emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.81

package/dist/accessi-module/security/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/audit.ts"],"names":[],"mappings":";;AA0GA,0DAyBC;AAqDD,sDAkBC;AAGD,8CAEC;AAGD,oDAMC;AAQD,oCAkBC;AAlPD,yCAAsC;AACtC,sDAA+D;AAyD/D,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO;IACP,aAAa;IACb,cAAc;IACd,SAAS;IACT,QAAQ;IACR,KAAK;IACL,eAAe;IACf,QAAQ;IACR,WAAW;IACX,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,MAAM;IACN,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,IAAI,KAAK,GAAuB,EAAE,CAAC;AACnC,IAAI,YAAY,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;AAClD,IAAI,aAAiC,CAAC;AACtC,IAAI,aAAa,GAAG,IAAI,CAAC;AACzB,IAAI,aAAiC,CAAC;AACtC,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC/D,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;YACtG,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBAChD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,uBAAuB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC;IACrD,OAAO,uBAAuB,CAAC,OAAO,CAA4B,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,IAAsB,EAAE,KAAc;;IAC7D,IAAA,6BAAmB,EAAC,iCAAiC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAA,IAAI,CAAC,IAAI,mCAAI,SAAS,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC;QACH,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAC9B,6BAA6B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7H,CAAC;IACJ,CAAC;IAAC,WAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB,EAAE,MAA0B;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,IAAI,OAAQ,MAAwB,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACnE,MAAwB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC,aAAa,IAAI,aAAa,IAAI,CAAC;QAAE,OAAO;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,WAAW,GAAG,iBAAiB;QAAE,OAAO;IAClD,WAAW,GAAG,GAAG,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU;YAAE,SAAS;QAC9E,IAAI,CAAC;YACH,MAAM,MAAM,GAAI,IAAkC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,MAAM,IAAI,OAAQ,MAA0B,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACrE,MAA0B,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,OAAwC;;IAC5E,KAAK,GAAG,EAAE,CAAC;IACX,YAAY,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC9C,aAAa,GAAG,SAAS,CAAC;IAC1B,aAAa,GAAG,IAAI,CAAC;IACrB,aAAa,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAC;IAClC,WAAW,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,GAAG,IAAI,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,EAAE;QAAE,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,aAAa,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,MAAK,KAAK,CAAC;IAC1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,MAAK,KAAK;QAAE,OAAO;IAEvC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,mCAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;QAAE,aAAa,GAAG,IAAI,CAAC;AAC9D,CAAC;AAED,0EAA0E;AAC1E,SAAgB,iBAAiB;IAC/B,qBAAqB,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,2EAA2E;AAC3E,SAAgB,oBAAoB;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAqC,EAAE,CACxE,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU;WAC5D,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU,CACnE,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAa,EAAE,UAAmC,EAAE;IAC/E,MAAM,MAAM,iCACV,KAAK,EACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAChC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChD,aAAa,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAChC,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,WAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,UAAU,EAAE,CAAC;AACf,CAAC","sourcesContent":["import { Logger } from '../../Logger';\nimport { recordAccessiMetric } from '../observability/metrics';\n\n/** Record di audit normalizzato e gia redatto. */\nexport interface AccessiAuditRecord {\n  event: string;\n  timestamp: string;\n  [key: string]: unknown;\n}\n\n/** Destinazione di un record di audit. */\nexport interface AccessiAuditSink {\n  /** Nome usato nelle metriche di errore del sink. */\n  name?: string;\n  write(record: AccessiAuditRecord): void | Promise<void>;\n}\n\nexport interface AccessiAuditQuery {\n  event?: string;\n  from?: string;\n  to?: string;\n  codiceUtente?: number;\n  limit?: number;\n  offset?: number;\n  order?: 'asc' | 'desc';\n}\n\nexport interface AccessiAuditPage {\n  records: AccessiAuditRecord[];\n  total: number;\n  limit: number;\n  offset: number;\n}\n\n/** Sink interrogabile dagli endpoint amministrativi e dalla retention. */\nexport interface AccessiAuditQueryableSink extends AccessiAuditSink {\n  query(filter?: AccessiAuditQuery): Promise<AccessiAuditPage>;\n  purge(before: Date): Promise<number>;\n}\n\n/** Opzioni di audit del modulo. */\nexport interface AccessiAuditOptions {\n  /** `false` disattiva i sink ma lascia il log strutturato. Default: abilitati. */\n  enabled?: boolean;\n  /** Sink aggiuntivi (HTTP, DB, OpenTelemetry). */\n  sinks?: AccessiAuditSink[];\n  /** Sink interrogabile usato da `/api/accessi/audit`. Default: primo sink queryable. */\n  store?: AccessiAuditQueryableSink;\n  /** Giorni di retention applicati ai sink queryable. Default: nessuna scadenza automatica. */\n  retentionDays?: number;\n  /** Chiavi aggiuntive da redigere, oltre a quelle predefinite. */\n  redact?: string[];\n  /** Etichetta tenant aggiunta a ogni record (multi-tenancy). */\n  tenantId?: string;\n  /** Scrivi anche sul Logger strutturato. Default: true. */\n  logger?: boolean;\n}\n\nconst REDACTED = '[REDACTED]';\nconst TRUNCATED = '[TRUNCATED]';\n\nconst DEFAULT_REDACTED_KEYS = new Set([\n  'token',\n  'accesstoken',\n  'refreshtoken',\n  'idtoken',\n  'bearer',\n  'jwt',\n  'authorization',\n  'cookie',\n  'setcookie',\n  'password',\n  'passwordhash',\n  'hashedpassword',\n  'resettoken',\n  'secret',\n  'clientsecret',\n  'privatekey',\n  'apikey',\n  'csrf',\n  'csrftoken',\n]);\n\nconst MAX_STRING_LENGTH = 512;\nconst MAX_ARRAY_LENGTH = 50;\nconst MAX_OBJECT_KEYS = 100;\nconst MAX_DEPTH = 4;\nconst PURGE_INTERVAL_MS = 60 * 60 * 1000;\n\nlet sinks: AccessiAuditSink[] = [];\nlet redactedKeys = new Set(DEFAULT_REDACTED_KEYS);\nlet retentionDays: number | undefined;\nlet loggerEnabled = true;\nlet auditTenantId: string | undefined;\nlet lastPurgeAt = 0;\n\nfunction normalizedKey(key: string): string {\n  return key.toLowerCase().replace(/[-_\\s]/g, '');\n}\n\n/**\n * Redige ricorsivamente token, segreti, cookie e header sensibili.\n *\n * Limita profondita, lunghezza delle stringhe e numero di elementi per evitare\n * che un payload applicativo finisca per intero nell'audit.\n */\nexport function redactAccessiAuditValue(value: unknown, depth = 0): unknown {\n  if (depth > MAX_DEPTH) return TRUNCATED;\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return value.length > MAX_STRING_LENGTH ? `${value.slice(0, MAX_STRING_LENGTH - 3)}...` : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'bigint') return value.toString();\n  if (value instanceof Date) return value.toISOString();\n  if (value instanceof Error) {\n    return { name: value.name, message: redactAccessiAuditValue(value.message, depth + 1) };\n  }\n  if (Array.isArray(value)) {\n    return value.slice(0, MAX_ARRAY_LENGTH).map((item) => redactAccessiAuditValue(item, depth + 1));\n  }\n  if (typeof value === 'object') {\n    const result: Record<string, unknown> = {};\n    for (const [key, entry] of Object.entries(value as Record<string, unknown>).slice(0, MAX_OBJECT_KEYS)) {\n      result[key] = redactedKeys.has(normalizedKey(key))\n        ? REDACTED\n        : redactAccessiAuditValue(entry, depth + 1);\n    }\n    return result;\n  }\n  return String(value);\n}\n\nfunction redactDetails(details: Record<string, unknown>): Record<string, unknown> {\n  return redactAccessiAuditValue(details) as Record<string, unknown>;\n}\n\nfunction reportSinkError(sink: AccessiAuditSink, error: unknown): void {\n  recordAccessiMetric('accessi_audit_sink_errors_total', 1, { sink: sink.name ?? 'unknown' });\n  try {\n    new Logger('AccessiAudit').error(\n      `Audit sink non disponibile${sink.name ? ` (${sink.name})` : ''}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  } catch {\n    // Il logging non deve mai interrompere l'operazione applicativa.\n  }\n}\n\nfunction writeToSink(sink: AccessiAuditSink, record: AccessiAuditRecord): void {\n  try {\n    const result = sink.write(record);\n    if (result && typeof (result as Promise<void>).catch === 'function') {\n      (result as Promise<void>).catch((error) => reportSinkError(sink, error));\n    }\n  } catch (error) {\n    reportSinkError(sink, error);\n  }\n}\n\nfunction maybePurge(): void {\n  if (!retentionDays || retentionDays <= 0) return;\n  const now = Date.now();\n  if (now - lastPurgeAt < PURGE_INTERVAL_MS) return;\n  lastPurgeAt = now;\n  const before = new Date(now - retentionDays * 24 * 60 * 60 * 1000);\n  for (const sink of sinks) {\n    if (typeof (sink as AccessiAuditQueryableSink).purge !== 'function') continue;\n    try {\n      const result = (sink as AccessiAuditQueryableSink).purge(before);\n      if (result && typeof (result as Promise<number>).catch === 'function') {\n        (result as Promise<number>).catch((error) => reportSinkError(sink, error));\n      }\n    } catch (error) {\n      reportSinkError(sink, error);\n    }\n  }\n}\n\n/**\n * Configura i sink di audit del processo.\n *\n * Chiamato da `AccessiModule.forRoot`. Le opzioni sono globali: un solo modulo\n * Accessi per processo e la configurazione consigliata.\n */\nexport function configureAccessiAudit(options: AccessiAuditOptions | undefined): void {\n  sinks = [];\n  redactedKeys = new Set(DEFAULT_REDACTED_KEYS);\n  retentionDays = undefined;\n  loggerEnabled = true;\n  auditTenantId = options?.tenantId;\n  lastPurgeAt = 0;\n\n  for (const key of options?.redact ?? []) redactedKeys.add(normalizedKey(key));\n  loggerEnabled = options?.logger !== false;\n  if (options?.enabled === false) return;\n\n  if (options?.store) sinks.push(options.store);\n  for (const sink of options?.sinks ?? []) {\n    if (!sinks.includes(sink)) sinks.push(sink);\n  }\n  const days = Number(options?.retentionDays);\n  if (Number.isFinite(days) && days > 0) retentionDays = days;\n}\n\n/** Ripristina la configurazione iniziale (logger attivo, nessun sink). */\nexport function resetAccessiAudit(): void {\n  configureAccessiAudit(undefined);\n}\n\n/** Sink interrogabile configurato, usato dagli endpoint amministrativi. */\nexport function getAccessiAuditStore(): AccessiAuditQueryableSink | undefined {\n  const configured = sinks.find((sink): sink is AccessiAuditQueryableSink =>\n    typeof (sink as AccessiAuditQueryableSink).query === 'function'\n    && typeof (sink as AccessiAuditQueryableSink).purge === 'function',\n  );\n  return configured;\n}\n\n/**\n * Registra un evento di sicurezza.