emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.81

package/dist/accessi-module/observability/metrics.js

@@ -0,0 +1,220 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiMetricsRegistry = createAccessiMetricsRegistry;
+exports.getAccessiMetricsRegistry = getAccessiMetricsRegistry;
+exports.getAccessiMetricsSink = getAccessiMetricsSink;
+exports.recordAccessiMetric = recordAccessiMetric;
+exports.recordAccessiDuration = recordAccessiDuration;
+exports.renderAccessiMetrics = renderAccessiMetrics;
+exports.resetAccessiMetrics = resetAccessiMetrics;
+exports.accessiMetricName = accessiMetricName;
+exports.countAccessiMetric = countAccessiMetric;
+exports.observeAccessiMetric = observeAccessiMetric;
+const HISTOGRAM_BUCKETS_MS = [5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 10000];
+const METRIC_NAME = /^[a-zA-Z_:][a-zA-Z0-9_:]*$/;
+const LABEL_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+function normalizeValue(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    return String(value);
+}
+function normalizeLabels(labels) {
+    const normalized = {};
+    for (const [name, value] of Object.entries(labels !== null && labels !== void 0 ? labels : {})) {
+        const text = normalizeValue(value);
+        if (text !== undefined && LABEL_NAME.test(name))
+            normalized[name] = text;
+    }
+    return normalized;
+}
+function labelKey(labels) {
+    return Object.keys(labels)
+        .sort()
+        .map((name) => `${name}=${labels[name]}`)
+        .join(',');
+}
+function escapeLabel(value) {
+    return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n');
+}
+function renderLabels(labels, extra) {
+    const entries = Object.entries(labels).sort(([left], [right]) => left.localeCompare(right));
+    if (extra)
+        entries.push(extra);
+    if (entries.length === 0)
+        return '';
+    return `{${entries.map(([name, value]) => `${name}="${escapeLabel(value)}"`).join(',')}}`;
+}
+function metricName(name) {
+    return METRIC_NAME.test(name) ? name : name.replace(/[^a-zA-Z0-9_:]/g, '_');
+}
+/**
+ * Registry in memoria con rendering Prometheus.
+ *
+ * Non usa dipendenze: la stessa struttura e usata dal servizio standalone e
+ * dai test. `reset()` serve per isolare i test.
+ */
+function createAccessiMetricsRegistry() {
+    const counters = new Map();
+    const gauges = new Map();
+    const histograms = new Map();
+    const entryKey = (name, labels) => `${metricName(name)}|${labelKey(labels)}`;
+    return {
+        increment(name, value = 1, labels) {
+            const normalizedName = metricName(name);
+            const normalizedLabels = normalizeLabels(labels);
+            const key = entryKey(normalizedName, normalizedLabels);
+            const current = counters.get(key);
+            if (current)
+                current.value += value;
+            else
+                counters.set(key, { name: normalizedName, labels: normalizedLabels, value });
+        },
+        gauge(name, value, labels) {
+            const normalizedName = metricName(name);
+            const normalizedLabels = normalizeLabels(labels);
+            gauges.set(entryKey(normalizedName, normalizedLabels), {
+                name: normalizedName,
+                labels: normalizedLabels,
+                value,
+            });
+        },
+        observe(name, valueMs, labels) {
+            if (!Number.isFinite(valueMs) || valueMs < 0)
+                return;
+            const normalizedName = metricName(name);
+            const normalizedLabels = normalizeLabels(labels);
+            const key = entryKey(normalizedName, normalizedLabels);
+            let entry = histograms.get(key);
+            if (!entry) {
+                entry = {
+                    name: normalizedName,
+                    labels: normalizedLabels,
+                    counts: HISTOGRAM_BUCKETS_MS.map(() => 0),
+                    sum: 0,
+                    count: 0,
+                };
+                histograms.set(key, entry);
+            }
+            entry.sum += valueMs;
+            entry.count += 1;
+            const histogram = entry;
+            HISTOGRAM_BUCKETS_MS.forEach((bucket, index) => {
+                var _a;
+                if (valueMs <= bucket)
+                    histogram.counts[index] = ((_a = histogram.counts[index]) !== null && _a !== void 0 ? _a : 0) + 1;
+            });
+        },
+        renderPrometheus() {
+            const lines = [];
+            const grouped = (entries) => {
+                const byName = new Map();
+                for (const entry of entries) {
+                    const bucket = byName.get(entry.name);
+                    if (bucket)
+                        bucket.push(entry);
+                    else
+                        byName.set(entry.name, [entry]);
+                }
+                return [...byName.entries()].sort(([left], [right]) => left.localeCompare(right));
+            };
+            const sorted = (entries) => [...entries].sort((left, right) => labelKey(left.labels).localeCompare(labelKey(right.labels)));
+            for (const [name, entries] of grouped([...counters.values()])) {
+                lines.push(`# HELP ${name} Accessi metric.`);
+                lines.push(`# TYPE ${name} counter`);
+                for (const entry of sorted(entries))
+                    lines.push(`${name}${renderLabels(entry.labels)} ${entry.value}`);
+            }
+            for (const [name, entries] of grouped([...gauges.values()])) {
+                lines.push(`# HELP ${name} Accessi metric.`);
+                lines.push(`# TYPE ${name} gauge`);
+                for (const entry of sorted(entries))
+                    lines.push(`${name}${renderLabels(entry.labels)} ${entry.value}`);
+            }
+            for (const [name, entries] of grouped([...histograms.values()])) {
+                lines.push(`# HELP ${name} Accessi metric.`);
+                lines.push(`# TYPE ${name} histogram`);
+                for (const entry of sorted(entries)) {
+                    HISTOGRAM_BUCKETS_MS.forEach((bucket, index) => {
+                        lines.push(`${name}_bucket${renderLabels(entry.labels, ['le', String(bucket)])} ${entry.counts[index]}`);
+                    });
+                    lines.push(`${name}_bucket${renderLabels(entry.labels, ['le', '+Inf'])} ${entry.count}`);
+                    lines.push(`${name}_sum${renderLabels(entry.labels)} ${entry.sum}`);
+                    lines.push(`${name}_count${renderLabels(entry.labels)} ${entry.count}`);
+                }
+            }
+            return lines.length > 0 ? `${lines.join('\n')}\n` : '';
+        },
+        snapshot() {
+            return {
+                counters: [...counters.values()].map((entry) => (Object.assign(Object.assign({}, entry), { labels: Object.assign({}, entry.labels) }))),
+                gauges: [...gauges.values()].map((entry) => (Object.assign(Object.assign({}, entry), { labels: Object.assign({}, entry.labels) }))),
+                histograms: [...histograms.values()].map((entry) => ({
+                    name: entry.name,
+                    labels: Object.assign({}, entry.labels),
+                    count: entry.count,
+                    sum: entry.sum,
+                    buckets: HISTOGRAM_BUCKETS_MS.map((le, index) => { var _a; return ({ le, count: (_a = entry.counts[index]) !== null && _a !== void 0 ? _a : 0 }); }),
+                })),
+            };
+        },
+        reset() {
+            counters.clear();
+            gauges.clear();
+            histograms.clear();
+        },
+    };
+}
+const defaultRegistry = createAccessiMetricsRegistry();
+/** Registry globale usato da Accessi e dal servizio standalone. */
+function getAccessiMetricsRegistry() {
+    return defaultRegistry;
+}
+/** Sink configurato per l'istanza, oppure registry globale. */
+function getAccessiMetricsSink(options) {
+    var _a, _b, _c;
+    if (((_a = options === null || options === void 0 ? void 0 : options.metrics) === null || _a === void 0 ? void 0 : _a.enabled) === false)
+        return undefined;
+    return (_c = (_b = options === null || options === void 0 ? void 0 : options.metrics) === null || _b === void 0 ? void 0 : _b.sink) !== null && _c !== void 0 ? _c : defaultRegistry;
+}
+/** Registra una metrica sul registry globale (usato da store e moduli senza options). */
+function recordAccessiMetric(name, value = 1, labels) {
+    defaultRegistry.increment(name, value, labels);
+}
+/** Registra una durata in millisecondi sul registry globale. */
+function recordAccessiDuration(name, valueMs, labels) {
+    defaultRegistry.observe(name, valueMs, labels);
+}
+/** Render Prometheus del registry globale. */
+function renderAccessiMetrics() {
+    return defaultRegistry.renderPrometheus();
+}
+/** Azzera il registry globale (test e reset espliciti). */
+function resetAccessiMetrics() {
+    defaultRegistry.reset();
+}
+/** Prefisso configurato, con normalizzazione per evitare nomi non validi. */
+function accessiMetricName(options, name) {
+    var _a, _b;
+    const prefix = (_b = (_a = options === null || options === void 0 ? void 0 : options.metrics) === null || _a === void 0 ? void 0 : _a.prefix) !== null && _b !== void 0 ? _b : 'accessi';
+    if (!prefix.trim())
+        return name;
+    return `${prefix.trim().replace(/[^a-zA-Z0-9_:]/g, '_')}_${name}`;
+}
+/** Incrementa un contatore di dominio sull'istanza (o sul registry globale). */
+function countAccessiMetric(options, name, labels, value = 1) {
+    var _a;
+    const withTenant = (options === null || options === void 0 ? void 0 : options.tenantId)
+        ? Object.assign({ tenant: options.tenantId }, labels) : labels;
+    (_a = getAccessiMetricsSink(options)) === null || _a === void 0 ? void 0 : _a.increment(accessiMetricName(options, name), value, withTenant);
+}
+/** Registra una durata di dominio in millisecondi. */
+function observeAccessiMetric(options, name, valueMs, labels) {
+    var _a;
+    const withTenant = (options === null || options === void 0 ? void 0 : options.tenantId)
+        ? Object.assign({ tenant: options.tenantId }, labels) : labels;
+    const sink = getAccessiMetricsSink(options);
+    (_a = sink === null || sink === void 0 ? void 0 : sink.observe) === null || _a === void 0 ? void 0 : _a.call(sink, accessiMetricName(options, name), valueMs, withTenant);
+}
+//# sourceMappingURL=metrics.js.map

