emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.81

package/dist/accessi-module/index.js

@@ -22,50 +22,110 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
+exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.leadingStatementKeyword = exports.analyzeCatalogScript = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.revokeAccessiAccessTokenIfConfigured = exports.revokeAccessiAccessToken = exports.isAccessiAccessTokenRevoked = exports.getAccessTokenRevocationStore = exports.createRedisAccessTokenRevocationStore = exports.createMemoryAccessTokenRevocationStore = exports.revokeRefreshTokenFamily = exports.isRefreshTokenFamilyRevoked = exports.getRefreshTokenRotationStore = exports.consumeRefreshToken = exports.createRedisRefreshTokenRotationStore = exports.createMemoryRefreshTokenRotationStore = exports.getSessionRevocationStore = exports.isAccessiTokenRevoked = exports.revokeAccessiUserSessionsIfConfigured = exports.revokeAccessiUserSessions = exports.createRedisSessionRevocationStore = exports.createMemorySessionRevocationStore = exports.createRedisAccessiAuditSink = exports.createMemoryAccessiAuditSink = exports.createHttpAccessiAuditSink = exports.createCallbackAccessiAuditSink = exports.resetAccessiAudit = exports.redactAccessiAuditValue = exports.getAccessiAuditStore = exports.configureAccessiAudit = exports.auditAccessi = exports.validateAccessiOptions = exports.assertValidAccessiOptions = exports.createAccessiEdgeRateLimitMiddleware = exports.getDefaultRateLimitStore = exports.createRedisRateLimitStore = exports.createMemoryRateLimitStore = exports.getDefaultConsoleEntryStore = exports.createRedisConsoleEntryStore = exports.createMemoryConsoleEntryStore = exports.AccessiDatabaseUpdater = exports.FederatedAuthExchangeController = exports.AccessiAuditController = exports.AccessiIntrospectionController = exports.AccessiModule = void 0;
+exports.verifyAccessiJwt = exports.resolveAccessiVerificationKeys = exports.getAccessiRefreshTokenVerificationConfig = exports.getAccessiRefreshTokenSigningConfig = exports.getAccessiAccessTokenVerificationConfig = exports.getAccessiAccessTokenSigningConfig = exports.instrumentAccessiRedisClient = exports.resetAccessiMetrics = exports.renderAccessiMetrics = exports.recordAccessiMetric = exports.recordAccessiDuration = exports.observeAccessiMetric = exports.getAccessiMetricsSink = exports.getAccessiMetricsRegistry = exports.createAccessiMetricsRegistry = exports.countAccessiMetric = exports.accessiMetricName = exports.isAccessiCsrfExemptPath = exports.parseAccessiCookieHeader = exports.applyAccessiAuthCookies = exports.clearAccessiAuthCookies = exports.setAccessiAuthCookies = exports.getAccessiRefreshTokenFromCookie = exports.getAccessiAccessTokenFromCookie = exports.resolveAccessiAuthCookieOptions = exports.createAccessiAuthCookieMiddleware = exports.resolveAccessiSecurityHeaders = exports.createAccessiSecurityHeadersMiddleware = exports.buildAccessiContentSecurityPolicy = exports.applyAccessiContentSecurityPolicy = exports.applyAccessiBaseSecurityHeaders = exports.setupAccessiJwks = exports.getAccessiJwksPath = exports.createAccessiJwksHandler = exports.buildAccessiJwks = exports.LOGIN_AS_QUERY_PARAM = exports.buildLoginAsUrl = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.isValidAdminBootstrapToken = exports.clearAdminBootstrapToken = exports.getAdminBootstrapToken = exports.getOrCreateAdminBootstrapToken = exports.AdminBootstrapService = exports.SchemaExportService = void 0;
+exports.createAccessiHealthModule = exports.readinessHttpStatus = exports.createAccessiLiveReport = exports.collectAccessiHealthStores = exports.checkAccessiDatabase = exports.checkAccessiReadiness = exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = void 0;
 exports.initializeAccessiModule = initializeAccessiModule;
-const common_1 = require("@nestjs/common");
+const express_1 = __importDefault(require("express"));
 const core_1 = require("@nestjs/core");
 const platform_express_1 = require("@nestjs/platform-express");
 const AccessiModule_1 = require("./AccessiModule");
 const Logger_1 = require("../Logger");
 const AuthService_1 = require("./Services/AuthService/AuthService");
+const OpenApiConfig_1 = require("../openapi/OpenApiConfig");
 const authenticateGen_1 = require("./middleware/authenticateGen");
+const accessiRuntime_1 = require("./accessiRuntime");
+const startupLog_1 = require("./startupLog");
+const accessiValidation_1 = require("./security/accessiValidation");
+const AccessiHttpExceptionFilter_1 = require("./security/AccessiHttpExceptionFilter");
+const emailConfiguration_1 = require("./security/emailConfiguration");
+const jwks_1 = require("./security/jwks");
+const edgeRateLimit_1 = require("./security/edgeRateLimit");
+const securityHeaders_1 = require("./security/securityHeaders");
+const authCookies_1 = require("./security/authCookies");
 function describeDatabaseTarget(options) {
     var _a, _b, _c, _d;
     const dbOptions = options.databaseOptions;
     return `${(_a = dbOptions.host) !== null && _a !== void 0 ? _a : "?"}:${(_b = dbOptions.port) !== null && _b !== void 0 ? _b : "?"} -> ${(_c = dbOptions.database) !== null && _c !== void 0 ? _c : "?"} as ${(_d = dbOptions.user) !== null && _d !== void 0 ? _d : "?"}`;
 }
+/**
+ * Monta il modulo Accessi in un'applicazione Express gia esistente.
+ *
+ * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza la
+ * documentazione OpenAPI, validazione ed error handler, quindi rende disponibile
+ * `authorizeAccessi` al resto dell'app.
+ * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware
+ * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.
+ *
+ * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.
+ * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.
+ * @returns Il sotto-app Nest e il documento OpenAPI generato (utile per il merge nell'host).
+ */
 function initializeAccessiModule(app, options) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f, _g;
+        // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.
+        (0, emailConfiguration_1.assertEmailConfigured)(options);
         const logger = new Logger_1.Logger("initializeAccessiModule");
         (0, authenticateGen_1.beginAccessiAuthInitialization)();
         const startedAt = performance.now();
+        const resolvedOpenApi = (0, OpenApiConfig_1.resolveAccessiOpenApiOptions)(options.openapi);
         try {
             logger.info("Inizializzazione modulo accessi avviata.");
             logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);
             logger.info(`Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`);
-            // Creiamo un'istanza Express separata per NestJS
-            const nestExpressInstance = new platform_express_1.ExpressAdapter(app);
-            // Creiamo l'app NestJS attaccata a Express
-            const nestApp = yield core_1.NestFactory.create(AccessiModule_1.AccessiModule.forRoot(options), nestExpressInstance, {
-                bufferLogs: true
+            const nestHostApp = (0, express_1.default)();
+            if (((_a = options.http) === null || _a === void 0 ? void 0 : _a.trustProxy) !== undefined) {
+                app.set('trust proxy', options.http.trustProxy);
+                nestHostApp.set('trust proxy', options.http.trustProxy);
+            }
+            const jwksPath = (0, jwks_1.getAccessiJwksPath)(options);
+            const isAccessiRoute = (path) => path === "/api/accessi" ||
+                path.startsWith("/api/accessi/") ||
+                (0, OpenApiConfig_1.isOpenApiRequestPath)(path, resolvedOpenApi) ||
+                (jwksPath !== undefined && path === jwksPath);
+            const edgeRateLimit = options.edgeRateLimit
+                ? (0, edgeRateLimit_1.createAccessiEdgeRateLimitMiddleware)(Object.assign(Object.assign({}, options.edgeRateLimit), { match: (_b = options.edgeRateLimit.match) !== null && _b !== void 0 ? _b : ((path) => isAccessiRoute(path)) }))
+                : undefined;
+            if (edgeRateLimit) {
+                app.use(edgeRateLimit);
+            }
+            const authCookie = (0, authCookies_1.createAccessiAuthCookieMiddleware)(options, isAccessiRoute);
+            if (authCookie) {
+                app.use(authCookie);
+            }
+            if (((_c = options.http) === null || _c === void 0 ? void 0 : _c.securityHeaders) !== false) {