\n *\n * Il record viene redatto prima di raggiungere logger e sink. Un sink guasto\n * non interrompe mai il flusso applicativo.\n */\nexport function auditAccessi(event: string, details: Record<string, unknown> = {}): void {\n  const record: AccessiAuditRecord = {\n    event,\n    timestamp: new Date().toISOString(),\n    ...(auditTenantId ? { tenant: auditTenantId } : {}),\n    ...redactDetails(details ?? {}),\n  };\n\n  if (loggerEnabled) {\n    try {\n      new Logger('AccessiAudit').warning(JSON.stringify(record));\n    } catch {\n      // Il logging non deve mai interrompere l'operazione applicativa.\n    }\n  }\n\n  for (const sink of sinks) writeToSink(sink, record);\n  maybePurge();\n}\n"]}

package/dist/accessi-module/security/auditSinks.d.ts

@@ -0,0 +1,55 @@
+import type { AccessiAuditQueryableSink, AccessiAuditRecord, AccessiAuditSink } from './audit';
+import type { AccessiRedisEvalClient } from '../observability/redisMetrics';
+/** Opzioni del sink in memoria. */
+export interface MemoryAccessiAuditSinkOptions {
+    name?: string;
+    /** Numero massimo di record conservati. Default: 10000. */
+    maxRecords?: number;
+    /** Retention in millisecondi. Default: nessuna scadenza. */
+    retentionMs?: number;
+    /** Orologio iniettabile per i test. */
+    now?: () => number;
+}
+export interface MemoryAccessiAuditSink extends AccessiAuditQueryableSink {
+    all(): AccessiAuditRecord[];
+    clear(): void;
+}
+/**
+ * Sink in memoria con query e retention.
+ *
+ * Adatto a sviluppo, test e singola istanza. Per piu istanze usare
+ * `createRedisAccessiAuditSink` o un sink esterno.
+ */
+export declare function createMemoryAccessiAuditSink(options?: MemoryAccessiAuditSinkOptions): MemoryAccessiAuditSink;
+/** Sink HTTP: inoltra ogni record a un endpoint esterno (SIEM, collector). */
+export interface HttpAccessiAuditSinkOptions {
+    name?: string;
+    url: string;
+    headers?: Record<string, string>;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+export declare function createHttpAccessiAuditSink(options: HttpAccessiAuditSinkOptions): AccessiAuditSink;
+/**
+ * Adattatore per database, OpenTelemetry o qualunque destinazione custom.
+ *
+ * La callback riceve un record gia redatto e serializzabile.
+ */
+export declare function createCallbackAccessiAuditSink(write: (record: AccessiAuditRecord) => void | Promise<void>, name?: string): AccessiAuditSink;
+export interface RedisAccessiAuditSinkOptions {
+    client: AccessiRedisEvalClient;
+    name?: string;
+    /** Default: `accessi:audit:`. */
+    keyPrefix?: string;
+    /** Numero massimo di record. Default: 10000. */
+    maxRecords?: number;
+    /** Retention Redis in millisecondi. Default: 30 giorni. */
+    retentionMs?: number;
+}
+/**
+ * Sink Redis persistente, condiviso tra istanze e interrogabile.
+ *
+ * Usa una lista con `LTRIM` per limitare i record e `PEXPIRE` per la retention.
+ * Le query leggono la lista e filtrano lato applicazione.
+ */
+export declare function createRedisAccessiAuditSink(options: RedisAccessiAuditSinkOptions): AccessiAuditQueryableSink;

package/dist/accessi-module/security/auditSinks.js

@@ -0,0 +1,228 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemoryAccessiAuditSink = createMemoryAccessiAuditSink;
+exports.createHttpAccessiAuditSink = createHttpAccessiAuditSink;
+exports.createCallbackAccessiAuditSink = createCallbackAccessiAuditSink;
+exports.createRedisAccessiAuditSink = createRedisAccessiAuditSink;
+const redisMetrics_1 = require("../observability/redisMetrics");
+const DEFAULT_LIMIT = 100;
+const MAX_LIMIT = 1000;
+function normalizeQuery(query = {}) {
+    const limit = Number.isFinite(query.limit)
+        ? Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query.limit)))
+        : DEFAULT_LIMIT;
+    const offset = Number.isFinite(query.offset) ? Math.max(0, Math.trunc(query.offset)) : 0;
+    return { limit, offset, order: query.order === 'asc' ? 'asc' : 'desc' };
+}
+function recordTime(record) {
+    const time = Date.parse(record.timestamp);
+    return Number.isFinite(time) ? time : 0;
+}
+function matches(record, query) {
+    if (query.event && record.event !== query.event)
+        return false;
+    if (query.codiceUtente !== undefined && Number(record.codiceUtente) !== query.codiceUtente)
+        return false;
+    const time = recordTime(record);
+    if (query.from) {
+        const from = Date.parse(query.from);
+        if (Number.isFinite(from) && time < from)
+            return false;
+    }
+    if (query.to) {
+        const to = Date.parse(query.to);
+        if (Number.isFinite(to) && time > to)
+            return false;
+    }
+    return true;
+}
+function paginate(records, query) {
+    const { limit, offset, order } = normalizeQuery(query);
+    const filtered = records.filter((record) => matches(record, query));
+    const ordered = order === 'asc' ? filtered : [...filtered].reverse();
+    return {
+        records: ordered.slice(offset, offset + limit),
+        total: filtered.length,
+        limit,
+        offset,
+    };
+}
+function cloneRecord(record) {
+    return JSON.parse(JSON.stringify(record));
+}
+/**
+ * Sink in memoria con query e retention.