package/dist/accessi-module/observability/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../../src/accessi-module/observability/metrics.ts"],"names":[],"mappings":";;AAgGA,oEAkHC;AAKD,8DAEC;AAGD,sDAGC;AAGD,kDAMC;AAGD,sDAMC;AAGD,oDAEC;AAGD,kDAEC;AAGD,8CAIC;AAGD,gDAUC;AAGD,oDAWC;AA5OD,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAK,EAAE,IAAK,EAAE,IAAK,EAAE,KAAM,CAAC,CAAC;AACzF,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAE9C,SAAS,cAAc,CAAC,KAA8B;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,MAAuC;IAC9D,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,MAA8B;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SACvB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,YAAY,CAAC,MAA8B,EAAE,KAAwB;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5F,IAAI,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5F,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,4BAA4B;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2E,CAAC;IACpG,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2E,CAAC;IAClG,MAAM,UAAU,GAAG,IAAI,GAAG,EAMtB,CAAC;IAEL,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,MAA8B,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAE7G,OAAO;QACL,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM;YAC/B,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,OAAO;gBAAE,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;;gBAC/B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM;YACvB,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,EAAE;gBACrD,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,gBAAgB;gBACxB,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM;YAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO;YACrD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;YACvD,IAAI,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG;oBACN,IAAI,EAAE,cAAc;oBACpB,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBACzC,GAAG,EAAE,CAAC;oBACN,KAAK,EAAE,CAAC;iBACT,CAAC;gBACF,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC;YACD,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC;YACrB,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YACjB,MAAM,SAAS,GAAG,KAAK,CAAC;YACxB,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;;gBAC7C,IAAI,OAAO,IAAI,MAAM;oBAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAA,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACtF,CAAC,CAAC,CAAC;QACL,CAAC;QACD,gBAAgB;YACd,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,CAA6B,OAAY,EAAwB,EAAE;gBACjF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAe,CAAC;gBACtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACtC,IAAI,MAAM;wBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;wBAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvC,CAAC;gBACD,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YACpF,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,CAA6D,OAAY,EAAE,EAAE,CAC1F,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAElG,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC9D,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC;gBACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC;gBACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,CAAC;gBACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpC,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;wBAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC3G,CAAC,CAAC,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;oBACzF,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBACpE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,CAAC;QACD,QAAQ;YACN,OAAO;gBACL,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAM,KAAK,KAAE,MAAM,oBAAO,KAAK,CAAC,MAAM,KAAK,CAAC;gBAC5F,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAM,KAAK,KAAE,MAAM,oBAAO,KAAK,CAAC,MAAM,KAAK,CAAC;gBACxF,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACnD,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,oBAAO,KAAK,CAAC,MAAM,CAAE;oBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,WAAC,OAAA,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAA,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAI,CAAC,EAAE,CAAC,CAAA,EAAA,CAAC;iBAC5F,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;QACD,KAAK;YACH,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,4BAA4B,EAAE,CAAC;AAEvD,mEAAmE;AACnE,SAAgB,yBAAyB;IACvC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,+DAA+D;AAC/D,SAAgB,qBAAqB,CAAC,OAAmC;;IACvE,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,0CAAE,IAAI,mCAAI,eAAe,CAAC;AACnD,CAAC;AAED,yFAAyF;AACzF,SAAgB,mBAAmB,CACjC,IAAY,EACZ,KAAK,GAAG,CAAC,EACT,MAA4B;IAE5B,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,gEAAgE;AAChE,SAAgB,qBAAqB,CACnC,IAAY,EACZ,OAAe,EACf,MAA4B;IAE5B,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,8CAA8C;AAC9C,SAAgB,oBAAoB;IAClC,OAAO,eAAe,CAAC,gBAAgB,EAAE,CAAC;AAC5C,CAAC;AAED,2DAA2D;AAC3D,SAAgB,mBAAmB;IACjC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,6EAA6E;AAC7E,SAAgB,iBAAiB,CAAC,OAAmC,EAAE,IAAY;;IACjF,MAAM,MAAM,GAAG,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,0CAAE,MAAM,mCAAI,SAAS,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACpE,CAAC;AAED,gFAAgF;AAChF,SAAgB,kBAAkB,CAChC,OAAmC,EACnC,IAAY,EACZ,MAA4B,EAC5B,KAAK,GAAG,CAAC;;IAET,MAAM,UAAU,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ;QAClC,CAAC,iBAAG,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAK,MAAM,EACvC,CAAC,CAAC,MAAM,CAAC;IACX,MAAA,qBAAqB,CAAC,OAAO,CAAC,0CAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AACjG,CAAC;AAED,sDAAsD;AACtD,SAAgB,oBAAoB,CAClC,OAAmC,EACnC,IAAY,EACZ,OAAe,EACf,MAA4B;;IAE5B,MAAM,UAAU,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ;QAClC,CAAC,iBAAG,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAK,MAAM,EACvC,CAAC,CAAC,MAAM,CAAC;IACX,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,qDAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\n\n/** Valore ammesso per un label Prometheus. */\nexport type AccessiMetricLabelValue = string | number | boolean | undefined;\nexport type AccessiMetricLabels = Record<string, AccessiMetricLabelValue>;\n\n/**\n * Destinazione delle metriche Accessi.