emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.81

package/dist/accessi-module/federated-auth/FederatedAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedAuthService.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4M;AAC5M,mCAAoC;AACpC,uFAAoF;AACpF,mCAAgC;AAChC,+CAAgD;AAGhD,mEAAgE;AAChE,qEAAkE;AAClE,qEAAkE;AAClE,uEAAkF;AAClF,qEAAsF;AAwBtF;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAC8C,OAAuB,EAClD,WAAwB,EACxB,WAAwB;QAFG,YAAO,GAAP,OAAO,CAAgB;QAClD,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,+FAA+F;IACzF,YAAY;;YAChB,MAAM,+CAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;KAAA;IAED,wFAAwF;IACxF,SAAS;;QACP,OAAO,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI,CAAC;IAChE,CAAC;IAED;;;OAGG;IACG,YAAY,CAAC,QAAmC;;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEjE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YACzI,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACrG,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC9G,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,cAAc,CAAC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;gBACtH,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;YAC9D,CAAC;YAED,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,kFAAkF,EAClF,CAAC,cAAc,CAAC,WAAW,CAAC,CAC7B,CAAC;YACF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,qEAAqE,EACrE,CAAC,cAAc,CAAC,YAAY,CAAC,CAC9B,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACxF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,KAAK,UAAU;gBACnE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;gBAC/D,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACrG,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5B,IAAI,MAAM,CAAC,OAAO;gBAAE,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;YACxD,OAAO;gBACL,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC;QACJ,CAAC;KAAA;IAED,4GAA4G;IACtG,YAAY,CAAC,YAAoB,EAAE,QAAmC,EAAE,IAAa;;;YACzF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAE5D,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;YAC3I,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,MAAA,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,IAAI,mCAAI,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,CACtD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;mCAC2B,EAC3B,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,IAAI,CAAC,CACvG,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAE,CAAC;QACvD,CAAC;KAAA;IAED,0GAA0G;IACpG,0BAA0B;6DAC9B,gBAAiC,EACjC,QAAmC,EACnC,oBAAoB,GAAG,KAAK,EAC5B,IAAa;YAEb,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YAC7I,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,IAAI;oBAC3B,YAAY,EAAE,uCAAkB,CAAC,IAAI;iBACtC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;gBACvE,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,4BAAmB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,2BAAkB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,oCAA2B,EAAE,CAAC;oBAC5M,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,+FAA+F,EAAE,CAAC,CAAC;gBAChM,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,oIAAoI,EAAE,CAAC,CAAC;YACxO,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,gCAAgC,CACpC,gBAAiC,EACjC,QAAmC;;;YAEnC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,qBAAqB,MAAK,IAAI,EAAE,CAAC;gBACzE,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnI,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;gBACrE,qBAAqB,EAAE,KAAK;gBAC5B,YAAY,EAAE,uCAAkB,CAAC,IAAI;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;KAAA;IAED,0FAA0F;IACpF,iBAAiB,CAAC,YAAoB;;YAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;;8BAOwB,EACxB,CAAC,YAAY,CAAC,CACf,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,yGAAyG;IACnG,YAAY;;YAChB,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;sDAGgD,CACjD,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,wFAAwF;IAClF,cAAc,CAAC,KAA+D;;;YAClF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,uFAAuF,EACvF,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,IAAI,EAAE,KAAI,IAAI,CAAC,CACpD,CAAC;YACF,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED,gGAAgG;IAChG;;;OAGG;IACG,cAAc,CAAC,aAAqB,EAAE,MAAiE;;YAC3G,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC9H,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED;;;;OAIG;IACG,cAAc,CAAC,aAAqB;;;YACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,SAAG,CAAC,KAAK,CAC3B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,sEAAsE,EACtE,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,QAAQ,GAAG,MAAA,MAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAyC,0CAAE,KAAK,mCACtE,MAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAyC,0CAAE,KAAK,CAAC;YAChE,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC;oBAC1B,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,qCAAqC,QAAQ,KAAK,KAAK,wEAAwE;iBACzI,CAAC,CAAC;YACL,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,6CAA6C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7G,CAAC;KAAA;IAED,0EAA0E;IAC1E;;;OAGG;IACG,uBAAuB,CAAC,YAAoB,EAAE,OAAgB;;YAClE,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;YACjE,2EAA2E;YAC3E,iFAAiF;YACjF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAChC,CAAC;YACF,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAA,yDAAqC,EAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;KAAA;IAED,mHAAmH;IACnH,0GAA0G;IACpG,sBAAsB,CAAC,YAAoB;;YAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,GAAG,CAAC;QACrH,CAAC;KAAA;IAED,4EAA4E;IAC5E,8GAA8G;IACxG,eAAe,CAAC,WAAmB;;YACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,8FAA8F,EAC9F,CAAC,WAAW,CAAC,CACd,CAAC;QACJ,CAAC;KAAA;IAED,oFAAoF;IAC9E,gBAAgB,CAAC,WAAmB;;YACxC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC3B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,0EAA0E,EAC1E,CAAC,WAAW,CAAC,CACd,CAAmC,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA0C,CAAC;YACvG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,YAAY,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,CAAC;KAAA;IAED,oGAAoG;IACpG;;;OAGG;IACG,cAAc,CAAC,YAAoB,EAAE,WAAmB;;YAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;YAC/G,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,iEAAiE,EACjE,CAAC,WAAW,EAAE,YAAY,CAAC,CAC5B,CAAC;QACJ,CAAC;KAAA;IAED,sGAAsG;IACtG,6GAA6G;IACvG,cAAc,CAAC,WAAmB,EAAE,MAA2C;;YACnF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;;oBAC/C,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACjC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACnI,CAAC;KAAA;IAED,uFAAuF;IACjF,YAAY;;YAChB,IAAI,IAAI,CAAC,SAAS,EAAE;gBAAE,MAAM,+CAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;KAAA;IAEa,YAAY,CAAC,QAAmC,EAAE,UAAmB;;YACjF,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;gEAM0D,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,EACpG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEa,gBAAgB,CAAC,YAAoB;;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QACxE,CAAC;KAAA;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;QACzI,CAAC;IACH,CAAC;IAED,uFAAuF;IAC/E,iBAAiB,CAAC,WAAmB;QAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,QAAmC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;QAChK,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAEO,iBAAiB,CAAC,KAAc;QACtC,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC,CAAC;QACnK,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEa,oBAAoB,CAAC,QAAgB;;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KAAA;IAEa,YAAY,CAAC,QAAgB;;YACzC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;0BAGoB,EACpB,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEO,cAAc,CAAC,QAAmC;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAChK,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAEO,UAAU,CAAC,GAAgB;QACjC,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;YACpC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YACtC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,KAAK,KAAK,IAAI,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;YACjI,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAgB;;QACjC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,WAAW,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACjD,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AA3dY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACX,yBAAW;GAJhC,oBAAoB,CA2dhC","sourcesContent":["import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, InternalServerErrorException, NotFoundException, OnModuleInit, ServiceUnavailableException } from '@nestjs/common';\nimport { createHash } from 'crypto';\nimport { AccessiDatabaseUpdater } from '../database-updates/AccessiDatabaseUpdater';\nimport { Orm } from '../../Orm';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { isAuthenticatedUserEnabledForJwt } from '../security/authenticatedToken';\nimport { revokeAccessiUserSessionsIfConfigured } from '../security/sessionRevocation';\nimport { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './FederatedAuthTypes';\n\ntype IdentityRow = {\n  identityKey?: string;\n  codiceUtente?: number;\n  provider?: string;\n  subject?: string;\n  active?: unknown;\n  createdAt?: Date | string;\n  lastLoginAt?: Date | string;\n  disabledAt?: Date | string;\n  note?: string;\n  passwordLoginEnabled?: unknown;\n};\n\ntype ProviderRow = {\n  provider?: string;\n  description?: string;\n  active?: unknown;\n  createdAt?: Date | string;\n  note?: string;\n};\n\n/**\n * Maps externally verified identities to Accessi users and issues the usual\n * Accessi JWT. It deliberately has no provider SDK dependency: validating an\n * Azure, Google, Apple, SAML, or custom token is always the hosting backend's job.\n */\n@Injectable()\nexport class FederatedAuthService implements OnModuleInit {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n    private readonly userService: UserService,\n    private readonly authService: AuthService,\n  ) {}\n\n  /** Await the same schema barrier as the module updater; never race two DDL implementations. */\n  async onModuleInit(): Promise<void> {\n    await AccessiDatabaseUpdater.initialize(this.options);\n  }\n\n  /** Returns true only when the host application opted in to federated authentication. */\n  isEnabled(): boolean {\n    return this.options.federatedAuthentication?.enabled === true;\n  }\n\n  /**\n   * Exchanges a backend-verified identity for the same login result and JWT\n   * emitted by the local password endpoint. No raw external token is accepted.