+                const securityHeaders = (0, securityHeaders_1.createAccessiSecurityHeadersMiddleware)((_d = options.http) === null || _d === void 0 ? void 0 : _d.securityHeaders, isAccessiRoute, { isOpenApiUi: (path) => (0, OpenApiConfig_1.isOpenApiRequestPath)(path, resolvedOpenApi) });
+                if (securityHeaders) {
+                    app.use(securityHeaders);
+                }
+            }
+            app.use((req, res, next) => {
+                if (!isAccessiRoute(req.path)) {
+                    return next();
+                }
+                return nestHostApp(req, res, next);
             });
+            (0, jwks_1.setupAccessiJwks)(app, options);
+            if (jwksPath) {
+                logger.info(`JWKS accessi disponibile su: ${jwksPath}`);
+            }
+            const nestExpressInstance = new platform_express_1.ExpressAdapter(nestHostApp);
+            const nestApp = yield core_1.NestFactory.create(AccessiModule_1.AccessiModule.forRoot(options), nestExpressInstance, Object.assign({ bufferLogs: options.bufferLogs !== false }, (options.logger ? { logger: options.logger } : {})));
             logger.info("Applicazione Nest accessi creata.");
-            nestApp.enableCors();
-            nestApp.useGlobalPipes(new common_1.ValidationPipe({
-                whitelist: true,
-                forbidNonWhitelisted: true,
-                transform: true,
-                transformOptions: {
-                    enableImplicitConversion: true,
-                },
-            }));
+            if (((_e = options.http) === null || _e === void 0 ? void 0 : _e.cors) !== false) {
+                nestApp.enableCors((_g = (_f = options.http) === null || _f === void 0 ? void 0 : _f.cors) !== null && _g !== void 0 ? _g : { exposedHeaders: ['X-Total-Count', 'X-CSRF-Token'] });
+            }
+            nestApp.useGlobalPipes((0, accessiValidation_1.createAccessiValidationPipe)());
+            nestApp.useGlobalFilters(new AccessiHttpExceptionFilter_1.AccessiHttpExceptionFilter());
             nestApp.setGlobalPrefix('api', {
-                exclude: ['/swagger', '/swagger/(.*)']
+                exclude: (0, OpenApiConfig_1.buildOpenApiExcludePaths)(resolvedOpenApi)
             });
-            // Note: Swagger setup is now handled by the unified module
+            const document = (0, OpenApiConfig_1.setupOpenApi)(nestApp, resolvedOpenApi);
             logger.info("Avvio init del modulo accessi.");
             yield nestApp.init();
             logger.info("Init del modulo accessi completata.");
@@ -75,27 +135,169 @@ function initializeAccessiModule(app, options) {
                 yield passwordMigrationService.migrateLegacyEncryptedPasswords();
                 logger.info("Migrazione password legacy accessi completata.");
             }
-            const accessiAuthService = nestApp.get(authenticateGen_1.AuthenticateGenService);
-            app.locals.accessiAuthService = accessiAuthService;
-            (0, authenticateGen_1.setAccessiAuthService)(accessiAuthService);
+            const accessiServices = (0, accessiRuntime_1.registerAccessiModuleServices)(app, nestApp);
+            app.locals.accessiAuthService = accessiServices.authenticateGenService;
+            (0, authenticateGen_1.setAccessiAuthService)(accessiServices.authenticateGenService);
+            (0, startupLog_1.logAccessiStartup)(options, resolvedOpenApi);
             const elapsedMs = performance.now() - startedAt;
             logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);
+            return { nestApp, document };
         }
         catch (error) {
             (0, authenticateGen_1.failAccessiAuthInitialization)(error);
-            logger.error("Errore in initialize AccessiModule:", error);
+            logger.error("Errore in initialize AccessiModule:", error instanceof Error
+                ? { name: error.name, message: error.message, stack: error.stack }
+                : { error: String(error) });
             throw error;
         }
     });
 }
 var AccessiModule_2 = require("./AccessiModule");
 Object.defineProperty(exports, "AccessiModule", { enumerable: true, get: function () { return AccessiModule_2.AccessiModule; } });
+var AccessiIntrospectionController_1 = require("./Controllers/AccessiIntrospectionController");
+Object.defineProperty(exports, "AccessiIntrospectionController", { enumerable: true, get: function () { return AccessiIntrospectionController_1.AccessiIntrospectionController; } });
+var AccessiAuditController_1 = require("./Controllers/AccessiAuditController");
+Object.defineProperty(exports, "AccessiAuditController", { enumerable: true, get: function () { return AccessiAuditController_1.AccessiAuditController; } });
+var FederatedAuthExchangeController_1 = require("./federated-auth/FederatedAuthExchangeController");
+Object.defineProperty(exports, "FederatedAuthExchangeController", { enumerable: true, get: function () { return FederatedAuthExchangeController_1.FederatedAuthExchangeController; } });
 var AccessiDatabaseUpdater_1 = require("./database-updates/AccessiDatabaseUpdater");
 Object.defineProperty(exports, "AccessiDatabaseUpdater", { enumerable: true, get: function () { return AccessiDatabaseUpdater_1.AccessiDatabaseUpdater; } });
+var consoleEntry_1 = require("./security/consoleEntry");
+Object.defineProperty(exports, "createMemoryConsoleEntryStore", { enumerable: true, get: function () { return consoleEntry_1.createMemoryConsoleEntryStore; } });
+Object.defineProperty(exports, "createRedisConsoleEntryStore", { enumerable: true, get: function () { return consoleEntry_1.createRedisConsoleEntryStore; } });
+Object.defineProperty(exports, "getDefaultConsoleEntryStore", { enumerable: true, get: function () { return consoleEntry_1.getDefaultConsoleEntryStore; } });
+var rateLimitStore_1 = require("./security/rateLimitStore");
+Object.defineProperty(exports, "createMemoryRateLimitStore", { enumerable: true, get: function () { return rateLimitStore_1.createMemoryRateLimitStore; } });
+Object.defineProperty(exports, "createRedisRateLimitStore", { enumerable: true, get: function () { return rateLimitStore_1.createRedisRateLimitStore; } });
+Object.defineProperty(exports, "getDefaultRateLimitStore", { enumerable: true, get: function () { return rateLimitStore_1.getDefaultRateLimitStore; } });
+var edgeRateLimit_2 = require("./security/edgeRateLimit");
+Object.defineProperty(exports, "createAccessiEdgeRateLimitMiddleware", { enumerable: true, get: function () { return edgeRateLimit_2.createAccessiEdgeRateLimitMiddleware; } });
+var validateOptions_1 = require("./security/validateOptions");
+Object.defineProperty(exports, "assertValidAccessiOptions", { enumerable: true, get: function () { return validateOptions_1.assertValidAccessiOptions; } });
+Object.defineProperty(exports, "validateAccessiOptions", { enumerable: true, get: function () { return validateOptions_1.validateAccessiOptions; } });
+var audit_1 = require("./security/audit");
+Object.defineProperty(exports, "auditAccessi", { enumerable: true, get: function () { return audit_1.auditAccessi; } });
+Object.defineProperty(exports, "configureAccessiAudit", { enumerable: true, get: function () { return audit_1.configureAccessiAudit; } });
+Object.defineProperty(exports, "getAccessiAuditStore", { enumerable: true, get: function () { return audit_1.getAccessiAuditStore; } });
+Object.defineProperty(exports, "redactAccessiAuditValue", { enumerable: true, get: function () { return audit_1.redactAccessiAuditValue; } });
+Object.defineProperty(exports, "resetAccessiAudit", { enumerable: true, get: function () { return audit_1.resetAccessiAudit; } });
+var auditSinks_1 = require("./security/auditSinks");
+Object.defineProperty(exports, "createCallbackAccessiAuditSink", { enumerable: true, get: function () { return auditSinks_1.createCallbackAccessiAuditSink; } });
+Object.defineProperty(exports, "createHttpAccessiAuditSink", { enumerable: true, get: function () { return auditSinks_1.createHttpAccessiAuditSink; } });
+Object.defineProperty(exports, "createMemoryAccessiAuditSink", { enumerable: true, get: function () { return auditSinks_1.createMemoryAccessiAuditSink; } });
+Object.defineProperty(exports, "createRedisAccessiAuditSink", { enumerable: true, get: function () { return auditSinks_1.createRedisAccessiAuditSink; } });
+var sessionRevocation_1 = require("./security/sessionRevocation");
+Object.defineProperty(exports, "createMemorySessionRevocationStore", { enumerable: true, get: function () { return sessionRevocation_1.createMemorySessionRevocationStore; } });