\n *\n * L'implementazione predefinita e il registry in memoria renderizzato in\n * formato Prometheus. Un host puo passare un sink custom (OpenTelemetry,\n * StatsD, ...) tramite `metrics.sink`.\n */\nexport interface AccessiMetricsSink {\n  increment(name: string, value?: number, labels?: AccessiMetricLabels): void;\n  gauge?(name: string, value: number, labels?: AccessiMetricLabels): void;\n  observe?(name: string, valueMs: number, labels?: AccessiMetricLabels): void;\n}\n\n/** Opzioni di osservabilita di Accessi. */\nexport interface AccessiMetricsOptions {\n  /** `false` disabilita le metriche di dominio. Default: abilitate. */\n  enabled?: boolean;\n  /** Sink custom. Default: registry in memoria. */\n  sink?: AccessiMetricsSink;\n  /** Prefisso dei nomi. Default `accessi`. */\n  prefix?: string;\n}\n\nexport interface AccessiMetricsRegistry extends AccessiMetricsSink {\n  observe(name: string, valueMs: number, labels?: AccessiMetricLabels): void;\n  gauge(name: string, value: number, labels?: AccessiMetricLabels): void;\n  renderPrometheus(): string;\n  snapshot(): AccessiMetricsSnapshot;\n  reset(): void;\n}\n\nexport interface AccessiMetricsSnapshot {\n  counters: Array<{ name: string; labels: Record<string, string>; value: number }>;\n  gauges: Array<{ name: string; labels: Record<string, string>; value: number }>;\n  histograms: Array<{\n    name: string;\n    labels: Record<string, string>;\n    count: number;\n    sum: number;\n    buckets: Array<{ le: number; count: number }>;\n  }>;\n}\n\nconst HISTOGRAM_BUCKETS_MS = [5, 10, 25, 50, 100, 250, 500, 1_000, 2_500, 5_000, 10_000];\nconst METRIC_NAME = /^[a-zA-Z_:][a-zA-Z0-9_:]*$/;\nconst LABEL_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;\n\nfunction normalizeValue(value: AccessiMetricLabelValue): string | undefined {\n  if (value === undefined) return undefined;\n  if (typeof value === 'boolean') return value ? 'true' : 'false';\n  return String(value);\n}\n\nfunction normalizeLabels(labels: AccessiMetricLabels | undefined): Record<string, string> {\n  const normalized: Record<string, string> = {};\n  for (const [name, value] of Object.entries(labels ?? {})) {\n    const text = normalizeValue(value);\n    if (text !== undefined && LABEL_NAME.test(name)) normalized[name] = text;\n  }\n  return normalized;\n}\n\nfunction labelKey(labels: Record<string, string>): string {\n  return Object.keys(labels)\n    .sort()\n    .map((name) => `${name}=${labels[name]}`)\n    .join(',');\n}\n\nfunction escapeLabel(value: string): string {\n  return value.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"').replace(/\\n/g, '\\\\n');\n}\n\nfunction renderLabels(labels: Record<string, string>, extra?: [string, string]): string {\n  const entries = Object.entries(labels).sort(([left], [right]) => left.localeCompare(right));\n  if (extra) entries.push(extra);\n  if (entries.length === 0) return '';\n  return `{${entries.map(([name, value]) => `${name}=\"${escapeLabel(value)}\"`).join(',')}}`;\n}\n\nfunction metricName(name: string): string {\n  return METRIC_NAME.test(name) ? name : name.replace(/[^a-zA-Z0-9_:]/g, '_');\n}\n\n/**\n * Registry in memoria con rendering Prometheus.\n *\n * Non usa dipendenze: la stessa struttura e usata dal servizio standalone e\n * dai test. `reset()` serve per isolare i test.\n */\nexport function createAccessiMetricsRegistry(): AccessiMetricsRegistry {\n  const counters = new Map<string, { name: string; labels: Record<string, string>; value: number }>();\n  const gauges = new Map<string, { name: string; labels: Record<string, string>; value: number }>();\n  const histograms = new Map<string, {\n    name: string;\n    labels: Record<string, string>;\n    counts: number[];\n    sum: number;\n    count: number;\n  }>();\n\n  const entryKey = (name: string, labels: Record<string, string>) => `${metricName(name)}|${labelKey(labels)}`;\n\n  return {\n    increment(name, value = 1, labels) {\n      const normalizedName = metricName(name);\n      const normalizedLabels = normalizeLabels(labels);\n      const key = entryKey(normalizedName, normalizedLabels);\n      const current = counters.get(key);\n      if (current) current.value += value;\n      else counters.set(key, { name: normalizedName, labels: normalizedLabels, value });\n    },\n    gauge(name, value, labels) {\n      const normalizedName = metricName(name);\n      const normalizedLabels = normalizeLabels(labels);\n      gauges.set(entryKey(normalizedName, normalizedLabels), {\n        name: normalizedName,\n        labels: normalizedLabels,\n        value,\n      });\n    },\n    observe(name, valueMs, labels) {\n      if (!Number.isFinite(valueMs) || valueMs < 0) return;\n      const normalizedName = metricName(name);\n      const normalizedLabels = normalizeLabels(labels);\n      const key = entryKey(normalizedName, normalizedLabels);\n      let entry = histograms.get(key);\n      if (!entry) {\n        entry = {\n          name: normalizedName,\n          labels: normalizedLabels,\n          counts: HISTOGRAM_BUCKETS_MS.map(() => 0),\n          sum: 0,\n          count: 0,\n        };\n        histograms.set(key, entry);\n      }\n      entry.sum += valueMs;\n      entry.count += 1;\n      const histogram = entry;\n      HISTOGRAM_BUCKETS_MS.forEach((bucket, index) => {\n        if (valueMs <= bucket) histogram.counts[index] = (histogram.counts[index] ?? 