+ *
+ * Adatto a sviluppo, test e singola istanza. Per piu istanze usare
+ * `createRedisAccessiAuditSink` o un sink esterno.
+ */
+function createMemoryAccessiAuditSink(options = {}) {
+    var _a, _b, _c, _d;
+    const maxRecords = Math.max(1, Math.trunc((_a = options.maxRecords) !== null && _a !== void 0 ? _a : 10000));
+    const retentionMs = Math.max(0, Number((_b = options.retentionMs) !== null && _b !== void 0 ? _b : 0));
+    const now = (_c = options.now) !== null && _c !== void 0 ? _c : Date.now;
+    let records = [];
+    const purgeExpired = () => {
+        if (!retentionMs)
+            return;
+        const threshold = now() - retentionMs;
+        records = records.filter((record) => recordTime(record) >= threshold);
+    };
+    return {
+        name: (_d = options.name) !== null && _d !== void 0 ? _d : 'memory',
+        write(record) {
+            records.push(cloneRecord(record));
+            if (records.length > maxRecords)
+                records = records.slice(records.length - maxRecords);
+            purgeExpired();
+        },
+        query() {
+            return __awaiter(this, arguments, void 0, function* (query = {}) {
+                purgeExpired();
+                return paginate(records, query);
+            });
+        },
+        purge(before) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const threshold = before.getTime();
+                const beforeCount = records.length;
+                records = records.filter((record) => recordTime(record) >= threshold);
+                return beforeCount - records.length;
+            });
+        },
+        all() {
+            return records.map(cloneRecord);
+        },
+        clear() {
+            records = [];
+        },
+    };
+}
+function createHttpAccessiAuditSink(options) {
+    var _a;
+    if (!(options === null || options === void 0 ? void 0 : options.url))
+        throw new Error('Audit sink HTTP: url obbligatoria.');
+    return {
+        name: (_a = options.name) !== null && _a !== void 0 ? _a : 'http',
+        write(record) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c;
+                const fetchImpl = (_a = options.fetch) !== null && _a !== void 0 ? _a : globalThis.fetch;
+                if (typeof fetchImpl !== 'function') {
+                    throw new Error('Audit sink HTTP: fetch non disponibile.');
+                }
+                const controller = new AbortController();
+                const timeout = setTimeout(() => controller.abort(), (_b = options.timeoutMs) !== null && _b !== void 0 ? _b : 3000);
+                try {
+                    const response = yield fetchImpl(options.url, {
+                        method: 'POST',
+                        headers: Object.assign({ 'Content-Type': 'application/json' }, ((_c = options.headers) !== null && _c !== void 0 ? _c : {})),
+                        body: JSON.stringify(record),
+                        signal: controller.signal,
+                    });
+                    if (!response.ok) {
+                        throw new Error(`Audit sink HTTP: risposta ${response.status}.`);
+                    }
+                }
+                finally {
+                    clearTimeout(timeout);
+                }
+            });
+        },
+    };
+}
+/**
+ * Adattatore per database, OpenTelemetry o qualunque destinazione custom.
+ *
+ * La callback riceve un record gia redatto e serializzabile.
+ */
+function createCallbackAccessiAuditSink(write, name = 'callback') {
+    return { name, write };
+}
+const REDIS_WRITE_SCRIPT = `
+local key = KEYS[1]
+redis.call('RPUSH', key, ARGV[1])
+redis.call('LTRIM', key, -tonumber(ARGV[2]), -1)
+redis.call('PEXPIRE', key, ARGV[3])
+return 1
+`;
+const REDIS_READ_SCRIPT = `return redis.call('LRANGE', KEYS[1], 0, -1)`;
+const REDIS_REWRITE_SCRIPT = `
+local key = KEYS[1]
+redis.call('DEL', key)
+for i = 2, #ARGV do
+  redis.call('RPUSH', key, ARGV[i])
+end
+redis.call('PEXPIRE', key, ARGV[1])
+return #ARGV - 1
+`;
+function parseRedisRecords(value) {
+    if (!Array.isArray(value))
+        return [];
+    const records = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string')
+            continue;
+        try {
+            const parsed = JSON.parse(entry);
+            if (parsed && typeof parsed.event === 'string' && typeof parsed.timestamp === 'string') {
+                records.push(parsed);
+            }
+        }
+        catch (_a) {
+            // Un record corrotto non deve bloccare query ed export.
+        }
+    }
+    return records;
+}
+/**
+ * Sink Redis persistente, condiviso tra istanze e interrogabile.
+ *
+ * Usa una lista con `LTRIM` per limitare i record e `PEXPIRE` per la retention.
+ * Le query leggono la lista e filtrano lato applicazione.