+Object.defineProperty(exports, "createRedisSessionRevocationStore", { enumerable: true, get: function () { return sessionRevocation_1.createRedisSessionRevocationStore; } });
+Object.defineProperty(exports, "revokeAccessiUserSessions", { enumerable: true, get: function () { return sessionRevocation_1.revokeAccessiUserSessions; } });
+Object.defineProperty(exports, "revokeAccessiUserSessionsIfConfigured", { enumerable: true, get: function () { return sessionRevocation_1.revokeAccessiUserSessionsIfConfigured; } });
+Object.defineProperty(exports, "isAccessiTokenRevoked", { enumerable: true, get: function () { return sessionRevocation_1.isAccessiTokenRevoked; } });
+Object.defineProperty(exports, "getSessionRevocationStore", { enumerable: true, get: function () { return sessionRevocation_1.getSessionRevocationStore; } });
+var refreshTokenRotation_1 = require("./security/refreshTokenRotation");
+Object.defineProperty(exports, "createMemoryRefreshTokenRotationStore", { enumerable: true, get: function () { return refreshTokenRotation_1.createMemoryRefreshTokenRotationStore; } });
+Object.defineProperty(exports, "createRedisRefreshTokenRotationStore", { enumerable: true, get: function () { return refreshTokenRotation_1.createRedisRefreshTokenRotationStore; } });
+Object.defineProperty(exports, "consumeRefreshToken", { enumerable: true, get: function () { return refreshTokenRotation_1.consumeRefreshToken; } });
+Object.defineProperty(exports, "getRefreshTokenRotationStore", { enumerable: true, get: function () { return refreshTokenRotation_1.getRefreshTokenRotationStore; } });
+Object.defineProperty(exports, "isRefreshTokenFamilyRevoked", { enumerable: true, get: function () { return refreshTokenRotation_1.isRefreshTokenFamilyRevoked; } });
+Object.defineProperty(exports, "revokeRefreshTokenFamily", { enumerable: true, get: function () { return refreshTokenRotation_1.revokeRefreshTokenFamily; } });
+var accessTokenRevocation_1 = require("./security/accessTokenRevocation");
+Object.defineProperty(exports, "createMemoryAccessTokenRevocationStore", { enumerable: true, get: function () { return accessTokenRevocation_1.createMemoryAccessTokenRevocationStore; } });
+Object.defineProperty(exports, "createRedisAccessTokenRevocationStore", { enumerable: true, get: function () { return accessTokenRevocation_1.createRedisAccessTokenRevocationStore; } });
+Object.defineProperty(exports, "getAccessTokenRevocationStore", { enumerable: true, get: function () { return accessTokenRevocation_1.getAccessTokenRevocationStore; } });
+Object.defineProperty(exports, "isAccessiAccessTokenRevoked", { enumerable: true, get: function () { return accessTokenRevocation_1.isAccessiAccessTokenRevoked; } });
+Object.defineProperty(exports, "revokeAccessiAccessToken", { enumerable: true, get: function () { return accessTokenRevocation_1.revokeAccessiAccessToken; } });
+Object.defineProperty(exports, "revokeAccessiAccessTokenIfConfigured", { enumerable: true, get: function () { return accessTokenRevocation_1.revokeAccessiAccessTokenIfConfigured; } });
+var AccessiCatalogMigrator_1 = require("./database-updates/AccessiCatalogMigrator");
+Object.defineProperty(exports, "AccessiCatalogMigrator", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.AccessiCatalogMigrator; } });
+Object.defineProperty(exports, "applyCatalogScripts", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.applyCatalogScripts; } });
+Object.defineProperty(exports, "listPendingCatalogScripts", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.listPendingCatalogScripts; } });
+Object.defineProperty(exports, "splitSqlStatements", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.splitSqlStatements; } });
+Object.defineProperty(exports, "analyzeCatalogScript", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.analyzeCatalogScript; } });
+Object.defineProperty(exports, "leadingStatementKeyword", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.leadingStatementKeyword; } });
+Object.defineProperty(exports, "computeCatalogScriptChecksum", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.computeCatalogScriptChecksum; } });
+Object.defineProperty(exports, "discoverCatalogScripts", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.discoverCatalogScripts; } });
+var ServiceTokenService_1 = require("./Services/ServiceTokenService/ServiceTokenService");
+Object.defineProperty(exports, "ServiceTokenService", { enumerable: true, get: function () { return ServiceTokenService_1.ServiceTokenService; } });
+var SchemaExportService_1 = require("./Services/SchemaExportService/SchemaExportService");
+Object.defineProperty(exports, "SchemaExportService", { enumerable: true, get: function () { return SchemaExportService_1.SchemaExportService; } });
+var AdminBootstrapService_1 = require("./Services/AdminBootstrapService/AdminBootstrapService");
+Object.defineProperty(exports, "AdminBootstrapService", { enumerable: true, get: function () { return AdminBootstrapService_1.AdminBootstrapService; } });
+var adminBootstrap_1 = require("./security/adminBootstrap");
+Object.defineProperty(exports, "getOrCreateAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.getOrCreateAdminBootstrapToken; } });
+Object.defineProperty(exports, "getAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.getAdminBootstrapToken; } });
+Object.defineProperty(exports, "clearAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.clearAdminBootstrapToken; } });
+Object.defineProperty(exports, "isValidAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.isValidAdminBootstrapToken; } });
+var serviceTokenGuard_1 = require("./security/serviceTokenGuard");
+Object.defineProperty(exports, "ServiceTokenGuard", { enumerable: true, get: function () { return serviceTokenGuard_1.ServiceTokenGuard; } });
+Object.defineProperty(exports, "RequireServiceTokenScopes", { enumerable: true, get: function () { return serviceTokenGuard_1.RequireServiceTokenScopes; } });
+Object.defineProperty(exports, "getAccessiServiceToken", { enumerable: true, get: function () { return serviceTokenGuard_1.getAccessiServiceToken; } });
+var emailConfiguration_2 = require("./security/emailConfiguration");
+Object.defineProperty(exports, "assertEmailConfigured", { enumerable: true, get: function () { return emailConfiguration_2.assertEmailConfigured; } });
+Object.defineProperty(exports, "isEmailConfigured", { enumerable: true, get: function () { return emailConfiguration_2.isEmailConfigured; } });
+Object.defineProperty(exports, "AccessiEmailNotConfiguredError", { enumerable: true, get: function () { return emailConfiguration_2.AccessiEmailNotConfiguredError; } });
+Object.defineProperty(exports, "ACCESSI_EMAIL_NOT_CONFIGURED", { enumerable: true, get: function () { return emailConfiguration_2.ACCESSI_EMAIL_NOT_CONFIGURED; } });
+var loginAs_1 = require("./security/loginAs");
+Object.defineProperty(exports, "buildLoginAsUrl", { enumerable: true, get: function () { return loginAs_1.buildLoginAsUrl; } });
+Object.defineProperty(exports, "LOGIN_AS_QUERY_PARAM", { enumerable: true, get: function () { return loginAs_1.LOGIN_AS_QUERY_PARAM; } });
+var jwks_2 = require("./security/jwks");
+Object.defineProperty(exports, "buildAccessiJwks", { enumerable: true, get: function () { return jwks_2.buildAccessiJwks; } });
+Object.defineProperty(exports, "createAccessiJwksHandler", { enumerable: true, get: function () { return jwks_2.createAccessiJwksHandler; } });
+Object.defineProperty(exports, "getAccessiJwksPath", { enumerable: true, get: function () { return jwks_2.getAccessiJwksPath; } });
+Object.defineProperty(exports, "setupAccessiJwks", { enumerable: true, get: function () { return jwks_2.setupAccessiJwks; } });
+var securityHeaders_2 = require("./security/securityHeaders");
+Object.defineProperty(exports, "applyAccessiBaseSecurityHeaders", { enumerable: true, get: function () { return securityHeaders_2.applyAccessiBaseSecurityHeaders; } });
+Object.defineProperty(exports, "applyAccessiContentSecurityPolicy", { enumerable: true, get: function () { return securityHeaders_2.applyAccessiContentSecurityPolicy; } });
+Object.defineProperty(exports, "buildAccessiContentSecurityPolicy", { enumerable: true, get: function () { return securityHeaders_2.buildAccessiContentSecurityPolicy; } });
+Object.defineProperty(exports, "createAccessiSecurityHeadersMiddleware", { enumerable: true, get: function () { return securityHeaders_2.createAccessiSecurityHeadersMiddleware; } });
+Object.defineProperty(exports, "resolveAccessiSecurityHeaders", { enumerable: true, get: function () { return securityHeaders_2.resolveAccessiSecurityHeaders; } });