0) + 1;\n      });\n    },\n    renderPrometheus() {\n      const lines: string[] = [];\n      const grouped = <T extends { name: string }>(entries: T[]): Array<[string, T[]]> => {\n        const byName = new Map<string, T[]>();\n        for (const entry of entries) {\n          const bucket = byName.get(entry.name);\n          if (bucket) bucket.push(entry);\n          else byName.set(entry.name, [entry]);\n        }\n        return [...byName.entries()].sort(([left], [right]) => left.localeCompare(right));\n      };\n      const sorted = <T extends { name: string; labels: Record<string, string> }>(entries: T[]) =>\n        [...entries].sort((left, right) => labelKey(left.labels).localeCompare(labelKey(right.labels)));\n\n      for (const [name, entries] of grouped([...counters.values()])) {\n        lines.push(`# HELP ${name} Accessi metric.`);\n        lines.push(`# TYPE ${name} counter`);\n        for (const entry of sorted(entries)) lines.push(`${name}${renderLabels(entry.labels)} ${entry.value}`);\n      }\n\n      for (const [name, entries] of grouped([...gauges.values()])) {\n        lines.push(`# HELP ${name} Accessi metric.`);\n        lines.push(`# TYPE ${name} gauge`);\n        for (const entry of sorted(entries)) lines.push(`${name}${renderLabels(entry.labels)} ${entry.value}`);\n      }\n\n      for (const [name, entries] of grouped([...histograms.values()])) {\n        lines.push(`# HELP ${name} Accessi metric.`);\n        lines.push(`# TYPE ${name} histogram`);\n        for (const entry of sorted(entries)) {\n          HISTOGRAM_BUCKETS_MS.forEach((bucket, index) => {\n            lines.push(`${name}_bucket${renderLabels(entry.labels, ['le', String(bucket)])} ${entry.counts[index]}`);\n          });\n          lines.push(`${name}_bucket${renderLabels(entry.labels, ['le', '+Inf'])} ${entry.count}`);\n          lines.push(`${name}_sum${renderLabels(entry.labels)} ${entry.sum}`);\n          lines.push(`${name}_count${renderLabels(entry.labels)} ${entry.count}`);\n        }\n      }\n\n      return lines.length > 0 ? `${lines.join('\\n')}\\n` : '';\n    },\n    snapshot() {\n      return {\n        counters: [...counters.values()].map((entry) => ({ ...entry, labels: { ...entry.labels } })),\n        gauges: [...gauges.values()].map((entry) => ({ ...entry, labels: { ...entry.labels } })),\n        histograms: [...histograms.values()].map((entry) => ({\n          name: entry.name,\n          labels: { ...entry.labels },\n          count: entry.count,\n          sum: entry.sum,\n          buckets: HISTOGRAM_BUCKETS_MS.map((le, index) => ({ le, count: entry.counts[index] ?? 0 })),\n        })),\n      };\n    },\n    reset() {\n      counters.clear();\n      gauges.clear();\n      histograms.clear();\n    },\n  };\n}\n\nconst defaultRegistry = createAccessiMetricsRegistry();\n\n/** Registry globale usato da Accessi e dal servizio standalone. */\nexport function getAccessiMetricsRegistry(): AccessiMetricsRegistry {\n  return defaultRegistry;\n}\n\n/** Sink configurato per l'istanza, oppure registry globale. */\nexport function getAccessiMetricsSink(options: AccessiOptions | undefined): AccessiMetricsSink | undefined {\n  if (options?.metrics?.enabled === false) return undefined;\n  return options?.metrics?.sink ?? defaultRegistry;\n}\n\n/** Registra una metrica sul registry globale (usato da store e moduli senza options). */\nexport function recordAccessiMetric(\n  name: string,\n  value = 1,\n  labels?: AccessiMetricLabels,\n): void {\n  defaultRegistry.increment(name, value, labels);\n}\n\n/** Registra una durata in millisecondi sul registry globale. */\nexport function recordAccessiDuration(\n  name: string,\n  valueMs: number,\n  labels?: AccessiMetricLabels,\n): void {\n  defaultRegistry.observe(name, valueMs, labels);\n}\n\n/** Render Prometheus del registry globale. */\nexport function renderAccessiMetrics(): string {\n  return defaultRegistry.renderPrometheus();\n}\n\n/** Azzera il registry globale (test e reset espliciti). */\nexport function resetAccessiMetrics(): void {\n  defaultRegistry.reset();\n}\n\n/** Prefisso configurato, con normalizzazione per evitare nomi non validi. */\nexport function accessiMetricName(options: AccessiOptions | undefined, name: string): string {\n  const prefix = options?.metrics?.prefix ?? 'accessi';\n  if (!prefix.trim()) return name;\n  return `${prefix.trim().replace(/[^a-zA-Z0-9_:]/g, '_')}_${name}`;\n}\n\n/** Incrementa un contatore di dominio sull'istanza (o sul registry globale). */\nexport function countAccessiMetric(\n  options: AccessiOptions | undefined,\n  name: string,\n  labels?: AccessiMetricLabels,\n  value = 1,\n): void {\n  const withTenant = options?.tenantId\n    ? { tenant: options.tenantId, ...labels }\n    : labels;\n  getAccessiMetricsSink(options)?.increment(accessiMetricName(options, name), value, withTenant);\n}\n\n/** Registra una durata di dominio in millisecondi. */\nexport function observeAccessiMetric(\n  options: AccessiOptions | undefined,\n  name: string,\n  valueMs: number,\n  labels?: AccessiMetricLabels,\n): void {\n  const withTenant = options?.tenantId\n    ? { tenant: options.tenantId, ...labels }\n    : labels;\n  const sink = getAccessiMetricsSink(options);\n  sink?.observe?.(accessiMetricName(options, name), valueMs, withTenant);\n}\n"]}