+ */
+function createRedisAccessiAuditSink(options) {
+    var _a, _b, _c, _d;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Audit sink Redis: client.eval non configurato.');
+    }
+    const client = (0, redisMetrics_1.instrumentAccessiRedisClient)('audit', options.client);
+    const key = `${((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:audit:').replace(/:*$/, ':')}events`;
+    const maxRecords = Math.max(1, Math.trunc((_b = options.maxRecords) !== null && _b !== void 0 ? _b : 10000));
+    const retentionMs = Math.max(1000, Math.trunc((_c = options.retentionMs) !== null && _c !== void 0 ? _c : 30 * 24 * 60 * 60 * 1000));
+    const readAll = () => __awaiter(this, void 0, void 0, function* () { return parseRedisRecords(yield client.eval(REDIS_READ_SCRIPT, 1, key)); });
+    return {
+        name: (_d = options.name) !== null && _d !== void 0 ? _d : 'redis',
+        write(record) {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield client.eval(REDIS_WRITE_SCRIPT, 1, key, JSON.stringify(record), maxRecords, retentionMs);
+            });
+        },
+        query() {
+            return __awaiter(this, arguments, void 0, function* (query = {}) {
+                return paginate(yield readAll(), query);
+            });
+        },
+        purge(before) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const records = yield readAll();
+                const kept = records.filter((record) => recordTime(record) >= before.getTime());
+                const removed = records.length - kept.length;
+                if (removed === 0)
+                    return 0;
+                yield client.eval(REDIS_REWRITE_SCRIPT, 1, key, retentionMs, ...kept.map((record) => JSON.stringify(record)));
+                return removed;
+            });
+        },
+    };
+}
+//# sourceMappingURL=auditSinks.js.map

package/dist/accessi-module/security/auditSinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditSinks.js","sourceRoot":"","sources":["../../../src/accessi-module/security/auditSinks.ts"],"names":[],"mappings":";;;;;;;;;;;AA+EA,oEAsCC;AAWD,gEA+BC;AAOD,wEAKC;AAwDD,kEAqCC;AAjQD,gEAA6E;AAG7E,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,SAAS,GAAG,IAAK,CAAC;AAExB,SAAS,cAAc,CAAC,QAA2B,EAAE;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAe,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,MAA0B;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,MAA0B,EAAE,KAAwB;IACnE,IAAI,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,KAAK,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACzG,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,OAA6B,EAAE,KAAwB;IACvE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAC9C,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAA0B;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAuB,CAAC;AAClE,CAAC;AAkBD;;;;;GAKG;AACH,SAAgB,4BAA4B,CAC1C,UAAyC,EAAE;;IAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,KAAM,CAAC,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAA,OAAO,CAAC,WAAW,mCAAI,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAI,CAAC,GAAG,CAAC;IACpC,IAAI,OAAO,GAAyB,EAAE,CAAC;IAEvC,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,WAAW,CAAC;QACtC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,MAAA,OAAO,CAAC,IAAI,mCAAI,QAAQ;QAC9B,KAAK,CAAC,MAAM;YACV,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAClC,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU;gBAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;YACtF,YAAY,EAAE,CAAC;QACjB,CAAC;QACK,KAAK;iEAAC,KAAK,GAAG,EAAE;gBACpB,YAAY,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;SAAA;QACK,KAAK,CAAC,MAAY;;gBACtB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;gBACnC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;gBACtE,OAAO,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YACtC,CAAC;SAAA;QACD,GAAG;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;QACD,KAAK;YACH,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,SAAgB,0BAA0B,CACxC,OAAoC;;IAEpC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAA;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACzE,OAAO;QACL,IAAI,EAAE,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM;QACtB,KAAK,CAAC,MAAM;;;gBAChB,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,UAAU,CAAC,KAAK,CAAC;gBACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAA,OAAO,CAAC,SAAS,mCAAI,IAAI,CAAC,CAAC;gBAChF,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;wBAC5C,MAAM,EAAE,MAAM;wBACd,OAAO,kBACL,cAAc,EAAE,kBAAkB,IAC/B,CAAC,MAAA,OAAO,CAAC,OAAO,mCAAI,EAAE,CAAC,CAC3B;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;wBAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;oBACnE,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,YAAY,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,8BAA8B,CAC5C,KAA2D,EAC3D,IAAI,GAAG,UAAU;IAEjB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAaD,MAAM,kBAAkB,GAAG;;;;;;CAM1B,CAAC;AAEF,MAAM,iBAAiB,GAAG,6CAA6C,CAAC;AAExE,MAAM,oBAAoB,GAAG;;;;;;;;CAQ5B,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAuB,CAAC;YACvD,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACvF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,WAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,OAAqC;;IAErC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,2CAA4B,EAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC;IACnF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,KAAM,CAAC,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,WAAW,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAEjG,MAAM,OAAO,GAAG,GAAwC,EAAE,gDACxD,OAAA,iBAAiB,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA,GAAA,CAAC;IAElE,OAAO;QACL,IAAI,EAAE,MAAA,OAAO,CAAC,IAAI,mCAAI,OAAO;QACvB,KAAK,CAAC,MAAM;;gBAChB,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACjG,CAAC;SAAA;QACK,KAAK;iEAAC,KAAK,GAAG,EAAE;gBACpB,OAAO,QAAQ,CAAC,MAAM,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;SAAA;QACK,KAAK,CAAC,MAAY;;gBACtB,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC7C,IAAI,OAAO,KAAK,CAAC;oBAAE,OAAO,CAAC,CAAC;gBAC5B,MAAM,MAAM,CAAC,IAAI,CACf,oBAAoB,EACpB,CAAC,EACD,GAAG,EACH,WAAW,EACX,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAChD,CAAC;gBACF,OAAO,OAAO,CAAC;YACjB,CAAC;SAAA;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AccessiAuditPage,\n  