+var authCookies_2 = require("./security/authCookies");
+Object.defineProperty(exports, "createAccessiAuthCookieMiddleware", { enumerable: true, get: function () { return authCookies_2.createAccessiAuthCookieMiddleware; } });
+Object.defineProperty(exports, "resolveAccessiAuthCookieOptions", { enumerable: true, get: function () { return authCookies_2.resolveAccessiAuthCookieOptions; } });
+Object.defineProperty(exports, "getAccessiAccessTokenFromCookie", { enumerable: true, get: function () { return authCookies_2.getAccessiAccessTokenFromCookie; } });
+Object.defineProperty(exports, "getAccessiRefreshTokenFromCookie", { enumerable: true, get: function () { return authCookies_2.getAccessiRefreshTokenFromCookie; } });
+Object.defineProperty(exports, "setAccessiAuthCookies", { enumerable: true, get: function () { return authCookies_2.setAccessiAuthCookies; } });
+Object.defineProperty(exports, "clearAccessiAuthCookies", { enumerable: true, get: function () { return authCookies_2.clearAccessiAuthCookies; } });
+Object.defineProperty(exports, "applyAccessiAuthCookies", { enumerable: true, get: function () { return authCookies_2.applyAccessiAuthCookies; } });
+Object.defineProperty(exports, "parseAccessiCookieHeader", { enumerable: true, get: function () { return authCookies_2.parseAccessiCookieHeader; } });
+Object.defineProperty(exports, "isAccessiCsrfExemptPath", { enumerable: true, get: function () { return authCookies_2.isAccessiCsrfExemptPath; } });
+var metrics_1 = require("./observability/metrics");
+Object.defineProperty(exports, "accessiMetricName", { enumerable: true, get: function () { return metrics_1.accessiMetricName; } });
+Object.defineProperty(exports, "countAccessiMetric", { enumerable: true, get: function () { return metrics_1.countAccessiMetric; } });
+Object.defineProperty(exports, "createAccessiMetricsRegistry", { enumerable: true, get: function () { return metrics_1.createAccessiMetricsRegistry; } });
+Object.defineProperty(exports, "getAccessiMetricsRegistry", { enumerable: true, get: function () { return metrics_1.getAccessiMetricsRegistry; } });
+Object.defineProperty(exports, "getAccessiMetricsSink", { enumerable: true, get: function () { return metrics_1.getAccessiMetricsSink; } });
+Object.defineProperty(exports, "observeAccessiMetric", { enumerable: true, get: function () { return metrics_1.observeAccessiMetric; } });
+Object.defineProperty(exports, "recordAccessiDuration", { enumerable: true, get: function () { return metrics_1.recordAccessiDuration; } });
+Object.defineProperty(exports, "recordAccessiMetric", { enumerable: true, get: function () { return metrics_1.recordAccessiMetric; } });
+Object.defineProperty(exports, "renderAccessiMetrics", { enumerable: true, get: function () { return metrics_1.renderAccessiMetrics; } });
+Object.defineProperty(exports, "resetAccessiMetrics", { enumerable: true, get: function () { return metrics_1.resetAccessiMetrics; } });
+var redisMetrics_1 = require("./observability/redisMetrics");
+Object.defineProperty(exports, "instrumentAccessiRedisClient", { enumerable: true, get: function () { return redisMetrics_1.instrumentAccessiRedisClient; } });
+var jwtTokenOptions_1 = require("./security/jwtTokenOptions");
+Object.defineProperty(exports, "getAccessiAccessTokenSigningConfig", { enumerable: true, get: function () { return jwtTokenOptions_1.getAccessiAccessTokenSigningConfig; } });
+Object.defineProperty(exports, "getAccessiAccessTokenVerificationConfig", { enumerable: true, get: function () { return jwtTokenOptions_1.getAccessiAccessTokenVerificationConfig; } });
+Object.defineProperty(exports, "getAccessiRefreshTokenSigningConfig", { enumerable: true, get: function () { return jwtTokenOptions_1.getAccessiRefreshTokenSigningConfig; } });
+Object.defineProperty(exports, "getAccessiRefreshTokenVerificationConfig", { enumerable: true, get: function () { return jwtTokenOptions_1.getAccessiRefreshTokenVerificationConfig; } });
+Object.defineProperty(exports, "resolveAccessiVerificationKeys", { enumerable: true, get: function () { return jwtTokenOptions_1.resolveAccessiVerificationKeys; } });
+Object.defineProperty(exports, "verifyAccessiJwt", { enumerable: true, get: function () { return jwtTokenOptions_1.verifyAccessiJwt; } });
+var FederatedAuthService_1 = require("./federated-auth/FederatedAuthService");
+Object.defineProperty(exports, "FederatedAuthService", { enumerable: true, get: function () { return FederatedAuthService_1.FederatedAuthService; } });
 __exportStar(require("./Dtos"), exports);
 var authenticateGen_2 = require("./middleware/authenticateGen");
 Object.defineProperty(exports, "authorizeAccessi", { enumerable: true, get: function () { return authenticateGen_2.authorizeAccessi; } });
 Object.defineProperty(exports, "authenticateGen", { enumerable: true, get: function () { return authenticateGen_2.authenticateGen; } });
 var accessiRequirements_1 = require("./middleware/accessiRequirements");
 Object.defineProperty(exports, "accessiRequirement", { enumerable: true, get: function () { return accessiRequirements_1.accessiRequirement; } });
+var accessiRuntime_2 = require("./accessiRuntime");
+Object.defineProperty(exports, "registerAccessiModuleServices", { enumerable: true, get: function () { return accessiRuntime_2.registerAccessiModuleServices; } });
+Object.defineProperty(exports, "getAccessiModuleServices", { enumerable: true, get: function () { return accessiRuntime_2.getAccessiModuleServices; } });
+Object.defineProperty(exports, "ACCESSI_MODULE_SERVICES_LOCALS_KEY", { enumerable: true, get: function () { return accessiRuntime_2.ACCESSI_MODULE_SERVICES_LOCALS_KEY; } });
+var readiness_1 = require("./health/readiness");
+Object.defineProperty(exports, "checkAccessiReadiness", { enumerable: true, get: function () { return readiness_1.checkAccessiReadiness; } });
+Object.defineProperty(exports, "checkAccessiDatabase", { enumerable: true, get: function () { return readiness_1.checkAccessiDatabase; } });
+Object.defineProperty(exports, "collectAccessiHealthStores", { enumerable: true, get: function () { return readiness_1.collectAccessiHealthStores; } });
+Object.defineProperty(exports, "createAccessiLiveReport", { enumerable: true, get: function () { return readiness_1.createAccessiLiveReport; } });
+Object.defineProperty(exports, "readinessHttpStatus", { enumerable: true, get: function () { return readiness_1.readinessHttpStatus; } });
+var nest_1 = require("./health/nest");
+Object.defineProperty(exports, "createAccessiHealthModule", { enumerable: true, get: function () { return nest_1.createAccessiHealthModule; } });
 //# sourceMappingURL=index.js.map

package/dist/accessi-module/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,0DA0DC;AAlFD,2CAAgD;AAChD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,kEAKsC;AAEtC,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,iDAAiD;YACjD,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,GAAG,CAAC,CAAC;YAEpD,2CAA2C;YAC3C,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,CAAC,cAAc,CAClB,IAAI,uBAAc,CAAC;gBACf,SAAS,EAAE,IAAI;gBACf,oBAAoB,EAAE,IAAI;gBAC1B,SAAS,EAAE,IAAI;gBACf,gBAAgB,EAAE;oBACd,wBAAwB,EAAE,IAAI;iBACjC;aACJ,CAAC,CACL,CAAC;YAEF,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;aACzC,CAAC,CAAC;YAEH,2DAA2D;YAC3D,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,wCAAsB,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACnD,IAAA,uCAAqB,EAAC,kBAAkB,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC3D,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAE/B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA","sourcesContent":["import { Application } from \"express\";\r\nimport { ValidationPipe } from \"@nestjs/common\";\r\nimport { NestFactory } from \"@nestjs/core\";\r\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\r\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\r\nimport { Logger } from \"../Logger\";\r\nimport { AuthService } from \"./Services/AuthService/AuthService\";\r\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    AuthenticateGenService,\n    setAccessiAuthService\n} from \"./middleware/authenticateGen\";\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n    const dbOptions = options.databaseOptions as {\n        host?: string;\n        port?: number;\n        database?: string;\n        user?: string;\n    };\n\n    return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions) {\n    const logger: Logger = new Logger(\"initializeAccessiModule\");\n    beginAccessiAuthInitialization();\n    const startedAt = performance.now();\n\n    try {\n        logger.info(\"Inizializzazione modulo accessi avviata.