\n   */\n  async authenticate(identity: VerifiedFederatedIdentity): Promise<FederatedAuthenticationResult> {\n    this.assertEnabled();\n    const normalized = this.normalizeIdentity(identity);\n    await this.assertProviderActive(normalized.provider);\n    const linkedIdentity = await this.findIdentity(normalized, true);\n\n    if (!linkedIdentity) {\n      throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_LINKED', message: 'Identita esterna non associata a un utente Accessi.' });\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(linkedIdentity.codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\n      throw new ForbiddenException({ code: 'FEDERATED_USER_DISABLED', message: 'Utente Accessi non abilitato.' });\n    }\n\n    if (currentUser.flagDueFattori) {\n      const login = await this.authService.beginFederatedTwoFactor(linkedIdentity.codiceUtente, linkedIdentity.identityKey);\n      return { codiceUtente: linkedIdentity.codiceUtente, login };\n    }\n\n    await Orm.execute(\n      this.options.databaseOptions,\n      'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n      [linkedIdentity.identityKey],\n    );\n    await Orm.execute(\n      this.options.databaseOptions,\n      'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?',\n      [linkedIdentity.codiceUtente],\n    );\n\n    const login = await this.authService.getLoginResultForUser(linkedIdentity.codiceUtente);\n    const tokens = typeof this.authService.createTokenPair === 'function'\n      ? this.authService.createTokenPair(login.utente, ['federated'])\n      : { access: this.authService.createAccessiToken(login.utente, ['federated']), refresh: undefined };\n    login.token = tokens.access;\n    if (tokens.refresh) login.refreshToken = tokens.refresh;\n    return {\n      codiceUtente: linkedIdentity.codiceUtente,\n      login,\n      token: tokens.access,\n    };\n  }\n\n  /** Links an external identity to an existing Accessi user. It never changes that user's password policy. */\n  async linkIdentity(codiceUtente: number, identity: VerifiedFederatedIdentity, note?: string): Promise<FederatedIdentity> {\n    this.assertEnabled();\n    await this.assertUserExists(codiceUtente);\n    const normalized = this.normalizeIdentity(identity);\n    await this.assertProviderActive(normalized.provider);\n    const existing = await this.findIdentity(normalized, false);\n\n    if (existing && existing.codiceUtente !== codiceUtente) {\n      throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identita esterna gia associata a un altro utente.' });\n    }\n\n    if (existing) {\n      await Orm.execute(\n        this.options.databaseOptions,\n        'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 1, DATDISATT = NULL, NOTA = ? WHERE IDNKEY = ?',\n        [note ?? existing.note ?? null, existing.identityKey],\n      );\n    } else {\n      await Orm.execute(\n        this.options.databaseOptions,\n        `INSERT INTO UTENTI_IDENTITA_EXT (IDNKEY, CODUTE, PROVIDER, SUBJECT, FLGATTIVO, NOTA)\n         VALUES (?, ?, ?, ?, 1, ?)`,\n        [this.getIdentityKey(normalized), codiceUtente, normalized.provider, normalized.subject, note ?? null],\n      );\n    }\n\n    return (await this.findIdentity(normalized, false))!;\n  }\n\n  /** Creates a confirmed Accessi user, associates an SSO identity and defaults the new user to SSO-only. */\n  async createManagedFederatedUser(\n    registrationData: RegisterRequest,\n    identity: VerifiedFederatedIdentity,\n    passwordLoginEnabled = false,\n    note?: string,\n  ): Promise<FederatedIdentity> {\n    this.assertEnabled();\n    const normalizedIdentity = this.normalizeIdentity(identity);\n    await this.assertProviderActive(normalizedIdentity.provider);\n    if (await this.findIdentity(normalizedIdentity, false)) {\n      throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identità esterna già associata a un utente Accessi.' });\n    }\n\n    try {\n      const codiceUtente = await this.userService.register(registrationData, {\n        allowPrivilegedFields: true,\n        initialState: StatoRegistrazione.CONF,\n      });\n      await this.setPasswordLoginEnabled(codiceUtente, passwordLoginEnabled);\n      return await this.linkIdentity(codiceUtente, normalizedIdentity, note);\n    } catch (error) {\n      if (error instanceof BadRequestException || error instanceof ConflictException || error instanceof ForbiddenException || error instanceof NotFoundException || error instanceof ServiceUnavailableException) {\n        throw error;\n      }\n      if (RestUtilities.isDatabaseSchemaError(error)) {\n        throw new ServiceUnavailableException({ code: 'ACCESSI_DATABASE_SCHEMA_OUTDATED', message: 'Lo schema del database Accessi non è aggiornato. Eseguire la migrazione database e riprovare.' });\n      }\n      throw new InternalServerErrorException({ code: 'FEDERATED_USER_PROVISIONING_FAILED', message: 'La creazione dell’utente SSO non è stata completata. Verificare il log del backend e l’eventuale utente creato senza identità SSO.' });\n    }\n  }\n\n  /**\n   * Allows self-provisioning only when explicitly enabled. The caller must have\n   * verified the external identity and decide which profile fields are trusted.\n   */\n  async registerSelfServiceFederatedUser(\n    registrationData: RegisterRequest,\n    identity: VerifiedFederatedIdentity,\n  ): Promise<FederatedIdentity> {\n    this.assertEnabled();\n    if (this.options.federatedAuthentication?.allowSelfRegistration !== true) {\n      throw new ForbiddenException({ code: 'FEDERATED_SELF_REGISTRATION_DISABLED', message: 'Auto-registrazione SSO non abilitata.' });\n    }\n\n    const codiceUtente = await this.userService.register(registrationData, {\n      allowPrivilegedFields: false,\n      initialState: StatoRegistrazione.CONF,\n    });\n    await this.setPasswordLoginEnabled(codiceUtente, false);\n    return this.linkIdentity(codiceUtente, identity);\n  }\n\n  /** Returns all linked identities for administration; disabled identities are included. */\n  async getUserIdentities(codiceUtente: number): Promise<FederatedIdentity[]> {\n    this.assertEnabled();\n    const rows = await Orm.query(\n      this.options.databaseOptions,\n      `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n              I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n              I.DATDISATT AS disabled_at, I.NOTA,\n              COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n       FROM UTENTI_IDENTITA_EXT I\n       LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n       WHERE I.CODUTE = ?\n       ORDER BY I.DATINS DESC`,\n      [codiceUtente],\n    );\n    return rows.map(RestUtilities.convertKeysToCamelCase).map((row: IdentityRow) => this.toIdentity(row));\n  }\n\n  /** Returns the complete provider catalog, including inactive providers, for superuser administration. */\n  async getProviders(): Promise<FederatedProvider[]> {\n    this.assertEnabled();\n    const rows = await Orm.query(\n      this.options.databaseOptions,\n      `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n              DATINS AS created_at, NOTA AS note\n       FROM SSO_PROVIDER\n       ORDER BY FLGATTIVO DESC, DESCRIZIONE, PROVIDER`,\n    );\n    return rows.map(RestUtilities.convertKeysToCamelCase).map((row: ProviderRow) => this.toProvider(row));\n  }\n\n  /** Registers a provider key that must match the backend's SSO configuration exactly. */\n  async createProvider(input: { provider: string; description: string; note?: string }): Promise<FederatedProvider> {\n    this.assertEnabled();\n    const provider = this.normalizeProvider(input.provider);\n    const description = this.normalizeDescription(input.description);\n    const existing = await this.findProvider(provider);\n    if (existing) {\n      throw new ConflictException({ code: 'FEDERATED_PROVIDER_ALREADY_EXISTS', message: 'Il provider SSO è già registrato.' });\n    }\n    await Orm.execute(\n      this.options.databaseOptions,\n      'INSERT INTO SSO_PROVIDER (PROVIDER, DESCRIZIONE, FLGATTIVO, NOTA) VALUES (?, ?, 1, ?)',\n      [provider, description, input.note?.trim() || null],\n    );\n    return (await this.findProvider(provider))!;\n  }\n\n  /** Updates provider metadata or disables the provider without removing its identity history. */\n  /**\n   * Aggiorna metadati amministrativi del catalogo. La chiave provider e immutabile perche parte dell'identita\n   * persistita e deve coincidere esattamente con la configurazione del backend validante.\n   */\n  async updateProvider(providerValue: string, update: { description?: string; active?: boolean; note?: string }): Promise<FederatedProvider> {\n    this.assertEnabled();\n    const provider = this.normalizeProvider(providerValue);\n    if (!(await this.findProvider(provider))) {\n      throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n    }\n    const changes: string[] = [];\n    const params: unknown[] = [];\n    if (update.description !== undefined) {\n      changes.push('DESCRIZIONE = ?');\n      params.push(this.normalizeDescription(update.description));\n    }\n    if (update.active !== undefined) {\n      changes.push('FLGATTIVO = ?');\n      params.push(update.active ? 1 : 0);\n    }\n    if (update.note !== undefined) {\n      changes.push('NOTA = ?');\n      params.push(update.note.trim() || null);\n    }\n    if (changes.length > 0) {\n      params.push(provider);\n      await Orm.execute(this.options.databaseOptions, `UPDATE SSO_PROVIDER SET ${changes.join(', ')} WHERE PROVIDER = ?`, params);\n    }\n    return (await this.findProvider(provider))!;\n  }\n\n  /**\n   * Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK\n   * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un\n   * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.\n   */\n  async deleteProvider(providerValue: string): Promise<void> {\n    this.assertEnabled();\n    const provider = this.normalizeProvider(providerValue);\n    if (!(await this.findProvider(provider))) {\n      throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n    }\n    const usage = await Orm.query(\n      this.options.databaseOptions,\n      'SELECT COUNT(*) AS total FROM UTENTI_IDENTITA_EXT WHERE PROVIDER = ?',\n      [provider],\n    );\n    const rawTotal = (usage?.[0] as Record<string, unknown> | undefined)?.TOTAL\n      ?? (usage?.[0] as Record<string, unknown> | undefined)?.total;\n    const total = typeof rawTotal === 'number' ? rawTotal : Number.parseInt(`${rawTotal ?? '0'}`, 10);\n    if (total > 0) {\n      throw new ConflictException({\n        code: 'FEDERATED_PROVIDER_IN_USE',\n        message: `Impossibile eliminare il provider ${provider}: ${total} identita collegate. Disabilitalo oppure rimuovi prima i collegamenti.