AccessiAuditQuery,\n  AccessiAuditQueryableSink,\n  AccessiAuditRecord,\n  AccessiAuditSink,\n} from './audit';\nimport { instrumentAccessiRedisClient } from '../observability/redisMetrics';\nimport type { AccessiRedisEvalClient } from '../observability/redisMetrics';\n\nconst DEFAULT_LIMIT = 100;\nconst MAX_LIMIT = 1_000;\n\nfunction normalizeQuery(query: AccessiAuditQuery = {}): Required<Pick<AccessiAuditQuery, 'limit' | 'offset' | 'order'>> {\n  const limit = Number.isFinite(query.limit)\n    ? Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query.limit as number)))\n    : DEFAULT_LIMIT;\n  const offset = Number.isFinite(query.offset) ? Math.max(0, Math.trunc(query.offset as number)) : 0;\n  return { limit, offset, order: query.order === 'asc' ? 'asc' : 'desc' };\n}\n\nfunction recordTime(record: AccessiAuditRecord): number {\n  const time = Date.parse(record.timestamp);\n  return Number.isFinite(time) ? time : 0;\n}\n\nfunction matches(record: AccessiAuditRecord, query: AccessiAuditQuery): boolean {\n  if (query.event && record.event !== query.event) return false;\n  if (query.codiceUtente !== undefined && Number(record.codiceUtente) !== query.codiceUtente) return false;\n  const time = recordTime(record);\n  if (query.from) {\n    const from = Date.parse(query.from);\n    if (Number.isFinite(from) && time < from) return false;\n  }\n  if (query.to) {\n    const to = Date.parse(query.to);\n    if (Number.isFinite(to) && time > to) return false;\n  }\n  return true;\n}\n\nfunction paginate(records: AccessiAuditRecord[], query: AccessiAuditQuery): AccessiAuditPage {\n  const { limit, offset, order } = normalizeQuery(query);\n  const filtered = records.filter((record) => matches(record, query));\n  const ordered = order === 'asc' ? filtered : [...filtered].reverse();\n  return {\n    records: ordered.slice(offset, offset + limit),\n    total: filtered.length,\n    limit,\n    offset,\n  };\n}\n\nfunction cloneRecord(record: AccessiAuditRecord): AccessiAuditRecord {\n  return JSON.parse(JSON.stringify(record)) as AccessiAuditRecord;\n}\n\n/** Opzioni del sink in memoria. */\nexport interface MemoryAccessiAuditSinkOptions {\n  name?: string;\n  /** Numero massimo di record conservati. Default: 10000. */\n  maxRecords?: number;\n  /** Retention in millisecondi. Default: nessuna scadenza. */\n  retentionMs?: number;\n  /** Orologio iniettabile per i test. */\n  now?: () => number;\n}\n\nexport interface MemoryAccessiAuditSink extends AccessiAuditQueryableSink {\n  all(): AccessiAuditRecord[];\n  clear(): void;\n}\n\n/**\n * Sink in memoria con query e retention.\n *\n * Adatto a sviluppo, test e singola istanza. Per piu istanze usare\n * `createRedisAccessiAuditSink` o un sink esterno.\n */\nexport function createMemoryAccessiAuditSink(\n  options: MemoryAccessiAuditSinkOptions = {},\n): MemoryAccessiAuditSink {\n  const maxRecords = Math.max(1, Math.trunc(options.maxRecords ?? 10_000));\n  const retentionMs = Math.max(0, Number(options.retentionMs ?? 0));\n  const now = options.now ?? Date.now;\n  let records: AccessiAuditRecord[] = [];\n\n  const purgeExpired = (): void => {\n    if (!retentionMs) return;\n    const threshold = now() - retentionMs;\n    records = records.filter((record) => recordTime(record) >= threshold);\n  };\n\n  return {\n    name: options.name ?? 'memory',\n    write(record) {\n      records.push(cloneRecord(record));\n      if (records.length > maxRecords) records = records.slice(records.length - maxRecords);\n      purgeExpired();\n    },\n    async query(query = {}) {\n      purgeExpired();\n      return paginate(records, query);\n    },\n    async purge(before: Date) {\n      const threshold = before.getTime();\n      const beforeCount = records.length;\n      records = records.filter((record) => recordTime(record) >= threshold);\n      return beforeCount - records.length;\n    },\n    all() {\n      return records.map(cloneRecord);\n    },\n    clear() {\n      records = [];\n    },\n  };\n}\n\n/** Sink HTTP: inoltra ogni record a un endpoint esterno (SIEM, collector). */\nexport interface HttpAccessiAuditSinkOptions {\n  name?: string;\n  url: string;\n  headers?: Record<string, string>;\n  fetch?: typeof fetch;\n  timeoutMs?: number;\n}\n\nexport function createHttpAccessiAuditSink(\n  options: HttpAccessiAuditSinkOptions,\n): AccessiAuditSink {\n  if (!options?.url) throw new Error('Audit sink HTTP: url obbligatoria.');\n  return {\n    name: options.name ?? 'http',\n    async write(record) {\n      const fetchImpl = options.fetch ?? globalThis.fetch;\n      if (typeof fetchImpl !