ApiOperation)({
         summary: 'Effettua il login utente',
-        description: 'Autentica l\'utente con email e password. Restituisce un token JWT e i dati dell\'utente se le credenziali sono corrette.',
+        description: "Con sola email restituisce passwordRequired oppure avvia il codice per utenti passwordless. Con password valida restituisce il login completo o challenge se la 2FA e attiva. Nessun JWT viene emesso prima della verifica del codice.",
         operationId: 'login',
     }),
     (0, swagger_1.ApiBody)({ type: Dtos_1.LoginRequest }),
@@ -182,21 +456,14 @@ __decorate([
     (0, swagger_1.ApiResponse)({
         status: 401,
         description: 'Credenziali non valide',
+        type: Dtos_1.ErrorResponse,
     }),
     (0, swagger_1.ApiResponse)({
         status: 403,
-        description: "Password scaduta, è necessatio aggiornarla. ",
-        schema: {
-            example: {
-                message: {
-                    severity: 'warning',
-                    statusCode: 2, // o il valore di StatusCode.Warning
-                    code: 'PASSWORD_EXPIRED',
-                    message: 'Password scaduta. È necessario aggiornarla.',
-                }
-            }
-        }
+        description: 'Password scaduta, e necessario aggiornarla.',
+        type: Dtos_1.PasswordExpiredResponse,
     }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: 'Utente abilitato solo a SSO.', type: Dtos_1.ErrorResponse }),
     (0, common_1.Post)('login'),
     __param(0, (0, common_1.Req)()),
     __param(1, (0, common_1.Body)()),
@@ -205,10 +472,93 @@ __decorate([
     __metadata("design:paramtypes", [Object, Dtos_1.LoginRequest, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "login", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Scambia un refresh token con un nuovo access token',
+        operationId: 'refreshAccessToken',
+        description: 'Richiede jwtOptions.refreshExpiresIn. Il refresh token ha typ=refresh e non e accettato dai guard API.',
+    }),
+    (0, swagger_1.ApiBody)({ type: Dtos_1.RefreshTokenRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: Dtos_1.RefreshTokenResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, description: 'Refresh token non valido, scaduto o revocato.', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 429, description: 'Troppi tentativi.', type: Dtos_1.ErrorResponse }),
+    (0, common_1.Post)('refresh'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Dtos_1.RefreshTokenRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "refresh", null);
+__decorate([
+    (0, common_1.Post)('two-factor/verify'),
+    (0, swagger_1.ApiOperation)({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' }),
+    (0, swagger_1.ApiBody)({ type: TwoFactorDtos_1.VerifyTwoFactorRequest }),
+    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.LoginResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 429, type: Dtos_1.ErrorResponse }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, TwoFactorDtos_1.VerifyTwoFactorRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "verifyTwoFactor", null);
+__decorate([
+    (0, common_1.Post)('two-factor/resend'),
+    (0, swagger_1.ApiOperation)({ summary: 'Reinvia il codice, invalidando il precedente', operationId: 'resendTwoFactor' }),
+    (0, swagger_1.ApiBody)({ type: TwoFactorDtos_1.ResendTwoFactorRequest }),
+    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.LoginResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 429, type: Dtos_1.ErrorResponse }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, TwoFactorDtos_1.ResendTwoFactorRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "resendTwoFactor", null);
+__decorate([
+    (0, common_1.Post)('bootstrap-admin'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Crea il primo utente admin (bootstrap)',
+        operationId: 'bootstrapAdmin',
+        description: 'Endpoint pubblico ma protetto dal token di avvio: attivo solo con adminBootstrap.enabled. ' +
+            'Crea un utente in stato confermato senza email, con flag admin (e super opzionale) e password fornita o generata.',
+    }),
+    (0, swagger_1.ApiBody)({ type: Dtos_1.BootstrapAdminRequest }),
+    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.BootstrapAdminResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, description: 'Token di bootstrap non valido', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: 'Bootstrap admin non abilitato', type: Dtos_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 429, description: 'Troppi tentativi', type: Dtos_1.ErrorResponse }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Dtos_1.BootstrapAdminRequest, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "bootstrapAdmin", null);
+__decorate([
+    (0, common_1.Get)('bootstrap-admin/status'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Indica se il bootstrap admin e abilitato',
+        operationId: 'getAdminBootstrapStatus',
+        description: 'Endpoint pubblico: la console mostra la sezione "Crea utente admin" solo quando enabled e true.',
+    }),
+    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.AdminBootstrapStatusResponse }),
+    __param(0, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "adminBootstrapStatus", null);
 exports.AuthController = AuthController = AuthController_1 = __decorate([
     (0, swagger_1.ApiTags)('Auth'),
-    (0, common_1.Controller)('accessi/auth'),
-    __param(1, (0, common_1.Inject)('ACCESSI_OPTIONS')),
-    __metadata("design:paramtypes", [AuthService_1.AuthService, Object])
+    (0, common_1.Controller)('accessi/auth') /**
+     * Endpoint pubblici di autenticazione locale e verifica sessione.
+     * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.
+     */,
+    __param(2, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [AuthService_1.AuthService,
+        AdminBootstrapService_1.AdminBootstrapService, Object])
 ], AuthController);
 //# sourceMappingURL=AuthController.js.map