`,\n      });\n    }\n    await Orm.execute(this.options.databaseOptions, 'DELETE FROM SSO_PROVIDER WHERE PROVIDER = ?', [provider]);\n  }\n\n  /** Enables or disables all local password authentication for one user. */\n  /**\n   * Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso\n   * email/password, che restituisce `PASSWORD_LOGIN_DISABLED`. L'assenza della riga mantiene il default legacy `true`.\n   */\n  async setPasswordLoginEnabled(codiceUtente: number, enabled: boolean): Promise<void> {\n    this.assertEnabled();\n    await this.assertUserExists(codiceUtente);\n    const previous = await this.isPasswordLoginEnabled(codiceUtente);\n    // Upsert: per utenti legacy senza riga in UTENTI_CONFIG una UPDATE a vuoto\n    // lasciava la policy al default, rendendo la disattivazione un no-op silenzioso.\n    await Orm.execute(\n      this.options.databaseOptions,\n      'UPDATE OR INSERT INTO UTENTI_CONFIG (CODUTE, FLGPASSWORD) VALUES (?, ?) MATCHING (CODUTE)',\n      [codiceUtente, enabled ? 1 : 0],\n    );\n    if (previous !== enabled) {\n      await revokeAccessiUserSessionsIfConfigured(this.options, codiceUtente, 'login_policy_change');\n    }\n  }\n\n  /** Returns the effective local password policy. Users without a policy row retain the historic enabled default. */\n  /** Restituisce la policy effettiva; utenti precedenti alla migrazione restano abilitati alla password. */\n  async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n    if (!this.isEnabled()) return true;\n    const rows = await Orm.query(\n      this.options.databaseOptions,\n      'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n      [codiceUtente],\n    );\n    const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow | undefined;\n    return row?.passwordLoginEnabled !== false && row?.passwordLoginEnabled !== 0 && row?.passwordLoginEnabled !== '0';\n  }\n\n  /** Soft-disables a linked identity without deleting operational history. */\n  /** Disabilita logicamente un collegamento SSO conservando audit e possibilita di successiva riattivazione. */\n  async disableIdentity(identityKey: string): Promise<void> {\n    this.assertEnabled();\n    this.assertIdentityKey(identityKey);\n    await Orm.execute(\n      this.options.databaseOptions,\n      'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 0, DATDISATT = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n      [identityKey],\n    );\n  }\n\n  /** Restituisce il CODUTE proprietario di un collegamento SSO, o null se assente. */\n  async getIdentityOwner(identityKey: string): Promise<number | null> {\n    this.assertIdentityKey(identityKey);\n    const rows = (await Orm.query(\n      this.options.databaseOptions,\n      'SELECT CODUTE AS codice_utente FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ?',\n      [identityKey],\n    )) as Array<Record<string, unknown>>;\n    const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { codiceUtente?: number } | undefined;\n    const owner = Number(row?.codiceUtente);\n    return Number.isSafeInteger(owner) && owner > 0 ? owner : null;\n  }\n\n  /** Permanently removes one identity link from its owning user after administrative confirmation. */\n  /**\n   * Elimina fisicamente un collegamento SSO soltanto dopo aver verificato che appartenga all'utente indicato.\n   * Non elimina mai l'utente Accessi, password, ruoli o grant associati.\n   */\n  async deleteIdentity(codiceUtente: number, identityKey: string): Promise<void> {\n    this.assertEnabled();\n    this.assertIdentityKey(identityKey);\n    const identity = (await this.getUserIdentities(codiceUtente)).find((item) => item.identityKey === identityKey);\n    if (!identity) {\n      throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_FOUND', message: 'Collegamento SSO non trovato per questo utente.' });\n    }\n    await Orm.execute(\n      this.options.databaseOptions,\n      'DELETE FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ? AND CODUTE = ?',\n      [identityKey, codiceUtente],\n    );\n  }\n\n  /** Aggiorna lo stato o la nota di un collegamento SSO usando la sua chiave tecnica amministrativa. */\n  /** Aggiorna stato o nota amministrativa senza modificare provider e subject, che identificano la persona. */\n  async updateIdentity(identityKey: string, update: { active?: boolean; note?: string }): Promise<void> {\n    this.assertEnabled();\n    this.assertIdentityKey(identityKey);\n    const changes: string[] = [];\n    const params: unknown[] = [];\n    if (update.active !== undefined) {\n      changes.push('FLGATTIVO = ?');\n      params.push(update.active ? 1 : 0);\n      if (update.active) changes.push('DATDISATT = NULL');\n      else changes.push('DATDISATT = CURRENT_TIMESTAMP');\n    }\n    if (update.note !== undefined) {\n      changes.push('NOTA = ?');\n      params.push(update.note);\n    }\n    if (changes.length === 0) return;\n    params.push(identityKey);\n    await Orm.execute(this.options.databaseOptions, `UPDATE UTENTI_IDENTITA_EXT SET ${changes.join(', ')} WHERE IDNKEY = ?`, params);\n  }\n\n  /** Explicit administrative schema reconciliation, shared with the standard updater. */\n  async ensureSchema(): Promise<void> {\n    if (this.isEnabled()) await AccessiDatabaseUpdater.run(this.options);\n  }\n\n  private async findIdentity(identity: VerifiedFederatedIdentity, onlyActive: boolean): Promise<FederatedIdentity | null> {\n    const rows = await Orm.query(\n      this.options.databaseOptions,\n      `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n              I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n              I.DATDISATT AS disabled_at, I.NOTA,\n              COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n       FROM UTENTI_IDENTITA_EXT I\n       LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n       WHERE I.IDNKEY = ? AND I.PROVIDER = ? AND I.SUBJECT = ?${onlyActive ? ' AND I.FLGATTIVO = 1' : ''}`,\n      [this.getIdentityKey(identity), identity.provider, identity.subject],\n    );\n    const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow | undefined;\n    return row ? this.toIdentity(row) : null;\n  }\n\n  private async assertUserExists(codiceUtente: number): Promise<void> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!user) throw new NotFoundException('Utente Accessi non trovato.');\n  }\n\n  private assertEnabled(): void {\n    if (!this.isEnabled()) {\n      throw new ForbiddenException({ code: 'FEDERATED_AUTH_DISABLED', message: 'Autenticazione federata non abilitata in AccessiOptions.' });\n    }\n  }\n\n  /** Validates the opaque SHA-256 key used only by administrative identity endpoints. */\n  private assertIdentityKey(identityKey: string): void {\n    if (!/^[a-f0-9]{64}$/i.test(identityKey)) {\n      throw new BadRequestException({ code: 'FEDERATED_IDENTITY_KEY_INVALID', message: 'Chiave del collegamento SSO non valida.' });\n    }\n  }\n\n  private normalizeIdentity(identity: VerifiedFederatedIdentity): VerifiedFederatedIdentity {\n    const provider = this.normalizeProvider(identity?.provider);\n    const subject = typeof identity?.subject === 'string' ? identity.subject.trim() : '';\n    if (!subject || Buffer.byteLength(subject, 'utf8') > 512) {\n      throw new BadRequestException({ code: 'FEDERATED_SUBJECT_INVALID', message: 'Subject non valido: è obbligatorio e può occupare al massimo 512 byte UTF-8.' });\n    }\n    return { provider, subject };\n  }\n\n  private normalizeProvider(value: unknown): string {\n    const provider = typeof value === 'string' ? value.trim().toLowerCase() : '';\n    if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(provider)) {\n      throw new BadRequestException({ code: 'FEDERATED_PROVIDER_INVALID', message: 'Provider non valido: usare un namespace ASCII stabile di massimo 64 caratteri.' });\n    }\n    return provider;\n  }\n\n  private normalizeDescription(value: unknown): string {\n    const description = typeof value === 'string' ? value.trim() : '';\n    if (!description || description.length > 160) {\n      throw new BadRequestException({ code: 'FEDERATED_PROVIDER_DESCRIPTION_INVALID', message: 'La descrizione del provider deve contenere da 1 a 160 caratteri.' });\n    }\n    return description;\n  }\n\n  private async assertProviderActive(provider: string): Promise<FederatedProvider> {\n    const registered = await this.findProvider(provider);\n    if (!registered) {\n      throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n    }\n    if (!registered.active) {\n      throw new ForbiddenException({ code: 'FEDERATED_PROVIDER_DISABLED', message: 'Provider SSO disabilitato.' });\n    }\n    return registered;\n  }\n\n  private async findProvider(provider: string): Promise<FederatedProvider | null> {\n    const rows = await Orm.query(\n      this.options.databaseOptions,\n      `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n              DATINS AS created_at, NOTA AS note\n       FROM SSO_PROVIDER\n       WHERE PROVIDER = ?`,\n      [provider],\n    );\n    const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as ProviderRow | undefined;\n    return row ? this.toProvider(row) : null;\n  }\n\n  private getIdentityKey(identity: VerifiedFederatedIdentity): string {\n    const provider = Buffer.from(identity.provider, 'utf8');\n    const subject = Buffer.from(identity.subject, 'utf8');\n    const payload = Buffer.concat([Buffer.from('accessi:federated:v1:'), Buffer.from(`${provider.length}:`), provider, Buffer.from(`${subject.length}:`), subject]);\n    return createHash('sha256').update(payload).digest('hex');\n  }\n\n  private toIdentity(row: IdentityRow): FederatedIdentity {\n    return {\n      identityKey: String(row.identityKey),\n      codiceUtente: Number(row.codiceUtente),\n      provider: String(row.provider).trim(),\n      subject: String(row.subject),\n      active: row.active === true || row.active === 1 || row.active === '1',\n      passwordLoginEnabled: !(row.passwordLoginEnabled === false || row.passwordLoginEnabled === 0 || row.passwordLoginEnabled === '0'),\n      createdAt: row.createdAt,\n      lastLoginAt: row.lastLoginAt,\n      disabledAt: row.disabledAt,\n      note: row.note,\n    };\n  }\n\n  private toProvider(row: ProviderRow): FederatedProvider {\n    return {\n      provider: String(row.provider).trim(),\n      description: String(row.description ?? '').trim(),\n      active: row.active === true || row.active === 1 || row.active === '1',\n      createdAt: row.createdAt,\n      note: row.note,\n    };\n  }\n}\n"]}