package/dist/accessi-module/observability/redisMetrics.d.ts

@@ -0,0 +1,12 @@
+/** Client Redis minimo usato dagli store Accessi. */
+export interface AccessiRedisEvalClient {
+    eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;
+}
+/**
+ * Avvolge un client Redis per misurare errori e latenza degli script Lua.
+ *
+ * Gli store accettano qualsiasi client con `eval` (ioredis, node-redis, client
+ * di test). Il wrapper e trasparente: altri metodi (`quit`, `command`, ...)
+ * restano disponibili e legati all'istanza originale.
+ */
+export declare function instrumentAccessiRedisClient<T extends AccessiRedisEvalClient>(store: string, client: T): T;

package/dist/accessi-module/observability/redisMetrics.js

@@ -0,0 +1,44 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.instrumentAccessiRedisClient = instrumentAccessiRedisClient;
+const metrics_1 = require("./metrics");
+/**
+ * Avvolge un client Redis per misurare errori e latenza degli script Lua.
+ *
+ * Gli store accettano qualsiasi client con `eval` (ioredis, node-redis, client
+ * di test). Il wrapper e trasparente: altri metodi (`quit`, `command`, ...)
+ * restano disponibili e legati all'istanza originale.
+ */
+function instrumentAccessiRedisClient(store, client) {
+    return new Proxy(client, {
+        get(target, property) {
+            if (property === 'eval') {
+                return (script, numKeys, ...args) => __awaiter(this, void 0, void 0, function* () {
+                    const startedAt = Date.now();
+                    try {
+                        return yield target.eval(script, numKeys, ...args);
+                    }
+                    catch (error) {
+                        (0, metrics_1.recordAccessiMetric)('accessi_store_errors_total', 1, { store });
+                        throw error;
+                    }
+                    finally {
+                        (0, metrics_1.recordAccessiDuration)('accessi_store_operation_duration_ms', Date.now() - startedAt, { store });
+                    }
+                });
+            }
+            const value = Reflect.get(target, property, target);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}
+//# sourceMappingURL=redisMetrics.js.map

package/dist/accessi-module/observability/redisMetrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisMetrics.js","sourceRoot":"","sources":["../../../src/accessi-module/observability/redisMetrics.ts"],"names":[],"mappings":";;;;;;;;;;;AAcA,oEAuBC;AArCD,uCAAuE;AAOvE;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAC1C,KAAa,EACb,MAAS;IAET,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,QAAQ;YAClB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,OAAO,CAAO,MAAc,EAAE,OAAe,EAAE,GAAG,IAA4B,EAAoB,EAAE;oBAClG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC7B,IAAI,CAAC;wBACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;oBACrD,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAA,6BAAmB,EAAC,4BAA4B,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;wBAChE,MAAM,KAAK,CAAC;oBACd,CAAC;4BAAS,CAAC;wBACT,IAAA,+BAAqB,EAAC,qCAAqC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;oBAClG,CAAC;gBACH,CAAC,CAAA,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClE,CAAC;KACF,CAAM,CAAC;AACV,CAAC","sourcesContent":["import { recordAccessiDuration, recordAccessiMetric } from './metrics';\n\n/** Client Redis minimo usato dagli store Accessi. */\nexport interface AccessiRedisEvalClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\n/**\n * Avvolge un client Redis per misurare errori e latenza degli script Lua.\n *\n * Gli store accettano qualsiasi client con `eval` (ioredis, node-redis, client\n * di test). Il wrapper e trasparente: altri metodi (`quit`, `command`, ...)\n * restano disponibili e legati all'istanza originale.\n */\nexport function instrumentAccessiRedisClient<T extends AccessiRedisEvalClient>(\n  store: string,\n  client: T,\n): T {\n  return new Proxy(client, {\n    get(target, property) {\n      if (property === 'eval') {\n        return async (script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown> => {\n          const startedAt = Date.now();\n          try {\n            return await target.eval(script, numKeys, ...args);\n          } catch (error) {\n            recordAccessiMetric('accessi_store_errors_total', 1, { store });\n            throw error;\n          } finally {\n            recordAccessiDuration('accessi_store_operation_duration_ms', Date.now() - startedAt, { store });\n          }\n        };\n      }\n      const value = Reflect.get(target, property, target);\n      return typeof value === 'function' ? value.bind(target) : value;\n    },\n  }) as T;\n}\n"]}

package/dist/accessi-module/security/AccessiHttpExceptionFilter.d.ts

@@ -0,0 +1,12 @@
+import { ArgumentsHost, ExceptionFilter } from '@nestjs/common';
+/**
+ * Finalizes every exception raised before an Accessi controller can reply.
+ *
+ * This includes invalid JSON, validation-pipe errors and guard failures. The
+ * filter deliberately never return SQL, stack traces or provider diagnostics.
+ */
+export declare class AccessiHttpExceptionFilter implements ExceptionFilter {
+    catch(exception: unknown, host: ArgumentsHost): void;
+    private getPayload;
+    private isInvalidJson;
+}