\");\n        logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n        logger.info(\n            `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n        );\n        // Creiamo un'istanza Express separata per NestJS\n        const nestExpressInstance = new ExpressAdapter(app);\n\n        // Creiamo l'app NestJS attaccata a Express\n        const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: true\n        });\n        logger.info(\"Applicazione Nest accessi creata.\");\n\n        nestApp.enableCors();\n        nestApp.useGlobalPipes(\n            new ValidationPipe({\n                whitelist: true,\r\n                forbidNonWhitelisted: true,\r\n                transform: true,\r\n                transformOptions: {\r\n                    enableImplicitConversion: true,\r\n                },\r\n            }),\r\n        );\r\n\r\n        nestApp.setGlobalPrefix('api', {\n            exclude: ['/swagger', '/swagger/(.*)']\n        });\n\n        // Note: Swagger setup is now handled by the unified module\n        logger.info(\"Avvio init del modulo accessi.\");\n        await nestApp.init();\n        logger.info(\"Init del modulo accessi completata.\");\n        if (options.legacyPasswordMigrationOnStartup !== false) {\n            logger.info(\"Avvio migrazione password legacy accessi.\");\n            const passwordMigrationService = nestApp.get(AuthService);\n            await passwordMigrationService.migrateLegacyEncryptedPasswords();\n            logger.info(\"Migrazione password legacy accessi completata.\");\n        }\n\n        const accessiAuthService = nestApp.get(AuthenticateGenService);\n        app.locals.accessiAuthService = accessiAuthService;\n        setAccessiAuthService(accessiAuthService);\n        const elapsedMs = performance.now() - startedAt;\n        logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n    } catch (error) {\n        failAccessiAuthInitialization(error);\n        logger.error(\"Errore in initialize AccessiModule:\", error);\n        throw error;\r\n    }\r\n}\r\n\r\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport * from \"./Dtos\";\nexport {\r\n    authorizeAccessi,\r\n    authenticateGen\r\n} from \"./middleware/authenticateGen\";\r\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\r\nexport type {\r\n    AccessiAuthorizationOptions,\r\n    AccessiRequirementNode,\r\n    AccessiCustomRequirementContext,\r\n    AccessiCustomRequirementHandler\r\n} from \"./middleware/accessiRequirements\";\r\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,0DAgHC;AA7KD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAG1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAKkC;AAClC,kEAIsC;AACtC,qDAAiE;AACjE,6CAAiD;AACjD,oEAA2E;AAC3E,sFAAmF;AACnF,sEAAsE;AACtE,0CAAuE;AACvE,4DAAgF;AAChF,gEAAoF;AACpF,wDAA2E;AAU3E,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAsB,uBAAuB,CACzC,GAAgB,EAChB,OAAuB;;;QAEvB,yFAAyF;QACzF,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,eAAe,GAAG,IAAA,4CAA4B,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEtE,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,IAAI,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,UAAU,MAAK,SAAS,EAAE,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChD,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CACpC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAA,oCAAoB,EAAC,IAAI,EAAE,eAAe,CAAC;gBAC3C,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa;gBACvC,CAAC,CAAC,IAAA,oDAAoC,kCAC/B,OAAO,CAAC,aAAa,KACxB,KAAK,EAAE,MAAA,OAAO,CAAC,aAAa,CAAC,KAAK,mCAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IACxE;gBACF,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,aAAa,EAAE,CAAC;gBAChB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,UAAU,GAAG,IAAA,+CAAiC,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC9E,IAAI,UAAU,EAAE,CAAC;gBACb,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,eAAe,MAAK,KAAK,EAAE,CAAC;gBAC1C,MAAM,eAAe,GAAG,IAAA,wDAAsC,EAC1D,MAAA,OAAO,CAAC,IAAI,0CAAE,eAAe,EAC7B,cAAc,EACd,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,oCAAoB,EAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CACzE,CAAC;gBACF,IAAI,eAAe,EAAE,CAAC;oBAClB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7B,CAAC;YACL,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,IAAA,uBAAgB,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,kBACxF,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,KAAK,IACrC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACvD,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,IAAI,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,IAAI,MAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO,CAAC,UAAU,CAAC,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,IAAI,mCAAI,EAAE,cAAc,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,IAAA,wCAAwB,EAAC,eAAe,CAAC;aACrD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAA,4BAAY,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,eAAe,GAAG,IAAA,8CAA6B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,eAAe,CAAC,sBAAsB,CAAC;YACvE,IAAA,uCAAqB,EAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;YAC9D,IAAA,8BAAiB,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAEvF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,+FAA8F;AAArF,gJAAA,8BAA8B,OAAA;AACvC,+EAA8E;AAArE,gIAAA,sBAAsB,OAAA;AAC/B,oGAAmG;AAA1F,kJAAA,+BAA+B,OAAA;AAExC,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAI/B,wDAIiC;AAH7B,6HAAA,6BAA6B,OAAA;AAC7B,4HAAA,4BAA4B,OAAA;AAC5B,2HAAA,2BAA2B,OAAA;AAU/B,4DAImC;AAH/B,4HAAA,0BAA0B,OAAA;AAC1B,2HAAA,yBAAyB,OAAA;AACzB,0HAAA,wBAAwB,OAAA;AAS5B,0DAAgF;AAAvE,qIAAA,oCAAoC,OAAA;AAK7C,8DAGoC;AAFhC,4HAAA,yBAAyB,OAAA;AACzB,yHAAA,sBAAsB,OAAA;AAE1B,0CAM0B;AALtB,qGAAA,YAAY,OAAA;AACZ,8GAAA,qBAAqB,OAAA;AACrB,6GAAA,oBAAoB,OAAA;AACpB,gHAAA,uBAAuB,OAAA;AACvB,0GAAA,iBAAiB,OAAA;AAUrB,oDAK+B;AAJ3B,4HAAA,8BAA8B,OAAA;AAC9B,wHAAA,0BAA0B,OAAA;AAC1B,0HAAA,4BAA4B,OAAA;AAC5B,yHAAA,2BAA2B,OAAA;AAQ/B,kEAOsC;AANlC,uIAAA,kCAAkC,OAAA;AAClC,sIAAA,iCAAiC,OAAA;AACjC,8HAAA,yBAAyB,OAAA;AACzB,0IAAA,qCAAqC,OAAA;AACrC,0HAAA,qBAAqB,OAAA;AACrB,8HAAA,yBAAyB,OAAA;AAS7B,wEAOyC;AANrC,6IAAA,qCAAqC,OAAA;AACrC,4IAAA,oCAAoC,OAAA;AACpC,2HAAA,mBAAmB,OAAA;AACnB,oIAAA,4BAA4B,OAAA;AAC5B,mIAAA,2BAA2B,OAAA;AAC3B,gIAAA,wBAAwB,OAAA;AAU5B,0EAO0C;AANtC,+IAAA,sCAAsC,OAAA;AACtC,8IAAA,qCAAqC,OAAA;AACrC,sIAAA,6BAA6B,OAAA;AAC7B,oIAAA,2BAA2B,OAAA;AAC3B,iIAAA,wBAAwB,OAAA;AACxB,6IAAA,oCAAoC,OAAA;AAaxC,oFASmD;AAR/C,gIAAA,sBAAsB,OAAA;AACtB,6HAAA,mBAAmB,OAAA;AACnB,mIAAA,yBAAyB,OAAA;AACzB,4HAAA,kBAAkB,OAAA;AAClB,8HAAA,oBAAoB,OAAA;AACpB,iIAAA,uBAAuB,OAAA;AACvB,sIAAA,4BAA4B,OAAA;AAC5B,gIAAA,sBAAsB,OAAA;AAG1B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAO5B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAE5B,gGAA+F;AAAtF,8HAAA,qBAAqB,OAAA;AAE9B,4DAKmC;AAJ/B,gIAAA,8BAA8B,OAAA;AAC9B,wHAAA,sBAAsB,OAAA;AACtB,0HAAA,wBAAwB,OAAA;AACxB,4HAAA,0BAA0B,OAAA;AAE9B,kEAAoH;AAA3G,sHAAA,iBAAiB,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AAAE,2HAAA,sBAAsB,OAAA;AAC7E,oEAAuJ;AAA9I,2HAAA,qBAAqB,OAAA;AAAE,uHAAA,iBAAiB,OAAA;AAAE,oIAAA,8BAA8B,OAAA;AAAE,kIAAA,4BAA4B,OAAA;AAC/G,8CAA2E;AAAlE,0GAAA,eAAe,OAAA;AAAE,+GAAA,oBAAoB,OAAA;AAC9C,wCAKyB;AAJrB,wGAAA,gBAAgB,OAAA;AAChB,gHAAA,wBAAwB,OAAA;AACxB,0GAAA,kBAAkB,OAAA;AAClB,wGAAA,gBAAgB,OAAA;AAGpB,8DAMoC;AALhC,kIAAA,+BAA+B,OAAA;AAC/B,oIAAA,iCAAiC,OAAA;AACjC,oIAAA,iCAAiC,OAAA;AACjC,yIAAA,sCAAsC,OAAA;AACtC,gIAAA,6BAA6B,OAAA;AAWjC,sDAUgC;AAT5B,gIAAA,iCAAiC,OAAA;AACjC,8HAAA,+BAA+B,OAAA;AAC/B,8HAAA,+BAA+B,OAAA;AAC/B,+HAAA,gCAAgC,OAAA;AAChC,oHAAA,qBAAqB,OAAA;AACrB,sHAAA,uBAAuB,OAAA;AACvB,sHAAA,uBAAuB,OAAA;AACvB,uHAAA,wBAAwB,OAAA;AACxB,sHAAA,uBAAuB,OAAA;AAQ3B,mDAWiC;AAV7B,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,uHAAA,4BAA4B,OAAA;AAC5B,oHAAA,yBAAyB,OAAA;AACzB,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA;AACpB,gHAAA,qBAAqB,OAAA;AACrB,8GAAA,mBAAmB,OAAA;AACnB,+GAAA,oBAAoB,OAAA;AACpB,8GAAA,mBAAmB,OAAA;AAUvB,6DAA4E;AAAnE,4HAAA,4BAA4B,OAAA;AAErC,8DAOoC;AANhC,qIAAA,kCAAkC,OAAA;AAClC,0IAAA,uCAAuC,OAAA;AACvC,sIAAA,mCAAmC,OAAA;AACnC,2IAAA,wCAAwC,OAAA;AACxC,iIAAA,8BAA8B,OAAA;AAC9B,mHAAA,gBAAgB,OAAA;AAMpB,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA;AAC3B,mDAI0B;AAHtB,+HAAA,6BAA6B,OAAA;AAC7B,0HAAA,wBAAwB,OAAA;AACxB,oIAAA,kCAAkC,OAAA;AAUtC,gDAM4B;AALxB,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AACpB,uHAAA,0BAA0B,OAAA;AAC1B,oHAAA,uBAAuB,OAAA;AACvB,gHAAA,mBAAmB,OAAA;AAUvB,sCAA0D;AAAjD,iHAAA,yBAAyB,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport type { INestApplication } from \"@nestjs/common\";\nimport type { OpenAPIObject } from \"@nestjs/swagger\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport {\n    buildOpenApiExcludePaths,\n    isOpenApiRequestPath,\n    resolveAccessiOpenApiOptions,\n    setupOpenApi\n} from \"../openapi/OpenApiConfig\";\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { registerAccessiModuleServices } from \"./accessiRuntime\";\nimport { logAccessiStartup } from \"./startupLog\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\nimport { assertEmailConfigured } from './security/emailConfiguration';\nimport { getAccessiJwksPath, setupAccessiJwks } from './security/jwks';\nimport { createAccessiEdgeRateLimitMiddleware } from './security/edgeRateLimit';\nimport { createAccessiSecurityHeadersMiddleware } from './security/securityHeaders';\nimport { createAccessiAuthCookieMiddleware } from './security/authCookies';\n\n/** Esito del bootstrap Express di Accessi. */\nexport interface AccessiModuleInitializationResult {\n    /** Sotto-app Nest che serve `/api/accessi/*` e la documentazione. */\n    nestApp: INestApplication;\n    /** Documento OpenAPI generato, mergiabile nel documento unico dell'host. */\n    document: OpenAPIObject;\n}\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n    const dbOptions = options.databaseOptions as {\n        host?: string;\n        port?: number;\n        database?: string;\n        user?: string;\n    };\n\n    return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/**\n * Monta il modulo Accessi in un'applicazione Express gia esistente.\n *\n * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza la\n * documentazione OpenAPI, validazione ed error handler, quindi rende disponibile\n * `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n *\n * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n * @returns Il sotto-app Nest e il documento OpenAPI generato (utile per il merge nell'host).\n */\nexport async function initializeAccessiModule(\n    app: Application,\n    options: AccessiOptions\n): Promise<AccessiModuleInitializationResult> {\n    // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.\n    assertEmailConfigured(options);\n    const logger: Logger = new Logger(\"initializeAccessiModule\");\n    beginAccessiAuthInitialization();\n    const startedAt = performance.now();\n    const resolvedOpenApi = resolveAccessiOpenApiOptions(options.openapi);\n\n    try {\n        logger.info(\"Inizializzazione modulo accessi avviata.\");\n        logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n        logger.info(\n            `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n        );\n        const nestHostApp = express();\n        if (options.http?.trustProxy !== undefined) {\n            app.set('trust proxy', options.http.trustProxy);\n            nestHostApp.set('trust proxy', options.http.trustProxy);\n        }\n        const jwksPath = getAccessiJwksPath(options);\n        const isAccessiRoute = (path: string) =>\n            path === \"/api/accessi\" ||\n            path.startsWith(\"/api/accessi/\") ||\n            isOpenApiRequestPath(path, resolvedOpenApi) ||\n            (jwksPath !== undefined && path === jwksPath);\n        const edgeRateLimit = options.edgeRateLimit\n            ? createAccessiEdgeRateLimitMiddleware({\n                ...options.edgeRateLimit,\n                match: options.edgeRateLimit.match ?? ((path) => isAccessiRoute(path)),\n            })\n            : undefined;\n        if (edgeRateLimit) {\n            app.use(edgeRateLimit);\n        }\n        const authCookie = createAccessiAuthCookieMiddleware(options, isAccessiRoute);\n        if (authCookie) {\n            app.use(authCookie);\n        }\n        if (options.http?.securityHeaders !== false) {\n            const securityHeaders = createAccessiSecurityHeadersMiddleware(\n                options.http?.securityHeaders,\n                isAccessiRoute,\n                { isOpenApiUi: (path) => isOpenApiRequestPath(path, resolvedOpenApi) },\n            );\n            if (securityHeaders) {\n                app.use(securityHeaders);\n            }\n        }\n\n        app.use((req: Request, res, next) => {\n            if (!isAccessiRoute(req.path)) {\n                return next();\n            }\n\n            return nestHostApp(req, res, next);\n        });\n\n        setupAccessiJwks(app, options);\n        if (jwksPath) {\n            logger.info(`JWKS accessi disponibile su: ${jwksPath}`);\n        }\n\n        const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n        const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: options.bufferLogs !== false,\n            ...(options.logger ? { logger: options.logger } : {})\n        });\n        logger.info(\"Applicazione Nest accessi creata.\");\n\n        if (options.http?.cors !== false) {\n            nestApp.enableCors(options.http?.cors ?? { exposedHeaders: ['X-Total-Count', 'X-CSRF-Token'] });\n        }\n        nestApp.useGlobalPipes(createAccessiValidationPipe());\n        nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\n        nestApp.setGlobalPrefix('api', {\n            exclude: buildOpenApiExcludePaths(resolvedOpenApi)\n        });\n\n        const document = setupOpenApi(nestApp, resolvedOpenApi);\n        logger.info(\"Avvio init del modulo accessi.\");\n        await nestApp.init();\n        logger.info(\"Init del modulo accessi completata.\");\n        if (options.legacyPasswordMigrationOnStartup !== false) {\n            logger.info(\"Avvio migrazione password legacy accessi.\");\n            const passwordMigrationService = nestApp.get(AuthService);\n            await passwordMigrationService.migrateLegacyEncryptedPasswords();\n            logger.info(\"Migrazione password legacy accessi completata.\");\n        }\n\n        const accessiServices = registerAccessiModuleServices(app, nestApp);\n        app.locals.accessiAuthService = accessiServices.authenticateGenService;\n        setAccessiAuthService(accessiServices.authenticateGenService);\n        logAccessiStartup(options, resolvedOpenApi);\n        const elapsedMs = performance.now() - startedAt;\n        logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n        return { nestApp, document };\n    } catch (error) {\n        failAccessiAuthInitialization(error);\n        logger.error(\n            \"Errore in initialize AccessiModule:\",\n            error instanceof Error\n                ? { name: error.name, message: error.message, stack: error.stack }\n                : { error: String(error) }\n        );\n        throw error;\n    }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiIntrospectionController } from \"./Controllers/AccessiIntrospectionController\";\nexport { AccessiAuditController } from \"./Controllers/AccessiAuditController\";\nexport { FederatedAuthExchangeController } from \"./federated-auth/FederatedAuthExchangeController\";\nexport type { AccessiTokenIntrospectionResult } from \"./Services/AuthService/AuthService\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from \"./AccessiModule\";\nexport type { CatalogScriptsOptions, CatalogScriptChecksumPolicy, ConsoleEntryOptions } from \"./AccessiModule\";\nexport {\n    createMemoryConsoleEntryStore,\n    createRedisConsoleEntryStore,\n    getDefaultConsoleEntryStore\n} from './security/consoleEntry';\nexport type {\n    ConsoleEntryRedisClient,\n    ConsoleEntryRecord,\n    ConsoleEntryStore,\n    ConsoleEntryTicket,\n    MemoryConsoleEntryStore,\n    RedisConsoleEntryStoreOptions\n} from './security/consoleEntry';\nexport {\n    createMemoryRateLimitStore,\n    createRedisRateLimitStore,\n    getDefaultRateLimitStore\n} from './security/rateLimitStore';\nexport type {\n    MemoryRateLimitStore,\n    RateLimitDecision,\n    RateLimitRedisClient,\n    RateLimitStore,\n    RedisRateLimitStoreOptions\n} from './security/rateLimitStore';\nexport { createAccessiEdgeRateLimitMiddleware } from './security/edgeRateLimit';\nexport type {\n    AccessiEdgeRateLimitMiddleware,\n    AccessiEdgeRateLimitOptions\n} from './security/edgeRateLimit';\nexport {\n    assertValidAccessiOptions,\n    validateAccessiOptions\n} from './security/validateOptions';\nexport {\n    auditAccessi,\n    configureAccessiAudit,\n    getAccessiAuditStore,\n    redactAccessiAuditValue,\n    resetAccessiAudit\n} from './security/audit';\nexport type {\n    AccessiAuditOptions,\n    