package/dist/accessi-module/federated-auth/FederatedAuthTypes.d.ts

@@ -0,0 +1,53 @@
+import { LoginResult } from '../Dtos/LoginResponse';
+import { TokenResult } from '../Dtos/TokenResult';
+/**
+ * Identita esterna gia verificata dal backend ospitante.
+ *
+ * Questa e l unica informazione che il backend passa ad Accessi dopo avere
+ * concluso il proprio flusso SSO. Accessi non riceve e non verifica token del
+ * provider: decide solo quale utente interno corrisponde all identita e quali
+ * grant possiede.
+ */
+export interface VerifiedFederatedIdentity {
+    /** Chiave stabile censita in Accessi e configurata nel backend, ad esempio `azure-ad-acme-produzione`. Non e il nome commerciale del provider. */
+    provider: string;
+    /** ID opaco e stabile dell account presso il provider, ad esempio oid, sub o NameID persistente. Non usare email, nome o username. */
+    subject: string;
+}
+/** Provider SSO censito in Accessi. Le configurazioni e i segreti restano nel backend ospitante. */
+export interface FederatedProvider {
+    /** Chiave stabile usata dal backend nei payload `{ provider, subject }`. */
+    provider: string;
+    /** Nome leggibile mostrato agli amministratori nella console. */
+    description: string;
+    /** Un provider disabilitato non puo autenticare nuove sessioni SSO. */
+    active: boolean;
+    createdAt?: Date | string;
+    note?: string;
+}
+/** Collegamento persistito fra una identita esterna e un utente Accessi. */
+export interface FederatedIdentity {
+    /** Chiave tecnica SHA-256 del collegamento. Serve solo alle CRUD amministrative, mai al login SSO. */
+    identityKey: string;
+    /** Chiave dell utente Accessi che riceve ruoli, grant e sessione interna. */
+    codiceUtente: number;
+    /** Namespace backend salvato al momento del collegamento. */
+    provider: string;
+    /** Identificativo esterno usato insieme a provider per riconoscere la persona. */
+    subject: string;
+    /** Indica se l utente puo usare anche la password locale. */
+    passwordLoginEnabled: boolean;
+    /** Indica se questo singolo collegamento SSO puo ancora autenticare. */
+    active: boolean;
+    createdAt?: Date | string;
+    lastLoginAt?: Date | string;
+    disabledAt?: Date | string;
+    note?: string;
+}
+/** Risultato dello scambio di un identita esterna verificata con una normale sessione Accessi. */
+export interface FederatedAuthenticationResult {
+    codiceUtente: number;
+    login: LoginResult;
+    /** Assente quando login.challenge richiede la verifica email. */
+    token?: TokenResult;
+}

package/dist/accessi-module/federated-auth/FederatedAuthTypes.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=FederatedAuthTypes.js.map

package/dist/accessi-module/federated-auth/FederatedAuthTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedAuthTypes.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthTypes.ts"],"names":[],"mappings":"","sourcesContent":["import { LoginResult } from '../Dtos/LoginResponse';\nimport { TokenResult } from '../Dtos/TokenResult';\n\n/**\n * Identita esterna gia verificata dal backend ospitante.\n *\n * Questa e l unica informazione che il backend passa ad Accessi dopo avere\n * concluso il proprio flusso SSO. Accessi non riceve e non verifica token del\n * provider: decide solo quale utente interno corrisponde all identita e quali\n * grant possiede.\n */\nexport interface VerifiedFederatedIdentity {\n  /** Chiave stabile censita in Accessi e configurata nel backend, ad esempio `azure-ad-acme-produzione`. Non e il nome commerciale del provider. */\n  provider: string;\n  /** ID opaco e stabile dell account presso il provider, ad esempio oid, sub o NameID persistente. Non usare email, nome o username. */\n  subject: string;\n}\n\n/** Provider SSO censito in Accessi. Le configurazioni e i segreti restano nel backend ospitante. */\nexport interface FederatedProvider {\n  /** Chiave stabile usata dal backend nei payload `{ provider, subject }`. */\n  provider: string;\n  /** Nome leggibile mostrato agli amministratori nella console. */\n  description: string;\n  /** Un provider disabilitato non puo autenticare nuove sessioni SSO. */\n  active: boolean;\n  createdAt?: Date | string;\n  note?: string;\n}\n\n/** Collegamento persistito fra una identita esterna e un utente Accessi. */\nexport interface FederatedIdentity {\n  /** Chiave tecnica SHA-256 del collegamento. Serve solo alle CRUD amministrative, mai al login SSO. */\n  identityKey: string;\n  /** Chiave dell utente Accessi che riceve ruoli, grant e sessione interna. */\n  codiceUtente: number;\n  /** Namespace backend salvato al momento del collegamento. */\n  provider: string;\n  /** Identificativo esterno usato insieme a provider per riconoscere la persona. */\n  subject: string;\n  /** Indica se l utente puo usare anche la password locale. */\n  passwordLoginEnabled: boolean;\n  /** Indica se questo singolo collegamento SSO puo ancora autenticare. */\n  active: boolean;\n  createdAt?: Date | string;\n  lastLoginAt?: Date | string;\n  disabledAt?: Date | string;\n  note?: string;\n}\n\n/** Risultato dello scambio di un identita esterna verificata con una normale sessione Accessi. */\nexport interface FederatedAuthenticationResult {\n  codiceUtente: number;\n  login: LoginResult;\n  /** Assente quando login.challenge richiede la verifica email. */\n  token?: TokenResult;\n}\n"]}