package/dist/accessi-module/security/AccessiHttpExceptionFilter.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiHttpExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+const Utilities_1 = require("../../Utilities");
+const Logger_1 = require("../../Logger");
+/**
+ * Finalizes every exception raised before an Accessi controller can reply.
+ *
+ * This includes invalid JSON, validation-pipe errors and guard failures. The
+ * filter deliberately never return SQL, stack traces or provider diagnostics.
+ */
+let AccessiHttpExceptionFilter = class AccessiHttpExceptionFilter {
+    catch(exception, host) {
+        var _a, _b;
+        const response = host.switchToHttp().getResponse();
+        if (response.headersSent)
+            return;
+        const status = exception instanceof common_1.HttpException
+            ? exception.getStatus()
+            : Utilities_1.RestUtilities.isDatabaseSchemaError(exception)
+                ? common_1.HttpStatus.SERVICE_UNAVAILABLE
+                : common_1.HttpStatus.INTERNAL_SERVER_ERROR;
+        const payload = this.getPayload(exception);
+        const invalidJson = status === common_1.HttpStatus.BAD_REQUEST && this.isInvalidJson(exception, payload);
+        const explicitMessage = typeof payload.message === 'string' ? payload.message : undefined;
+        const code = (_a = payload.code) !== null && _a !== void 0 ? _a : (Utilities_1.RestUtilities.isDatabaseSchemaError(exception)
+            ? 'ACCESSI_DATABASE_SCHEMA_OUTDATED'
+            : invalidJson
+                ? 'ACCESSI_INVALID_JSON'
+                : status === common_1.HttpStatus.BAD_REQUEST
+                    ? 'ACCESSI_REQUEST_ERROR'
+                    : status === common_1.HttpStatus.UNAUTHORIZED
+                        ? 'ACCESSI_UNAUTHORIZED'
+                        : status === common_1.HttpStatus.FORBIDDEN
+                            ? 'ACCESSI_FORBIDDEN'
+                            : 'ACCESSI_INTERNAL_ERROR');
+        const message = code === 'ACCESSI_VALIDATION_ERROR'
+            ? 'La richiesta contiene dati non validi.'
+            : code === 'ACCESSI_DATABASE_SCHEMA_OUTDATED'
+                ? 'Lo schema del database Accessi non e aggiornato. Eseguire la migrazione database e riprovare.'
+                : invalidJson
+                    ? 'Il corpo della richiesta non contiene JSON valido.'
+                    : explicitMessage !== null && explicitMessage !== void 0 ? explicitMessage : (status === common_1.HttpStatus.UNAUTHORIZED
+                        ? 'Autenticazione non valida o scaduta.'
+                        : status === common_1.HttpStatus.FORBIDDEN
+                            ? 'Operazione non autorizzata.'
+                            : status >= common_1.HttpStatus.INTERNAL_SERVER_ERROR
+                                ? 'Errore interno del modulo Accessi.'
+                                : 'Richiesta non valida.');
+        const stack = exception instanceof Error ? exception.stack : undefined;
+        new Logger_1.Logger('[ACCESSI-EXCEPTION]').error(`HTTP ${status} ${code}: ${exception instanceof Error ? exception.message : String(exception)}`, ...(stack ? [stack] : []));
+        response.status(status).json(Object.assign({ severity: 'error', status, statusCode: Utilities_1.StatusCode.Error, code, error: code, message }, (((_b = payload.details) === null || _b === void 0 ? void 0 : _b.length) ? { details: payload.details } : {})));
+    }
+    getPayload(exception) {
+        if (!(exception instanceof common_1.HttpException))
+            return {};
+        const response = exception.getResponse();
+        return typeof response === 'string' ? { message: response } : response;
+    }
+    isInvalidJson(exception, payload) {
+        const message = exception instanceof Error ? exception.message : payload.message;
+        const text = Array.isArray(message) ? message.join(' ') : String(message !== null && message !== void 0 ? message : '');
+        return /json|unexpected token|expected property name|unterminated string/i.test(text);
+    }
+};
+exports.AccessiHttpExceptionFilter = AccessiHttpExceptionFilter;
+exports.AccessiHttpExceptionFilter = AccessiHttpExceptionFilter = __decorate([
+    (0, common_1.Catch)()
+], AccessiHttpExceptionFilter);
+//# sourceMappingURL=AccessiHttpExceptionFilter.js.map