AccessiAuditPage,\n    AccessiAuditQuery,\n    AccessiAuditQueryableSink,\n    AccessiAuditRecord,\n    AccessiAuditSink\n} from './security/audit';\nexport {\n    createCallbackAccessiAuditSink,\n    createHttpAccessiAuditSink,\n    createMemoryAccessiAuditSink,\n    createRedisAccessiAuditSink\n} from './security/auditSinks';\nexport type {\n    HttpAccessiAuditSinkOptions,\n    MemoryAccessiAuditSink,\n    MemoryAccessiAuditSinkOptions,\n    RedisAccessiAuditSinkOptions\n} from './security/auditSinks';\nexport {\n    createMemorySessionRevocationStore,\n    createRedisSessionRevocationStore,\n    revokeAccessiUserSessions,\n    revokeAccessiUserSessionsIfConfigured,\n    isAccessiTokenRevoked,\n    getSessionRevocationStore\n} from './security/sessionRevocation';\nexport type {\n    MemorySessionRevocationStore,\n    RedisSessionRevocationStoreOptions,\n    SessionRevocationOptions,\n    SessionRevocationRedisClient,\n    SessionRevocationStore\n} from './security/sessionRevocation';\nexport {\n    createMemoryRefreshTokenRotationStore,\n    createRedisRefreshTokenRotationStore,\n    consumeRefreshToken,\n    getRefreshTokenRotationStore,\n    isRefreshTokenFamilyRevoked,\n    revokeRefreshTokenFamily\n} from './security/refreshTokenRotation';\nexport type {\n    MemoryRefreshTokenRotationStore,\n    RedisRefreshTokenRotationStoreOptions,\n    RefreshTokenConsumeResult,\n    RefreshTokenRotationOptions,\n    RefreshTokenRotationRedisClient,\n    RefreshTokenRotationStore\n} from './security/refreshTokenRotation';\nexport {\n    createMemoryAccessTokenRevocationStore,\n    createRedisAccessTokenRevocationStore,\n    getAccessTokenRevocationStore,\n    isAccessiAccessTokenRevoked,\n    revokeAccessiAccessToken,\n    revokeAccessiAccessTokenIfConfigured\n} from './security/accessTokenRevocation';\nexport type {\n    AccessTokenRevocationOptions,\n    AccessTokenRevocationRedisClient,\n    AccessTokenRevocationStore,\n    MemoryAccessTokenRevocationStore,\n    RedisAccessTokenRevocationStoreOptions\n} from './security/accessTokenRevocation';\nexport type {\n    AccessiOptionsValidationIssue,\n    AccessiOptionsValidationResult\n} from './security/validateOptions';\nexport {\n    AccessiCatalogMigrator,\n    applyCatalogScripts,\n    listPendingCatalogScripts,\n    splitSqlStatements,\n    analyzeCatalogScript,\n    leadingStatementKeyword,\n    computeCatalogScriptChecksum,\n    discoverCatalogScripts\n} from \"./database-updates/AccessiCatalogMigrator\";\nexport type { CatalogMigrationReport, CatalogScriptMigration } from \"./database-updates/AccessiCatalogMigrator\";\nexport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nexport type {\n    ServiceTokenMetadata,\n    IssuedServiceToken,\n    VerifiedServiceToken,\n    IssueServiceTokenInput\n} from './Services/ServiceTokenService/ServiceTokenService';\nexport { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';\nexport type { SchemaDdlResult, SchemaDdlSection, SchemaEntitiesResult } from './Services/SchemaExportService/SchemaExportService';\nexport { AdminBootstrapService } from './Services/AdminBootstrapService/AdminBootstrapService';\nexport type { BootstrapAdminResult } from './Services/AdminBootstrapService/AdminBootstrapService';\nexport {\n    getOrCreateAdminBootstrapToken,\n    getAdminBootstrapToken,\n    clearAdminBootstrapToken,\n    isValidAdminBootstrapToken\n} from './security/adminBootstrap';\nexport { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';\nexport { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';\nexport { buildLoginAsUrl, LOGIN_AS_QUERY_PARAM } from './security/loginAs';\nexport {\n    buildAccessiJwks,\n    createAccessiJwksHandler,\n    getAccessiJwksPath,\n    setupAccessiJwks\n} from './security/jwks';\nexport type { AccessiJwksDocument, AccessiJwksKey } from './security/jwks';\nexport {\n    applyAccessiBaseSecurityHeaders,\n    applyAccessiContentSecurityPolicy,\n    buildAccessiContentSecurityPolicy,\n    createAccessiSecurityHeadersMiddleware,\n    resolveAccessiSecurityHeaders\n} from './security/securityHeaders';\nexport type {\n    AccessiCspDirectives,\n    AccessiCspOptions,\n    AccessiCspSurface,\n    AccessiSecurityHeadersOptions,\n    AccessiSecurityHeadersSetting,\n    ResolvedAccessiCsp,\n    ResolvedAccessiSecurityHeaders\n} from './security/securityHeaders';\nexport {\n    createAccessiAuthCookieMiddleware,\n    resolveAccessiAuthCookieOptions,\n    getAccessiAccessTokenFromCookie,\n    getAccessiRefreshTokenFromCookie,\n    setAccessiAuthCookies,\n    clearAccessiAuthCookies,\n    applyAccessiAuthCookies,\n    parseAccessiCookieHeader,\n    isAccessiCsrfExemptPath\n} from './security/authCookies';\nexport type {\n    AccessiAuthCookieOptions,\n    AccessiAuthCookieSetting,\n    AccessiAuthTokenPair,\n    ResolvedAccessiAuthCookieOptions\n} from './security/authCookies';\nexport {\n    accessiMetricName,\n    countAccessiMetric,\n    createAccessiMetricsRegistry,\n    getAccessiMetricsRegistry,\n    getAccessiMetricsSink,\n    observeAccessiMetric,\n    recordAccessiDuration,\n    recordAccessiMetric,\n    renderAccessiMetrics,\n    resetAccessiMetrics\n} from './observability/metrics';\nexport type {\n    AccessiMetricLabelValue,\n    AccessiMetricLabels,\n    AccessiMetricsOptions,\n    AccessiMetricsRegistry,\n    AccessiMetricsSink,\n    AccessiMetricsSnapshot\n} from './observability/metrics';\nexport { instrumentAccessiRedisClient } from './observability/redisMetrics';\nexport type { AccessiRedisEvalClient } from './observability/redisMetrics';\nexport {\n    getAccessiAccessTokenSigningConfig,\n    getAccessiAccessTokenVerificationConfig,\n    getAccessiRefreshTokenSigningConfig,\n    getAccessiRefreshTokenVerificationConfig,\n    resolveAccessiVerificationKeys,\n    verifyAccessiJwt\n} from './security/jwtTokenOptions';\nexport type {\n    AccessiJwtVerificationConfig,\n    AccessiUnknownKeyIdEvent\n} from './security/jwtTokenOptions';\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\n    authorizeAccessi,\n    authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport {\n    registerAccessiModuleServices,\n    getAccessiModuleServices,\n    ACCESSI_MODULE_SERVICES_LOCALS_KEY\n} from \"./accessiRuntime\";\nexport type { AccessiModuleServices } from \"./accessiRuntime\";\nexport type {\n    AccessiAuthorizationOptions,\n    AccessiRequirementNode,\n    AccessiCustomRequirementContext,\n    AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n\nexport {\n    checkAccessiReadiness,\n    checkAccessiDatabase,\n    collectAccessiHealthStores,\n    createAccessiLiveReport,\n    readinessHttpStatus\n} from './health/readiness';\nexport type {\n    AccessiHealthCheckResult,\n    AccessiHealthStore,\n    AccessiLiveReport,\n    AccessiReadinessCheck,\n    AccessiReadinessDependencies,\n    AccessiReadinessReport\n} from './health/readiness';\nexport { createAccessiHealthModule } from './health/nest';\nexport type { AccessiHealthModuleOptions } from './health/nest';\n\n"]}

package/dist/accessi-module/jwt/jwt.strategy.d.ts

@@ -1,5 +1,5 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
-import { AccessiOptions } from '../AccessiModule';
+import type { AccessiOptions } from '../AccessiModule';
 import { UserService } from '../Services/UserService/UserService';
 export declare class JwtSimpleGuard implements CanActivate {
     private readonly accessiOptions;

package/dist/accessi-module/jwt/jwt.strategy.js

@@ -1,43 +1,10 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
@@ -56,9 +23,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtSimpleGuard = void 0;
 const common_1 = require("@nestjs/common");
-const jwt = __importStar(require("jsonwebtoken"));
 const UserService_1 = require("../Services/UserService/UserService");
 const authenticatedToken_1 = require("../security/authenticatedToken");
+const jwtTokenOptions_1 = require("../security/jwtTokenOptions");
+const sessionRevocation_1 = require("../security/sessionRevocation");
 let JwtSimpleGuard = class JwtSimpleGuard {
     constructor(accessiOptions, userService) {
         this.accessiOptions = accessiOptions;
@@ -66,26 +34,37 @@ let JwtSimpleGuard = class JwtSimpleGuard {
     }
     canActivate(context) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
             const request = context.switchToHttp().getRequest();
             const authHeader = request.headers['authorization'];
             if (!authHeader)
                 throw new common_1.UnauthorizedException('Token mancante.');