package/dist/accessi-module/health/nest.d.ts

@@ -0,0 +1,31 @@
+import type { DynamicModule } from '@nestjs/common';
+import type { AccessiOptions } from '../AccessiModule';
+import type { AccessiReadinessCheck, AccessiReadinessDependencies } from './readiness';
+export interface AccessiHealthModuleOptions {
+    /** Opzioni gia passate ad `AccessiModule.forRoot` / `initializeAccessiModule`. */
+    accessiOptions: AccessiOptions;
+    /** Check applicativi aggiuntivi, come nel servizio standalone. */
+    readinessChecks?: AccessiReadinessCheck[];
+    /** Override dei check (es. pool database esterni o test). */
+    readinessDependencies?: AccessiReadinessDependencies;
+    /** Path base degli endpoint. Default: `/health`. */
+    path?: string;
+}
+/**
+ * Crea un modulo Nest con `/health/live` e `/health/ready`.
+ *
+ * Stesso contratto del servizio standalone: readiness 200/503 con il dettaglio
+ * di bootstrap, database, store condivisi e check applicativi. Da importare
+ * nell'host Nest accanto ad `AccessiModule.forRoot`:
+ *
+ * ```ts
+ * @Module({
+ *   imports: [
+ *     AccessiModule.forRoot(accessiOptions),
+ *     createAccessiHealthModule({ accessiOptions }),
+ *   ],
+ * })
+ * export class AppModule {}
+ * ```
+ */
+export declare function createAccessiHealthModule(options: AccessiHealthModuleOptions): DynamicModule;

package/dist/accessi-module/health/nest.js

@@ -0,0 +1,89 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiHealthModule = createAccessiHealthModule;
+const common_1 = require("@nestjs/common");
+const readiness_1 = require("./readiness");
+function normalizeHealthPath(value) {
+    return `/${value.replace(/^\/+|\/+$/g, '')}`;
+}
+let AccessiHealthHostModule = class AccessiHealthHostModule {
+};
+AccessiHealthHostModule = __decorate([
+    (0, common_1.Module)({})
+], AccessiHealthHostModule);
+/**
+ * Crea un modulo Nest con `/health/live` e `/health/ready`.
+ *
+ * Stesso contratto del servizio standalone: readiness 200/503 con il dettaglio
+ * di bootstrap, database, store condivisi e check applicativi. Da importare
+ * nell'host Nest accanto ad `AccessiModule.forRoot`:
+ *
+ * ```ts
+ * @Module({
+ *   imports: [
+ *     AccessiModule.forRoot(accessiOptions),
+ *     createAccessiHealthModule({ accessiOptions }),
+ *   ],
+ * })
+ * export class AppModule {}
+ * ```
+ */
+function createAccessiHealthModule(options) {
+    var _a, _b;
+    const readinessChecks = (_a = options.readinessChecks) !== null && _a !== void 0 ? _a : [];
+    const basePath = normalizeHealthPath((_b = options.path) !== null && _b !== void 0 ? _b : '/health');
+    let AccessiHealthController = class AccessiHealthController {
+        live() {
+            return (0, readiness_1.createAccessiLiveReport)();
+        }
+        ready(res) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const report = yield (0, readiness_1.checkAccessiReadiness)(options.accessiOptions, readinessChecks, options.readinessDependencies);
+                res.status((0, readiness_1.readinessHttpStatus)(report));
+                return report;
+            });
+        }
+    };
+    __decorate([
+        (0, common_1.Get)('live'),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", []),
+        __metadata("design:returntype", Object)
+    ], AccessiHealthController.prototype, "live", null);
+    __decorate([
+        (0, common_1.Get)('ready'),
+        __param(0, (0, common_1.Res)({ passthrough: true })),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", [Object]),
+        __metadata("design:returntype", Promise)
+    ], AccessiHealthController.prototype, "ready", null);
+    AccessiHealthController = __decorate([
+        (0, common_1.Controller)(basePath)
+    ], AccessiHealthController);
+    return {
+        module: AccessiHealthHostModule,
+        controllers: [AccessiHealthController],
+    };
+}
+//# sourceMappingURL=nest.js.map

package/dist/accessi-module/health/nest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nest.js","sourceRoot":"","sources":["../../../src/accessi-module/health/nest.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDA,8DA2BC;AA9ED,2CAA8D;AAI9D,2CAIqB;AAmBrB,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAGD,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;CAAG,CAAA;AAA1B,uBAAuB;IAD5B,IAAA,eAAM,EAAC,EAAE,CAAC;GACL,uBAAuB,CAAG;AAEhC;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,yBAAyB,CAAC,OAAmC;;IAC3E,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAA,OAAO,CAAC,IAAI,mCAAI,SAAS,CAAC,CAAC;IAGhE,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;QAE3B,IAAI;YACF,OAAO,IAAA,mCAAuB,GAAE,CAAC;QACnC,CAAC;QAGK,KAAK,CAA6B,GAAa;;gBACnD,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAqB,EACxC,OAAO,CAAC,cAAc,EACtB,eAAe,EACf,OAAO,CAAC,qBAAqB,CAC9B,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,IAAA,+BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC;gBACxC,OAAO,MAAM,CAAC;YAChB,CAAC;SAAA;KACF,CAAA;IAdC;QADC,IAAA,YAAG,EAAC,MAAM,CAAC;;;;uDAGX;IAGK;QADL,IAAA,YAAG,EAAC,OAAO,CAAC;QACA,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;wDAQtC;IAfG,uBAAuB;QAD5B,IAAA,mBAAU,EAAC,QAAQ,CAAC;OACf,uBAAuB,CAgB5B;IAED,OAAO;QACL,MAAM,EAAE,uBAAuB;QAC/B,WAAW,EAAE,CAAC,uBAAuB,CAAC;KACvC,CAAC;AACJ,CAAC","sourcesContent":["import { Controller, Get, Module, Res } from '@nestjs/common';\nimport type { DynamicModule } from '@nestjs/common';\nimport type { Response } from 'express';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n  checkAccessiReadiness,\n  createAccessiLiveReport,\n  readinessHttpStatus,\n} from './readiness';\nimport type {\n  AccessiLiveReport,\n  AccessiReadinessCheck,\n  AccessiReadinessDependencies,\n  AccessiReadinessReport,\n} from './readiness';\n\nexport interface AccessiHealthModuleOptions {\n  /** Opzioni gia passate ad `AccessiModule.forRoot` / `initializeAccessiModule`. */\n  accessiOptions: AccessiOptions;\n  /** Check applicativi aggiuntivi, come nel servizio standalone. */\n  readinessChecks?: AccessiReadinessCheck[];\n  /** Override dei check (es. pool database esterni o test). */\n  readinessDependencies?: AccessiReadinessDependencies;\n  /** Path base degli endpoint. Default: `/health`. */\n  path?: string;\n}\n\nfunction normalizeHealthPath(value: string): string {\n  return `/${value.replace(/^\\/+|\\/+$/g, '')}`;\n}\n\n@Module({})\nclass AccessiHealthHostModule {}\n\n/**\n * Crea un modulo Nest con `/health/live` e `/health/ready`.\n *\n * Stesso contratto del servizio standalone: readiness 200/503 con il dettaglio\n * di bootstrap, database, store condivisi e check applicativi. Da importare\n * nell'host Nest accanto ad `AccessiModule.forRoot`:\n *\n * ```ts\n * @Module({\n *   imports: [\n *     AccessiModule.forRoot(accessiOptions),\n *     createAccessiHealthModule({ accessiOptions }),\n *   ],\n * })\n * export class AppModule {}\n * ```\n */\nexport function createAccessiHealthModule(options: AccessiHealthModuleOptions): DynamicModule {\n  const readinessChecks = options.readinessChecks ?? [];\n  const basePath = normalizeHealthPath(options.path ?? '/health');\n\n  @Controller(basePath)\n  class AccessiHealthController {\n    @Get('live')\n    live(): AccessiLiveReport {\n      return createAccessiLiveReport();\n    }\n\n    @Get('ready')\n    async ready(@Res({ passthrough: true }) res: Response): Promise<AccessiReadinessReport> {\n      const report = await checkAccessiReadiness(\n        options.accessiOptions,\n        readinessChecks,\n        options.readinessDependencies,\n      );\n      res.status(readinessHttpStatus(report));\n      return report;\n    }\n  }\n\n  return {\n    module: AccessiHealthHostModule,\n    controllers: [AccessiHealthController],\n  };\n}\n"]}