package/dist/accessi-module/security/AccessiHttpExceptionFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessiHttpExceptionFilter.js","sourceRoot":"","sources":["../../../src/accessi-module/security/AccessiHttpExceptionFilter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAkG;AAElG,+CAA4D;AAC5D,yCAAsC;AAStC;;;;;GAKG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,KAAK,CAAC,SAAkB,EAAE,IAAmB;;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;QAC7D,IAAI,QAAQ,CAAC,WAAW;YAAE,OAAO;QAEjC,MAAM,MAAM,GAAG,SAAS,YAAY,sBAAa;YAC/C,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE;YACvB,CAAC,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;gBAC9C,CAAC,CAAC,mBAAU,CAAC,mBAAmB;gBAChC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,KAAK,mBAAU,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChG,MAAM,eAAe,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCACpB,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;YAChD,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,WAAW;oBACjC,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBAClC,CAAC,CAAC,sBAAsB;wBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,mBAAmB;4BACrB,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,KAAK,0BAA0B;YACjD,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,IAAI,KAAK,kCAAkC;gBAC3C,CAAC,CAAC,+FAA+F;gBACjG,CAAC,CAAC,WAAW;oBACX,CAAC,CAAC,oDAAoD;oBACtD,CAAC,CAAC,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBACtD,CAAC,CAAC,sCAAsC;wBACxC,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,6BAA6B;4BAC/B,CAAC,CAAC,MAAM,IAAI,mBAAU,CAAC,qBAAqB;gCAC1C,CAAC,CAAC,oCAAoC;gCACtC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAEvC,MAAM,KAAK,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,eAAM,CAAC,qBAAqB,CAAC,CAAC,KAAK,CACrC,QAAQ,MAAM,IAAI,IAAI,KAAK,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAC/F,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1B,CAAC;QAEF,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,iBAC1B,QAAQ,EAAE,OAAO,EACjB,MAAM,EACN,UAAU,EAAE,sBAAU,CAAC,KAAK,EAC5B,IAAI,EACJ,KAAK,EAAE,IAAI,EACX,OAAO,IACJ,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,MAAM,EAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAChE,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,SAAkB;QACnC,IAAI,CAAC,CAAC,SAAS,YAAY,sBAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAA4B,CAAC;IAC7F,CAAC;IAEO,aAAa,CAAC,SAAkB,EAAE,OAAyB;QACjE,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACjF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;QAChF,OAAO,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;CACF,CAAA;AApEY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,cAAK,GAAE;GACK,0BAA0B,CAoEtC","sourcesContent":["import { ArgumentsHost, Catch, ExceptionFilter, HttpException, HttpStatus } from '@nestjs/common';\nimport { Response } from 'express';\nimport { RestUtilities, StatusCode } from '../../Utilities';\nimport { Logger } from '../../Logger';\n\ntype ExceptionPayload = {\n  code?: string;\n  error?: string;\n  message?: string | string[];\n  details?: string[];\n};\n\n/**\n * Finalizes every exception raised before an Accessi controller can reply.\n *\n * This includes invalid JSON, validation-pipe errors and guard failures. The\n * filter deliberately never return SQL, stack traces or provider diagnostics.\n */\n@Catch()\nexport class AccessiHttpExceptionFilter implements ExceptionFilter {\n  catch(exception: unknown, host: ArgumentsHost): void {\n    const response = host.switchToHttp().getResponse<Response>();\n    if (response.headersSent) return;\n\n    const status = exception instanceof HttpException\n      ? exception.getStatus()\n      : RestUtilities.isDatabaseSchemaError(exception)\n        ? HttpStatus.SERVICE_UNAVAILABLE\n        : HttpStatus.INTERNAL_SERVER_ERROR;\n    const payload = this.getPayload(exception);\n    const invalidJson = status === HttpStatus.BAD_REQUEST && this.isInvalidJson(exception, payload);\n    const explicitMessage = typeof payload.message === 'string' ? payload.message : undefined;\n    const code = payload.code\n      ?? (RestUtilities.isDatabaseSchemaError(exception)\n        ? 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n        : invalidJson\n          ? 'ACCESSI_INVALID_JSON'\n          : status === HttpStatus.BAD_REQUEST\n            ? 'ACCESSI_REQUEST_ERROR'\n            : status === HttpStatus.UNAUTHORIZED\n              ? 'ACCESSI_UNAUTHORIZED'\n              : status === HttpStatus.FORBIDDEN\n                ? 'ACCESSI_FORBIDDEN'\n                : 'ACCESSI_INTERNAL_ERROR');\n\n    const message = code === 'ACCESSI_VALIDATION_ERROR'\n      ? 'La richiesta contiene dati non validi.'\n      : code === 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n        ? 'Lo schema del database Accessi non e aggiornato. Eseguire la migrazione database e riprovare.'\n        : invalidJson\n          ? 'Il corpo della richiesta non contiene JSON valido.'\n          : explicitMessage ?? (status === HttpStatus.UNAUTHORIZED\n            ? 'Autenticazione non valida o scaduta.'\n            : status === HttpStatus.FORBIDDEN\n              ? 'Operazione non autorizzata.'\n              : status >= HttpStatus.INTERNAL_SERVER_ERROR\n                ? 'Errore interno del modulo Accessi.'\n                : 'Richiesta non valida.');\n\n    const stack = exception instanceof Error ? exception.stack : undefined;\n    new Logger('[ACCESSI-EXCEPTION]').error(\n      `HTTP ${status} ${code}: ${exception instanceof Error ? exception.message : String(exception)}`,\n      ...(stack ? [stack] : [])\n    );\n\n    response.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: StatusCode.Error,\n      code,\n      error: code,\n      message,\n      ...(payload.details?.length ? { details: payload.details } : {}),\n    });\n  }\n\n  private getPayload(exception: unknown): ExceptionPayload {\n    if (!(exception instanceof HttpException)) return {};\n    const response = exception.getResponse();\n    return typeof response === 'string' ? { message: response } : response as ExceptionPayload;\n  }\n\n  private isInvalidJson(exception: unknown, payload: ExceptionPayload): boolean {\n    const message = exception instanceof Error ? exception.message : payload.message;\n    const text = Array.isArray(message) ? message.join(' ') : String(message ?? '');\n    return /json|unexpected token|expected property name|unterminated string/i.test(text);\n  }\n}\n"]}

package/dist/accessi-module/security/accessControl.d.ts

@@ -1,17 +1,63 @@
 import { Request } from 'express';
+/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */
 export interface AuthenticatedAccessiUser {
     codiceUtente: number;
     email?: string;
     flagSuper: boolean;
-    flagAdminConfigurator: boolean;
+    flagAdmin: boolean;
 }
+/**
+ * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.
+ * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.
+ */
 export declare function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser;
+/** Impone il flag superutente: gestione utenti e dei loro grant. */
 export declare function ensureSuperUser(user: AuthenticatedAccessiUser, message?: string): void;
+/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */
+export declare function ensureAdmin(user: AuthenticatedAccessiUser, message?: string): void;
+/**
+ * Gestione utenti e assegnazioni: consentita a superutenti e admin.
+ * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.
+ */
+export declare function ensureUserManagement(user: AuthenticatedAccessiUser, message?: string): void;
+/**
+ * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.
+ * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango
+ * pari o inferiore, quindi un superutente non puo' toccare un admin.
+ */
+export declare function accessiUserRank(user: {
+    flagSuper?: boolean;
+    flagAdmin?: boolean;
+}): number;
+/**
+ * Impone che l'attore possa gestire il target: rango attore >= rango target.
+ * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).
+ */
+export declare function ensureCanManageTargetUser(actor: AuthenticatedAccessiUser, target: {
+    flagSuper?: boolean;
+    flagAdmin?: boolean;
+}, message?: string): void;
+/**
+ * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:
+ * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza
+ * `flagAdmin` gestisce solo `flagSuper`.
+ */
+export declare function ensurePrivilegeFlagChanges(user: AuthenticatedAccessiUser, changes: {
+    flagSuper?: unknown;
+    flagAdmin?: unknown;
+}): void;
+/** Accesso alla console: superutenti e admin. */
+export declare function ensureConsoleAccess(user: AuthenticatedAccessiUser, message?: string): void;
+/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */
 export declare function ensureSelfOrSuperUser(user: AuthenticatedAccessiUser, targetUserCode: number, message?: string): void;
+/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */
 export declare function hasPrivilegedUserChanges(user: {
     statoRegistrazione?: unknown;
     flagSuper?: unknown;
-    flagAdminConfigurator?: unknown;
+    flagAdmin?: unknown;
+    passwordLoginEnabled?: unknown;
+    passwordlessLoginEnabled?: unknown;
+    flagDueFattori?: unknown;
     roles?: unknown;
     permissions?: unknown;
 }): boolean;