== 'function') {\n        throw new Error('Audit sink HTTP: fetch non disponibile.');\n      }\n      const controller = new AbortController();\n      const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 3000);\n      try {\n        const response = await fetchImpl(options.url, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            ...(options.headers ?? {}),\n          },\n          body: JSON.stringify(record),\n          signal: controller.signal,\n        });\n        if (!response.ok) {\n          throw new Error(`Audit sink HTTP: risposta ${response.status}.`);\n        }\n      } finally {\n        clearTimeout(timeout);\n      }\n    },\n  };\n}\n\n/**\n * Adattatore per database, OpenTelemetry o qualunque destinazione custom.\n *\n * La callback riceve un record gia redatto e serializzabile.\n */\nexport function createCallbackAccessiAuditSink(\n  write: (record: AccessiAuditRecord) => void | Promise<void>,\n  name = 'callback',\n): AccessiAuditSink {\n  return { name, write };\n}\n\nexport interface RedisAccessiAuditSinkOptions {\n  client: AccessiRedisEvalClient;\n  name?: string;\n  /** Default: `accessi:audit:`. */\n  keyPrefix?: string;\n  /** Numero massimo di record. Default: 10000. */\n  maxRecords?: number;\n  /** Retention Redis in millisecondi. Default: 30 giorni. */\n  retentionMs?: number;\n}\n\nconst REDIS_WRITE_SCRIPT = `\nlocal key = KEYS[1]\nredis.call('RPUSH', key, ARGV[1])\nredis.call('LTRIM', key, -tonumber(ARGV[2]), -1)\nredis.call('PEXPIRE', key, ARGV[3])\nreturn 1\n`;\n\nconst REDIS_READ_SCRIPT = `return redis.call('LRANGE', KEYS[1], 0, -1)`;\n\nconst REDIS_REWRITE_SCRIPT = `\nlocal key = KEYS[1]\nredis.call('DEL', key)\nfor i = 2, #ARGV do\n  redis.call('RPUSH', key, ARGV[i])\nend\nredis.call('PEXPIRE', key, ARGV[1])\nreturn #ARGV - 1\n`;\n\nfunction parseRedisRecords(value: unknown): AccessiAuditRecord[] {\n  if (!Array.isArray(value)) return [];\n  const records: AccessiAuditRecord[] = [];\n  for (const entry of value) {\n    if (typeof entry !== 'string') continue;\n    try {\n      const parsed = JSON.parse(entry) as AccessiAuditRecord;\n      if (parsed && typeof parsed.event === 'string' && typeof parsed.timestamp === 'string') {\n        records.push(parsed);\n      }\n    } catch {\n      // Un record corrotto non deve bloccare query ed export.\n    }\n  }\n  return records;\n}\n\n/**\n * Sink Redis persistente, condiviso tra istanze e interrogabile.\n *\n * Usa una lista con `LTRIM` per limitare i record e `PEXPIRE` per la retention.\n * Le query leggono la lista e filtrano lato applicazione.\n */\nexport function createRedisAccessiAuditSink(\n  options: RedisAccessiAuditSinkOptions,\n): AccessiAuditQueryableSink {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Audit sink Redis: client.eval non configurato.');\n  }\n  const client = instrumentAccessiRedisClient('audit', options.client);\n  const key = `${(options.keyPrefix ?? 'accessi:audit:').replace(/:*$/, ':')}events`;\n  const maxRecords = Math.max(1, Math.trunc(options.maxRecords ?? 10_000));\n  const retentionMs = Math.max(1_000, Math.trunc(options.retentionMs ?? 30 * 24 * 60 * 60 * 1000));\n\n  const readAll = async (): Promise<AccessiAuditRecord[]> =>\n    parseRedisRecords(await client.eval(REDIS_READ_SCRIPT, 1, key));\n\n  return {\n    name: options.name ?? 'redis',\n    async write(record) {\n      await client.eval(REDIS_WRITE_SCRIPT, 1, key, JSON.stringify(record), maxRecords, retentionMs);\n    },\n    async query(query = {}) {\n      return paginate(await readAll(), query);\n    },\n    async purge(before: Date) {\n      const records = await readAll();\n      const kept = records.filter((record) => recordTime(record) >= before.getTime());\n      const removed = records.length - kept.length;\n      if (removed === 0) return 0;\n      await client.eval(\n        REDIS_REWRITE_SCRIPT,\n        1,\n        key,\n        retentionMs,\n        ...kept.map((record) => JSON.stringify(record)),\n      );\n      return removed;\n    },\n  };\n}\n"]}

package/dist/accessi-module/security/authCookies.d.ts

@@ -0,0 +1,104 @@
+import type { NextFunction, Request, Response } from 'express';
+import type { AccessiOptions } from '../AccessiModule';
+/** Modalita di autenticazione via cookie httpOnly. */
+export interface AccessiAuthCookieOptions {
+    /** Default `true`: la sola presenza dell'oggetto abilita la modalita cookie. */
+    enabled?: boolean;
+    /** `Secure` sui cookie. Default `true`; disattivare solo in sviluppo locale HTTP. */
+    secure?: boolean;
+    /** Default `lax`. Per SPA su altro dominio serve `none` insieme a `secure: true`. */
+    sameSite?: 'strict' | 'lax' | 'none';
+    /** Dominio dei cookie, opzionale. */
+    domain?: string;
+    /** Nome del cookie con l'access token. Default `accessi_access`. */
+    accessTokenName?: string;
+    /** Nome del cookie con il refresh token. Default `accessi_refresh`. */
+    refreshTokenName?: string;
+    /** Nome del cookie CSRF leggibile dal client. Default `accessi_csrf`. */
+    csrfTokenName?: string;
+    /** Path del cookie access. Default `/api/accessi`. */
+    accessPath?: string;
+    /** Path del cookie refresh. Default `/api/accessi/auth`. */
+    refreshPath?: string;
+    /** Path del cookie CSRF. Default `/`. */
+    csrfPath?: string;
+    /** Header CSRF richiesto. Default `x-csrf-token`. */
+    csrfHeaderName?: string;
+    /** `double-submit` (default) oppure `off` per host che gestiscono CSRF altrove. */
+    csrf?: 'double-submit' | 'off';
+    /**
+     * Restituisce comunque i token nel body JSON. Default `false`: in modalita
+     * cookie i token restano solo negli header httpOnly.