package/dist/accessi-module/health/readiness.d.ts

@@ -0,0 +1,53 @@
+import type { AccessiOptions } from '../AccessiModule';
+/**
+ * Health e readiness riutilizzabili.
+ *
+ * Lo stesso contratto e usato da `createAccessiService` (servizio standalone) e
+ * da `createAccessiHealthModule` (host Nest con `AccessiModule.forRoot`):
+ * `/health/live` risponde sempre se il processo e vivo, `/health/ready` verifica
+ * bootstrap, schema del database, store condivisi e check applicativi.
+ */
+export interface AccessiReadinessCheck {
+    name: string;
+    check: () => boolean | Promise<boolean>;
+}
+export interface AccessiHealthCheckResult {
+    ok: boolean;
+    detail?: string;
+}
+export interface AccessiReadinessReport {
+    status: 'ok' | 'error';
+    checks: Record<string, AccessiHealthCheckResult>;
+    timestamp: string;
+}
+export interface AccessiLiveReport {
+    status: 'ok';
+    uptimeSeconds: number;
+}
+/** Store condivisi con health check, senza duplicati. */
+export interface AccessiHealthStore {
+    name: string;
+    store: {
+        healthCheck?: () => Promise<boolean>;
+    };
+}
+export interface AccessiReadinessDependencies {
+    /** Override del check database (usato dai test o da host con pool esterni). */
+    databaseVersion?: (options: AccessiOptions) => Promise<string | null | undefined>;
+}
+/** Stato liveness: il processo risponde, nessun accesso a DB o store. */
+export declare function createAccessiLiveReport(): AccessiLiveReport;
+/** Store con health check configurati nelle opzioni Accessi. */
+export declare function collectAccessiHealthStores(options: AccessiOptions): AccessiHealthStore[];
+/** Verifica che lo schema Accessi sia inizializzato e alla versione attesa. */
+export declare function checkAccessiDatabase(options: AccessiOptions, resolveVersion?: AccessiReadinessDependencies['databaseVersion']): Promise<AccessiHealthCheckResult>;
+/**
+ * Report di readiness con lo stesso formato del servizio standalone.
+ *
+ * `bootstrap` e considerato completato: chi chiama questa funzione ha gia
+ * inizializzato il modulo. Il servizio standalone mantiene il proprio stato di
+ * bootstrap prima di delegare qui.
+ */
+export declare function checkAccessiReadiness(options: AccessiOptions, readinessChecks?: AccessiReadinessCheck[], dependencies?: AccessiReadinessDependencies): Promise<AccessiReadinessReport>;
+/** Status HTTP da usare per un report di readiness: 200 o 503. */
+export declare function readinessHttpStatus(report: AccessiReadinessReport): 200 | 503;

package/dist/accessi-module/health/readiness.js

@@ -0,0 +1,110 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiLiveReport = createAccessiLiveReport;
+exports.collectAccessiHealthStores = collectAccessiHealthStores;
+exports.checkAccessiDatabase = checkAccessiDatabase;
+exports.checkAccessiReadiness = checkAccessiReadiness;
+exports.readinessHttpStatus = readinessHttpStatus;
+const accessiSchema_1 = require("../database-updates/accessiSchema");
+const AccessiDatabaseUpdater_1 = require("../database-updates/AccessiDatabaseUpdater");
+/** Stato liveness: il processo risponde, nessun accesso a DB o store. */
+function createAccessiLiveReport() {
+    return { status: 'ok', uptimeSeconds: Math.floor(process.uptime()) };
+}
+/** Store con health check configurati nelle opzioni Accessi. */
+function collectAccessiHealthStores(options) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const stores = [];
+    const seen = new Set();
+    const add = (name, store) => {
+        if (!store || seen.has(store) || typeof store.healthCheck !== 'function')
+            return;
+        seen.add(store);
+        stores.push({ name, store });
+    };
+    add('publicAuthRateLimit', (_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.store);
+    add('serviceTokenRateLimit', (_b = options.serviceTokens) === null || _b === void 0 ? void 0 : _b.rateLimitStore);
+    add('consoleEntry', (_c = options.consoleEntry) === null || _c === void 0 ? void 0 : _c.store);
+    add('edgeRateLimit', (_d = options.edgeRateLimit) === null || _d === void 0 ? void 0 : _d.store);
+    add('sessionRevocation', (_e = options.sessionRevocation) === null || _e === void 0 ? void 0 : _e.store);
+    add('accessTokenRevocation', (_f = options.accessTokenRevocation) === null || _f === void 0 ? void 0 : _f.store);
+    add('refreshTokenRotation', (_g = options.refreshTokenRotation) === null || _g === void 0 ? void 0 : _g.store);
+    return stores;
+}
+/** Verifica che lo schema Accessi sia inizializzato e alla versione attesa. */
+function checkAccessiDatabase(options_1) {
+    return __awaiter(this, arguments, void 0, function* (options, resolveVersion = (value) => AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.getCurrentVersion(value)) {
+        try {
+            const version = yield resolveVersion(options);
+            if (!version) {
+                return { ok: false, detail: 'schema Accessi non inizializzato' };
+            }
+            return {
+                ok: true,
+                detail: version === accessiSchema_1.ACCESSI_SCHEMA_VERSION ? version : `${version} (atteso ${accessiSchema_1.ACCESSI_SCHEMA_VERSION})`,
+            };
+        }
+        catch (error) {
+            return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+        }
+    });
+}
+/**
+ * Report di readiness con lo stesso formato del servizio standalone.
+ *
+ * `bootstrap` e considerato completato: chi chiama questa funzione ha gia
+ * inizializzato il modulo. Il servizio standalone mantiene il proprio stato di
+ * bootstrap prima di delegare qui.
+ */
+function checkAccessiReadiness(options_1) {
+    return __awaiter(this, arguments, void 0, function* (options, readinessChecks = [], dependencies = {}) {
+        const checks = {
+            bootstrap: { ok: true },
+            database: yield checkAccessiDatabase(options, dependencies.databaseVersion),
+        };
+        const stores = collectAccessiHealthStores(options);
+        yield Promise.all(stores.map((_a) => __awaiter(this, [_a], void 0, function* ({ name, store }) {
+            var _b;
+            try {
+                checks[name] = { ok: Boolean(yield ((_b = store.healthCheck) === null || _b === void 0 ? void 0 : _b.call(store))) };
+            }
+            catch (error) {
+                checks[name] = {
+                    ok: false,
+                    detail: error instanceof Error ? error.message : String(error),
+                };
+            }
+        })));
+        for (const check of readinessChecks) {
+            try {
+                checks[check.name] = { ok: Boolean(yield check.check()) };
+            }
+            catch (error) {
+                checks[check.name] = {
+                    ok: false,
+                    detail: error instanceof Error ? error.message : String(error),
+                };
+            }
+        }
+        const ok = Object.values(checks).every((check) => check.ok);
+        return {
+            status: ok ? 'ok' : 'error',
+            checks,
+            timestamp: new Date().toISOString(),
+        };
+    });
+}
+/** Status HTTP da usare per un report di readiness: 200 o 503. */
+function readinessHttpStatus(report) {
+    return report.status === 'ok' ? 200 : 503;
+}
+//# sourceMappingURL=readiness.js.map