-            const token = authHeader.split(' ')[1];
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(authHeader);
             if (!token)
                 throw new common_1.UnauthorizedException('Formato token non valido.');
             try {
-                const secret = ((_b = (_a = this.accessiOptions) === null || _a === void 0 ? void 0 : _a.jwtOptions) === null || _b === void 0 ? void 0 : _b.secret) || process.env.ACC_JWT_SECRET;
-                if (!secret) {
-                    throw new common_1.InternalServerErrorException('JWT secret non configurato.');
+                let verification;
+                try {
+                    verification = (0, jwtTokenOptions_1.getAccessiAccessTokenVerificationConfig)(this.accessiOptions);
+                }
+                catch (_a) {
+                    throw new common_1.InternalServerErrorException('Chiave JWT non configurata.');
+                }
+                let payload;
+                try {
+                    payload = (0, jwtTokenOptions_1.verifyAccessiJwt)(token, verification);
+                }
+                catch (_b) {
+                    throw new common_1.UnauthorizedException('Token non valido o scaduto.');
                 }
-                const payload = jwt.verify(token, secret);
                 const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(payload);
                 if (!codiceUtente) {
                     throw new common_1.UnauthorizedException('Token privo di un utente valido.');
                 }
+                if (yield (0, sessionRevocation_1.isAccessiTokenRevoked)(this.accessiOptions, payload, codiceUtente)) {
+                    throw new common_1.UnauthorizedException('Sessione revocata.');
+                }
                 const currentUser = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
-                if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+                if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(payload, currentUser)) {
                     throw new common_1.UnauthorizedException('Utente non piu autorizzato.');
                 }
                 request.user = (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(payload, currentUser);
@@ -95,7 +74,7 @@ let JwtSimpleGuard = class JwtSimpleGuard {
                 if (error instanceof common_1.InternalServerErrorException || error instanceof common_1.UnauthorizedException) {
                     throw error;
                 }
-                throw new common_1.UnauthorizedException('Token non valido o scaduto.');
+                throw new common_1.InternalServerErrorException('Errore durante la verifica dell utente.');
             }
         });
     }

package/dist/accessi-module/jwt/jwt.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kDAAoC;AAEpC,qEAAkE;AAClE,uEAIwC;AAGjC,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAA,MAAA,MAAA,IAAI,CAAC,cAAc,0CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBACrF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC1C,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;oBACnD,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAxCY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CAwC1B","sourcesContent":["import {\r\n  CanActivate,\r\n  ExecutionContext,\r\n  Inject,\r\n  Injectable,\r\n  InternalServerErrorException,\r\n  UnauthorizedException,\r\n} from '@nestjs/common';\r\nimport * as jwt from 'jsonwebtoken';\r\nimport { AccessiOptions } from '../AccessiModule';\r\nimport { UserService } from '../Services/UserService/UserService';\r\nimport {\r\n  buildAuthenticatedTokenPayload,\r\n  isAuthenticatedUserEnabledForJwt,\r\n  resolveCodiceUtenteFromTokenPayload,\r\n} from '../security/authenticatedToken';\r\n\r\n@Injectable()\r\nexport class JwtSimpleGuard implements CanActivate {\r\n  constructor(\r\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\r\n    private readonly userService: UserService,\r\n  ) {}\r\n\r\n  async canActivate(context: ExecutionContext): Promise<boolean> {\r\n    const request = context.switchToHttp().getRequest();\r\n\r\n    const authHeader = request.headers['authorization'];\r\n    if (!authHeader) throw new UnauthorizedException('Token mancante.');\r\n\r\n    const token = authHeader.split(' ')[1];\r\n    if (!token) throw new UnauthorizedException('Formato token non valido.');\r\n\r\n    try {\r\n      const secret = this.accessiOptions?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\r\n      if (!secret) {\r\n        throw new InternalServerErrorException('JWT secret non configurato.');\r\n      }\r\n      const payload = jwt.verify(token, secret);\r\n      const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\r\n      if (!codiceUtente) {\r\n        throw new UnauthorizedException('Token privo di un utente valido.');\r\n      }\r\n\r\n      const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\r\n      if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\r\n        throw new UnauthorizedException('Utente non piu autorizzato.');\r\n      }\r\n\r\n      request.user = buildAuthenticatedTokenPayload(payload, currentUser);\r\n      return true;\r\n    } catch (error) {\r\n      if (error instanceof InternalServerErrorException || error instanceof UnauthorizedException) {\r\n        throw error;\r\n      }\r\n      throw new UnauthorizedException('Token non valido o scaduto.');\r\n    }\r\n  }\r\n}\r\n"]}
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AAExB,qEAAkE;AAClE,uEAMwC;AACxC,iEAAwG;AACxG,qEAAsE;AAG/D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,IAAI,YAAwE,CAAC;gBAC7E,IAAI,CAAC;oBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC9E,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,OAAgB,CAAC;gBACrB,IAAI,CAAC;oBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,KAAK,EAAE,YAAY,CAAC,CAAC;gBAClD,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;oBACvG,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;gBACxD,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,yCAAyC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAlDY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CAkD1B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  Inject,\n  Injectable,\n  InternalServerErrorException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { UserService } from '../Services/UserService/UserService';\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from '../security/authenticatedToken';\nimport { getAccessiAccessTokenVerificationConfig, verifyAccessiJwt } from '../security/jwtTokenOptions';\nimport { isAccessiTokenRevoked } from '../security/sessionRevocation';\n\n@Injectable()\nexport class JwtSimpleGuard implements CanActivate {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly userService: UserService,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const authHeader = request.headers['authorization'];\n    if (!authHeader) throw new UnauthorizedException('Token mancante.');\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) throw new UnauthorizedException('Formato token non valido.');\n\n    try {\n      let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n      try {\n        verification = getAccessiAccessTokenVerificationConfig(this.accessiOptions);\n      } catch {\n        throw new InternalServerErrorException('Chiave JWT non configurata.');\n      }\n      let payload: unknown;\n      try {\n        payload = verifyAccessiJwt(token, verification);\n      } catch {\n        throw new UnauthorizedException('Token non valido o scaduto.');\n      }\n      const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\n      if (!codiceUtente) {\n        throw new UnauthorizedException('Token privo di un utente valido.');\n      }\n      if (await isAccessiTokenRevoked(this.accessiOptions, payload as Record<string, unknown>, codiceUtente)) {\n        throw new UnauthorizedException('Sessione revocata.');\n      }\n\n      const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n      if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(payload, currentUser)) {\n        throw new UnauthorizedException('Utente non piu autorizzato.');\n      }\n\n      request.user = buildAuthenticatedTokenPayload(payload, currentUser);\n      return true;\n    } catch (error) {\n      if (error instanceof InternalServerErrorException || error instanceof UnauthorizedException) {\n        throw error;\n      }\n      throw new InternalServerErrorException('Errore durante la verifica dell utente.');\n    }\n  }\n}\n"]}