+     */
+    exposeTokens?: boolean;
+    /** Legge il refresh token dal cookie quando il body non lo contiene. Default `true`. */
+    refreshFromCookie?: boolean;
+}
+export type AccessiAuthCookieSetting = AccessiAuthCookieOptions;
+export interface ResolvedAccessiAuthCookieOptions {
+    secure: boolean;
+    sameSite: 'strict' | 'lax' | 'none';
+    domain?: string;
+    accessTokenName: string;
+    refreshTokenName: string;
+    csrfTokenName: string;
+    accessPath: string;
+    refreshPath: string;
+    csrfPath: string;
+    csrfHeaderName: string;
+    csrf: 'double-submit' | 'off';
+    exposeTokens: boolean;
+    refreshFromCookie: boolean;
+}
+export interface AccessiAuthTokenPair {
+    access?: string;
+    refresh?: string;
+}
+/** Risolve la configurazione dei cookie; `undefined` quando la modalita e disattivata. */
+export declare function resolveAccessiAuthCookieOptions(options: Pick<AccessiOptions, 'authCookie'>): ResolvedAccessiAuthCookieOptions | undefined;
+/** Legge i cookie senza aggiungere la dipendenza `cookie-parser`. */
+export declare function parseAccessiCookieHeader(header: string | undefined): Record<string, string>;
+/** True per richieste che modificano stato (dove serve il CSRF). */
+export declare function isAccessiUnsafeMethod(method: string): boolean;
+/** True per gli endpoint pubblici esenti da CSRF. */
+export declare function isAccessiCsrfExemptPath(path: string): boolean;
+/** Imposta i cookie access, refresh e (se assente) CSRF. */
+export declare function setAccessiAuthCookies(res: Pick<Response, 'append'>, config: ResolvedAccessiAuthCookieOptions, tokens: AccessiAuthTokenPair): void;
+/** Cancella i cookie di sessione (logout/revoca). */
+export declare function clearAccessiAuthCookies(res: Pick<Response, 'append'>, config: ResolvedAccessiAuthCookieOptions): void;
+export interface AccessiAuthTokenValue {
+    value?: string;
+}
+/** Forma comune dei risultati di auth: stringa o `TokenResult` di Accessi. */
+export interface AccessiAuthResultLike {
+    token?: string | AccessiAuthTokenValue;
+    refreshToken?: string | AccessiAuthTokenValue;
+}
+/**
+ * Prepara la risposta di login/refresh: imposta i cookie e rimuove i token dal
+ * body quando la modalita cookie non prevede `exposeTokens`.
+ */
+export declare function applyAccessiAuthCookies<T extends AccessiAuthResultLike>(res: Pick<Response, 'append'>, config: ResolvedAccessiAuthCookieOptions | undefined, result: T): T;
+/** Rimuove i token dal `LoginResult` quando la modalita cookie li nasconde. */
+export declare function hideAccessiLoginTokens(config: ResolvedAccessiAuthCookieOptions | undefined, result: {
+    token?: unknown;
+    refreshToken?: unknown;
+}): void;
+/** Legge l'access token dal cookie (per test e per host senza middleware). */
+export declare function getAccessiAccessTokenFromCookie(header: string | undefined, config: ResolvedAccessiAuthCookieOptions): string | undefined;
+/** Legge il refresh token dal cookie. */
+export declare function getAccessiRefreshTokenFromCookie(header: string | undefined, config: ResolvedAccessiAuthCookieOptions): string | undefined;
+/**
+ * Middleware della modalita cookie.
+ *
+ * - copia l'access token dal cookie nell'header `Authorization`, cosi guard,
+ *   middleware e controller esistenti funzionano senza modifiche;
+ * - garantisce un cookie CSRF double-submit leggibile dal client;
+ * - blocca le richieste autenticate via cookie che modificano stato senza
+ *   l'header CSRF, salvo endpoint pubblici di bootstrap della sessione.
+ */
+export declare function createAccessiAuthCookieMiddleware(options: Pick<AccessiOptions, 'authCookie'>, isAccessiRoute: (path: string) => boolean): ((req: Request, res: Response, next: NextFunction) => void) | undefined;
+/** True se il nome cookie e valido per l'header `Set-Cookie`. */
+export declare function isValidAccessiCookieName(name: string): boolean;
+/** Helpers per le combinazioni di cookie supportate (usati dalla validazione). */
+export declare function accessiCookieNames(config: ResolvedAccessiAuthCookieOptions): string[];