package/dist/accessi-module/health/readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.js","sourceRoot":"","sources":["../../../src/accessi-module/health/readiness.ts"],"names":[],"mappings":";;;;;;;;;;;AA6CA,0DAEC;AAGD,gEAkBC;AAGD,oDAiBC;AASD,sDAuCC;AAGD,kDAEC;AA5ID,qEAA2E;AAC3E,uFAAoF;AA0CpF,yEAAyE;AACzE,SAAgB,uBAAuB;IACrC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,gEAAgE;AAChE,SAAgB,0BAA0B,CAAC,OAAuB;;IAChE,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAEhC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAA2D,EAAQ,EAAE;QAC9F,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU;YAAE,OAAO;QACjF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,GAAG,CAAC,qBAAqB,EAAE,MAAA,OAAO,CAAC,mBAAmB,0CAAE,KAAK,CAAC,CAAC;IAC/D,GAAG,CAAC,uBAAuB,EAAE,MAAA,OAAO,CAAC,aAAa,0CAAE,cAAc,CAAC,CAAC;IACpE,GAAG,CAAC,cAAc,EAAE,MAAA,OAAO,CAAC,YAAY,0CAAE,KAAK,CAAC,CAAC;IACjD,GAAG,CAAC,eAAe,EAAE,MAAA,OAAO,CAAC,aAAa,0CAAE,KAAK,CAAC,CAAC;IACnD,GAAG,CAAC,mBAAmB,EAAE,MAAA,OAAO,CAAC,iBAAiB,0CAAE,KAAK,CAAC,CAAC;IAC3D,GAAG,CAAC,uBAAuB,EAAE,MAAA,OAAO,CAAC,qBAAqB,0CAAE,KAAK,CAAC,CAAC;IACnE,GAAG,CAAC,sBAAsB,EAAE,MAAA,OAAO,CAAC,oBAAoB,0CAAE,KAAK,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,SAAsB,oBAAoB;yDACxC,OAAuB,EACvB,iBAAkE,CAAC,KAAK,EAAE,EAAE,CAC1E,+CAAsB,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YACnE,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,OAAO,KAAK,sCAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,YAAY,sCAAsB,GAAG;aACvG,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;CAAA;AAED;;;;;;GAMG;AACH,SAAsB,qBAAqB;yDACzC,OAAuB,EACvB,kBAA2C,EAAE,EAC7C,eAA6C,EAAE;QAE/C,MAAM,MAAM,GAA6C;YACvD,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;YACvB,QAAQ,EAAE,MAAM,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,eAAe,CAAC;SAC5E,CAAC;QAEF,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAwB,EAAE,0CAAnB,EAAE,IAAI,EAAE,KAAK,EAAE;;YACjD,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAA,MAAA,KAAK,CAAC,WAAW,qDAAI,CAAA,CAAC,EAAE,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,GAAG;oBACb,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC/D,CAAC;YACJ,CAAC;QACH,CAAC,CAAA,CAAC,CAAC,CAAC;QAEJ,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;oBACnB,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YAC3B,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;CAAA;AAED,kEAAkE;AAClE,SAAgB,mBAAmB,CAAC,MAA8B;IAChE,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5C,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\nimport { ACCESSI_SCHEMA_VERSION } from '../database-updates/accessiSchema';\nimport { AccessiDatabaseUpdater } from '../database-updates/AccessiDatabaseUpdater';\n\n/**\n * Health e readiness riutilizzabili.\n *\n * Lo stesso contratto e usato da `createAccessiService` (servizio standalone) e\n * da `createAccessiHealthModule` (host Nest con `AccessiModule.forRoot`):\n * `/health/live` risponde sempre se il processo e vivo, `/health/ready` verifica\n * bootstrap, schema del database, store condivisi e check applicativi.\n */\nexport interface AccessiReadinessCheck {\n  name: string;\n  check: () => boolean | Promise<boolean>;\n}\n\nexport interface AccessiHealthCheckResult {\n  ok: boolean;\n  detail?: string;\n}\n\nexport interface AccessiReadinessReport {\n  status: 'ok' | 'error';\n  checks: Record<string, AccessiHealthCheckResult>;\n  timestamp: string;\n}\n\nexport interface AccessiLiveReport {\n  status: 'ok';\n  uptimeSeconds: number;\n}\n\n/** Store condivisi con health check, senza duplicati. */\nexport interface AccessiHealthStore {\n  name: string;\n  store: { healthCheck?: () => Promise<boolean> };\n}\n\nexport interface AccessiReadinessDependencies {\n  /** Override del check database (usato dai test o da host con pool esterni). */\n  databaseVersion?: (options: AccessiOptions) => Promise<string | null | undefined>;\n}\n\n/** Stato liveness: il processo risponde, nessun accesso a DB o store. */\nexport function createAccessiLiveReport(): AccessiLiveReport {\n  return { status: 'ok', uptimeSeconds: Math.floor(process.uptime()) };\n}\n\n/** Store con health check configurati nelle opzioni Accessi. */\nexport function collectAccessiHealthStores(options: AccessiOptions): AccessiHealthStore[] {\n  const stores: AccessiHealthStore[] = [];\n  const seen = new Set<unknown>();\n\n  const add = (name: string, store: { healthCheck?: () => Promise<boolean> } | undefined): void => {\n    if (!store || seen.has(store) || typeof store.healthCheck !== 'function') return;\n    seen.add(store);\n    stores.push({ name, store });\n  };\n\n  add('publicAuthRateLimit', options.publicAuthRateLimit?.store);\n  add('serviceTokenRateLimit', options.serviceTokens?.rateLimitStore);\n  add('consoleEntry', options.consoleEntry?.store);\n  add('edgeRateLimit', options.edgeRateLimit?.store);\n  add('sessionRevocation', options.sessionRevocation?.store);\n  add('accessTokenRevocation', options.accessTokenRevocation?.store);\n  add('refreshTokenRotation', options.refreshTokenRotation?.store);\n  return stores;\n}\n\n/** Verifica che lo schema Accessi sia inizializzato e alla versione attesa. */\nexport async function checkAccessiDatabase(\n  options: AccessiOptions,\n  resolveVersion: AccessiReadinessDependencies['databaseVersion'] = (value) =>\n    AccessiDatabaseUpdater.getCurrentVersion(value),\n): Promise<AccessiHealthCheckResult> {\n  try {\n    const version = await resolveVersion(options);\n    if (!version) {\n      return { ok: false, detail: 'schema Accessi non inizializzato' };\n    }\n    return {\n      ok: true,\n      detail: version === ACCESSI_SCHEMA_VERSION ? version : `${version} (atteso ${ACCESSI_SCHEMA_VERSION})`,\n    };\n  } catch (error) {\n    return { ok: false, detail: error instanceof Error ? error.message : String(error) };\n  }\n}\n\n/**\n * Report di readiness con lo stesso formato del servizio standalone.\n *\n * `bootstrap` e considerato completato: chi chiama questa funzione ha gia\n * inizializzato il modulo. Il servizio standalone mantiene il proprio stato di\n * bootstrap prima di delegare qui.\n */\nexport async function checkAccessiReadiness(\n  options: AccessiOptions,\n  readinessChecks: AccessiReadinessCheck[] = [],\n  dependencies: AccessiReadinessDependencies = {},\n): Promise<AccessiReadinessReport> {\n  const checks: Record<string, AccessiHealthCheckResult> = {\n    bootstrap: { ok: true },\n    database: await checkAccessiDatabase(options, dependencies.databaseVersion),\n  };\n\n  const stores = collectAccessiHealthStores(options);\n  await Promise.all(stores.map(async ({ name, store }) => {\n    try {\n      checks[name] = { ok: Boolean(await store.healthCheck?.()) };\n    } catch (error) {\n      checks[name] = {\n        ok: false,\n        detail: error instanceof Error ? error.message : String(error),\n      };\n    }\n  }));\n\n  for (const check of readinessChecks) {\n    try {\n      checks[check.name] = { ok: Boolean(await check.check()) };\n    } catch (error) {\n      checks[check.name] = {\n        ok: false,\n        detail: error instanceof Error ? error.message : String(error),\n      };\n    }\n  }\n\n  const ok = Object.values(checks).every((check) => check.ok);\n  return {\n    status: ok ? 'ok' : 'error',\n    checks,\n    timestamp: new Date().toISOString(),\n  };\n}\n\n/** Status HTTP da usare per un report di readiness: 200 o 503. */\nexport function readinessHttpStatus(report: AccessiReadinessReport): 200 | 503 {\n  return report.status === 'ok' ? 200 : 503;\n}\n"]}