package/dist/accessi-module/security/accessControl.js

@@ -2,42 +2,118 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAuthenticatedAccessiUser = getAuthenticatedAccessiUser;
 exports.ensureSuperUser = ensureSuperUser;
+exports.ensureAdmin = ensureAdmin;
+exports.ensureUserManagement = ensureUserManagement;
+exports.accessiUserRank = accessiUserRank;
+exports.ensureCanManageTargetUser = ensureCanManageTargetUser;
+exports.ensurePrivilegeFlagChanges = ensurePrivilegeFlagChanges;
+exports.ensureConsoleAccess = ensureConsoleAccess;
 exports.ensureSelfOrSuperUser = ensureSelfOrSuperUser;
 exports.hasPrivilegedUserChanges = hasPrivilegedUserChanges;
 const common_1 = require("@nestjs/common");
 function normalizeBooleanFlag(value) {
     return value === true || value === 1 || value === '1';
 }
+/**
+ * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.
+ * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.
+ */
 function getAuthenticatedAccessiUser(req) {
-    var _a, _b, _c;
-    const payload = req === null || req === void 0 ? void 0 : req.user;
-    const utente = (_c = (_a = payload === null || payload === void 0 ? void 0 : payload.utente) !== null && _a !== void 0 ? _a : (_b = payload === null || payload === void 0 ? void 0 : payload.userData) === null || _b === void 0 ? void 0 : _b.utente) !== null && _c !== void 0 ? _c : payload;
+    var _a, _b;
+    const payload = req.user;
+    const payloadRecord = payload && typeof payload === 'object' ? payload : undefined;
+    const userData = (payloadRecord === null || payloadRecord === void 0 ? void 0 : payloadRecord.userData) && typeof payloadRecord.userData === 'object'
+        ? payloadRecord.userData
+        : undefined;
+    const rawUser = (_b = (_a = payloadRecord === null || payloadRecord === void 0 ? void 0 : payloadRecord.utente) !== null && _a !== void 0 ? _a : userData === null || userData === void 0 ? void 0 : userData.utente) !== null && _b !== void 0 ? _b : payloadRecord;
+    const utente = rawUser && typeof rawUser === 'object' ? rawUser : undefined;
     const codiceUtente = Number(utente === null || utente === void 0 ? void 0 : utente.codiceUtente);
-    if (!codiceUtente) {
+    if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {
         throw new common_1.UnauthorizedException('Utente non autenticato.');
     }
     return {
         codiceUtente,
         email: typeof (utente === null || utente === void 0 ? void 0 : utente.email) === 'string' ? utente.email : undefined,
         flagSuper: normalizeBooleanFlag(utente === null || utente === void 0 ? void 0 : utente.flagSuper),
-        flagAdminConfigurator: normalizeBooleanFlag(utente === null || utente === void 0 ? void 0 : utente.flagAdminConfigurator),
+        flagAdmin: normalizeBooleanFlag(utente === null || utente === void 0 ? void 0 : utente.flagAdmin),
     };
 }
-function ensureSuperUser(user, message = 'Operazione riservata agli amministratori.') {
+/** Impone il flag superutente: gestione utenti e dei loro grant. */
+function ensureSuperUser(user, message = 'Operazione riservata ai superutenti.') {
     if (!user.flagSuper) {
         throw new common_1.ForbiddenException(message);
     }
 }
+/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */
+function ensureAdmin(user, message = 'Operazione riservata agli amministratori.') {
+    if (!user.flagAdmin) {
+        throw new common_1.ForbiddenException(message);
+    }
+}
+/**
+ * Gestione utenti e assegnazioni: consentita a superutenti e admin.
+ * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.
+ */
+function ensureUserManagement(user, message = 'Operazione riservata agli amministratori degli utenti.') {
+    if (!user.flagSuper && !user.flagAdmin) {
+        throw new common_1.ForbiddenException(message);
+    }
+}
+/**
+ * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.
+ * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango
+ * pari o inferiore, quindi un superutente non puo' toccare un admin.
+ */
+function accessiUserRank(user) {
+    if (user.flagAdmin)
+        return 2;
+    if (user.flagSuper)
+        return 1;
+    return 0;
+}
+/**
+ * Impone che l'attore possa gestire il target: rango attore >= rango target.
+ * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).
+ */
+function ensureCanManageTargetUser(actor, target, message = 'Non puoi gestire un utente di rango superiore al tuo.') {
+    if (accessiUserRank(actor) < accessiUserRank(target)) {
+        throw new common_1.ForbiddenException(message);
+    }
+}
+/**
+ * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:
+ * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza
+ * `flagAdmin` gestisce solo `flagSuper`.
+ */
+function ensurePrivilegeFlagChanges(user, changes) {
+    if (changes.flagAdmin !== undefined && !user.flagAdmin) {
+        throw new common_1.ForbiddenException('Solo un admin puo modificare il flag admin.');
+    }
+    if (changes.flagSuper !== undefined && !user.flagSuper && !user.flagAdmin) {
+        throw new common_1.ForbiddenException('Solo un superutente o un admin puo modificare il flag superutente.');
+    }
+}
+/** Accesso alla console: superutenti e admin. */
+function ensureConsoleAccess(user, message = 'La console richiede un superutente o un admin Accessi.') {
+    if (!user.flagSuper && !user.flagAdmin) {
+        throw new common_1.ForbiddenException(message);
+    }
+}
+/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */
 function ensureSelfOrSuperUser(user, targetUserCode, message = 'Operazione non autorizzata su questo utente.') {
-    if (user.flagSuper || user.codiceUtente === targetUserCode) {
+    if (user.flagSuper || user.flagAdmin || user.codiceUtente === targetUserCode) {
         return;
     }
     throw new common_1.ForbiddenException(message);
 }
+/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */
 function hasPrivilegedUserChanges(user) {
     return (user.statoRegistrazione !== undefined ||
         user.flagSuper !== undefined ||
-        user.flagAdminConfigurator !== undefined ||
+        user.flagAdmin !== undefined ||
+        user.passwordLoginEnabled !== undefined ||
+        user.passwordlessLoginEnabled !== undefined ||
+        user.flagDueFattori !== undefined ||
         user.roles !== undefined ||
         user.permissions !== undefined);
 }