package/dist/accessi-module/index.d.ts

@@ -1,10 +1,88 @@
 import { Application } from "express";
+import type { INestApplication } from "@nestjs/common";
+import type { OpenAPIObject } from "@nestjs/swagger";
 import { AccessiOptions } from "./AccessiModule";
-export declare function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<void>;
+/** Esito del bootstrap Express di Accessi. */
+export interface AccessiModuleInitializationResult {
+    /** Sotto-app Nest che serve `/api/accessi/*` e la documentazione. */
+    nestApp: INestApplication;
+    /** Documento OpenAPI generato, mergiabile nel documento unico dell'host. */
+    document: OpenAPIObject;
+}
+/**
+ * Monta il modulo Accessi in un'applicazione Express gia esistente.
+ *
+ * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza la
+ * documentazione OpenAPI, validazione ed error handler, quindi rende disponibile
+ * `authorizeAccessi` al resto dell'app.
+ * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware
+ * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.
+ *
+ * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.
+ * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.
+ * @returns Il sotto-app Nest e il documento OpenAPI generato (utile per il merge nell'host).
+ */
+export declare function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<AccessiModuleInitializationResult>;
 export { AccessiModule } from "./AccessiModule";
+export { AccessiIntrospectionController } from "./Controllers/AccessiIntrospectionController";
+export { AccessiAuditController } from "./Controllers/AccessiAuditController";
+export { FederatedAuthExchangeController } from "./federated-auth/FederatedAuthExchangeController";
+export type { AccessiTokenIntrospectionResult } from "./Services/AuthService/AuthService";
 export { AccessiDatabaseUpdater } from "./database-updates/AccessiDatabaseUpdater";
 export type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from "./AccessiModule";
+export type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from "./AccessiModule";
+export type { CatalogScriptsOptions, CatalogScriptChecksumPolicy, ConsoleEntryOptions } from "./AccessiModule";
+export { createMemoryConsoleEntryStore, createRedisConsoleEntryStore, getDefaultConsoleEntryStore } from './security/consoleEntry';
+export type { ConsoleEntryRedisClient, ConsoleEntryRecord, ConsoleEntryStore, ConsoleEntryTicket, MemoryConsoleEntryStore, RedisConsoleEntryStoreOptions } from './security/consoleEntry';
+export { createMemoryRateLimitStore, createRedisRateLimitStore, getDefaultRateLimitStore } from './security/rateLimitStore';
+export type { MemoryRateLimitStore, RateLimitDecision, RateLimitRedisClient, RateLimitStore, RedisRateLimitStoreOptions } from './security/rateLimitStore';
+export { createAccessiEdgeRateLimitMiddleware } from './security/edgeRateLimit';
+export type { AccessiEdgeRateLimitMiddleware, AccessiEdgeRateLimitOptions } from './security/edgeRateLimit';
+export { assertValidAccessiOptions, validateAccessiOptions } from './security/validateOptions';
+export { auditAccessi, configureAccessiAudit, getAccessiAuditStore, redactAccessiAuditValue, resetAccessiAudit } from './security/audit';
+export type { AccessiAuditOptions, AccessiAuditPage, AccessiAuditQuery, AccessiAuditQueryableSink, AccessiAuditRecord, AccessiAuditSink } from './security/audit';
+export { createCallbackAccessiAuditSink, createHttpAccessiAuditSink, createMemoryAccessiAuditSink, createRedisAccessiAuditSink } from './security/auditSinks';
+export type { HttpAccessiAuditSinkOptions, MemoryAccessiAuditSink, MemoryAccessiAuditSinkOptions, RedisAccessiAuditSinkOptions } from './security/auditSinks';
+export { createMemorySessionRevocationStore, createRedisSessionRevocationStore, revokeAccessiUserSessions, revokeAccessiUserSessionsIfConfigured, isAccessiTokenRevoked, getSessionRevocationStore } from './security/sessionRevocation';
+export type { MemorySessionRevocationStore, RedisSessionRevocationStoreOptions, SessionRevocationOptions, SessionRevocationRedisClient, SessionRevocationStore } from './security/sessionRevocation';
+export { createMemoryRefreshTokenRotationStore, createRedisRefreshTokenRotationStore, consumeRefreshToken, getRefreshTokenRotationStore, isRefreshTokenFamilyRevoked, revokeRefreshTokenFamily } from './security/refreshTokenRotation';
+export type { MemoryRefreshTokenRotationStore, RedisRefreshTokenRotationStoreOptions, RefreshTokenConsumeResult, RefreshTokenRotationOptions, RefreshTokenRotationRedisClient, RefreshTokenRotationStore } from './security/refreshTokenRotation';
+export { createMemoryAccessTokenRevocationStore, createRedisAccessTokenRevocationStore, getAccessTokenRevocationStore, isAccessiAccessTokenRevoked, revokeAccessiAccessToken, revokeAccessiAccessTokenIfConfigured } from './security/accessTokenRevocation';
+export type { AccessTokenRevocationOptions, AccessTokenRevocationRedisClient, AccessTokenRevocationStore, MemoryAccessTokenRevocationStore, RedisAccessTokenRevocationStoreOptions } from './security/accessTokenRevocation';
+export type { AccessiOptionsValidationIssue, AccessiOptionsValidationResult } from './security/validateOptions';
+export { AccessiCatalogMigrator, applyCatalogScripts, listPendingCatalogScripts, splitSqlStatements, analyzeCatalogScript, leadingStatementKeyword, computeCatalogScriptChecksum, discoverCatalogScripts } from "./database-updates/AccessiCatalogMigrator";
+export type { CatalogMigrationReport, CatalogScriptMigration } from "./database-updates/AccessiCatalogMigrator";
+export { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';
+export type { ServiceTokenMetadata, IssuedServiceToken, VerifiedServiceToken, IssueServiceTokenInput } from './Services/ServiceTokenService/ServiceTokenService';
+export { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';
+export type { SchemaDdlResult, SchemaDdlSection, SchemaEntitiesResult } from './Services/SchemaExportService/SchemaExportService';
+export { AdminBootstrapService } from './Services/AdminBootstrapService/AdminBootstrapService';
+export type { BootstrapAdminResult } from './Services/AdminBootstrapService/AdminBootstrapService';
+export { getOrCreateAdminBootstrapToken, getAdminBootstrapToken, clearAdminBootstrapToken, isValidAdminBootstrapToken } from './security/adminBootstrap';
+export { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';
+export { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';
+export { buildLoginAsUrl, LOGIN_AS_QUERY_PARAM } from './security/loginAs';
+export { buildAccessiJwks, createAccessiJwksHandler, getAccessiJwksPath, setupAccessiJwks } from './security/jwks';
+export type { AccessiJwksDocument, AccessiJwksKey } from './security/jwks';
+export { applyAccessiBaseSecurityHeaders, applyAccessiContentSecurityPolicy, buildAccessiContentSecurityPolicy, createAccessiSecurityHeadersMiddleware, resolveAccessiSecurityHeaders } from './security/securityHeaders';
+export type { AccessiCspDirectives, AccessiCspOptions, AccessiCspSurface, AccessiSecurityHeadersOptions, AccessiSecurityHeadersSetting, ResolvedAccessiCsp, ResolvedAccessiSecurityHeaders } from './security/securityHeaders';
+export { createAccessiAuthCookieMiddleware, resolveAccessiAuthCookieOptions, getAccessiAccessTokenFromCookie, getAccessiRefreshTokenFromCookie, setAccessiAuthCookies, clearAccessiAuthCookies, applyAccessiAuthCookies, parseAccessiCookieHeader, isAccessiCsrfExemptPath } from './security/authCookies';
+export type { AccessiAuthCookieOptions, AccessiAuthCookieSetting, AccessiAuthTokenPair, ResolvedAccessiAuthCookieOptions } from './security/authCookies';
+export { accessiMetricName, countAccessiMetric, createAccessiMetricsRegistry, getAccessiMetricsRegistry, getAccessiMetricsSink, observeAccessiMetric, recordAccessiDuration, recordAccessiMetric, renderAccessiMetrics, resetAccessiMetrics } from './observability/metrics';
+export type { AccessiMetricLabelValue, AccessiMetricLabels, AccessiMetricsOptions, AccessiMetricsRegistry, AccessiMetricsSink, AccessiMetricsSnapshot } from './observability/metrics';
+export { instrumentAccessiRedisClient } from './observability/redisMetrics';
+export type { AccessiRedisEvalClient } from './observability/redisMetrics';
+export { getAccessiAccessTokenSigningConfig, getAccessiAccessTokenVerificationConfig, getAccessiRefreshTokenSigningConfig, getAccessiRefreshTokenVerificationConfig, resolveAccessiVerificationKeys, verifyAccessiJwt } from './security/jwtTokenOptions';
+export type { AccessiJwtVerificationConfig, AccessiUnknownKeyIdEvent } from './security/jwtTokenOptions';
+export { FederatedAuthService } from './federated-auth/FederatedAuthService';
+export type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';
 export * from "./Dtos";
 export { authorizeAccessi, authenticateGen } from "./middleware/authenticateGen";
 export { accessiRequirement } from "./middleware/accessiRequirements";
+export { registerAccessiModuleServices, getAccessiModuleServices, ACCESSI_MODULE_SERVICES_LOCALS_KEY } from "./accessiRuntime";
+export type { AccessiModuleServices } from "./accessiRuntime";
 export type { AccessiAuthorizationOptions, AccessiRequirementNode, AccessiCustomRequirementContext, AccessiCustomRequirementHandler } from "./middleware/accessiRequirements";
+export { checkAccessiReadiness, checkAccessiDatabase, collectAccessiHealthStores, createAccessiLiveReport, readinessHttpStatus } from './health/readiness';
+export type { AccessiHealthCheckResult, AccessiHealthStore, AccessiLiveReport, AccessiReadinessCheck, AccessiReadinessDependencies, AccessiReadinessReport } from './health/readiness';
+export { createAccessiHealthModule } from './health/nest';
+export type { AccessiHealthModuleOptions } from './health/nest';