emilsoftware-utilities 2.0.0-dev.8 → 2.0.0-dev.81

package/dist/accessi-module/security/refreshTokenRotation.js

@@ -0,0 +1,206 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemoryRefreshTokenRotationStore = createMemoryRefreshTokenRotationStore;
+exports.createRedisRefreshTokenRotationStore = createRedisRefreshTokenRotationStore;
+exports.getRefreshTokenRotationStore = getRefreshTokenRotationStore;
+exports.isRefreshTokenFamilyRevoked = isRefreshTokenFamilyRevoked;
+exports.revokeRefreshTokenFamily = revokeRefreshTokenFamily;
+exports.consumeRefreshToken = consumeRefreshToken;
+exports.clearDefaultRefreshTokenRotations = clearDefaultRefreshTokenRotations;
+const redisMetrics_1 = require("../observability/redisMetrics");
+const CONSUME_SCRIPT = `
+local ttl = tonumber(ARGV[2])
+if not ttl or ttl <= 0 then return nil end
+local stored = redis.call('GET', KEYS[1])
+if not stored then
+  redis.call('SET', KEYS[1], ARGV[1], 'PX', ttl)
+  return {1, 0}
+end
+return {0, tonumber(stored) or 0}
+`;
+const REVOKE_FAMILY_SCRIPT = "if tonumber(ARGV[1]) > 0 then return redis.call('SET', KEYS[1], '1', 'PX', ARGV[1]) else return redis.call('SET', KEYS[1], '1') end";
+const IS_FAMILY_REVOKED_SCRIPT = "return redis.call('EXISTS', KEYS[1])";
+function parseConsumeResult(result) {
+    if (Array.isArray(result)) {
+        const consumed = Number(result[0]) === 1 || result[0] === true;
+        const consumedAtMs = Number(result[1]);
+        return Object.assign({ consumed }, (Number.isFinite(consumedAtMs) && consumedAtMs > 0 ? { consumedAtMs } : {}));
+    }
+    // Client minimali (o store precedenti) rispondono 'OK' / null.
+    return { consumed: result !== null && result !== undefined && result !== false };
+}
+function createMemoryRefreshTokenRotationStore() {
+    const used = new Map();
+    const revokedFamilies = new Map();
+    const prune = (now) => {
+        for (const [jti, entry] of used) {
+            if (entry.expiresAtMs <= now)
+                used.delete(jti);
+        }
+        for (const [familyId, expiresAt] of revokedFamilies) {
+            if (expiresAt <= now)
+                revokedFamilies.delete(familyId);
+        }
+    };
+    const consumeWithMetadata = (jti, expiresAtMs) => __awaiter(this, void 0, void 0, function* () {
+        const now = Date.now();
+        prune(now);
+        const existing = used.get(jti);
+        if (existing && existing.expiresAtMs > now) {
+            return { consumed: false, consumedAtMs: existing.consumedAtMs };
+        }
+        used.set(jti, { expiresAtMs, consumedAtMs: now });
+        return { consumed: true };
+    });
+    return {
+        consume(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                return (yield consumeWithMetadata(jti, expiresAtMs)).consumed;
+            });
+        },
+        consumeWithMetadata,
+        revokeFamily(familyId, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                revokedFamilies.set(familyId, Math.max(expiresAtMs, Date.now() + 1));
+            });
+        },
+        isFamilyRevoked(familyId) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const expiresAt = revokedFamilies.get(familyId);
+                if (expiresAt === undefined)
+                    return false;
+                if (expiresAt <= Date.now()) {
+                    revokedFamilies.delete(familyId);
+                    return false;
+                }
+                return true;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                return true;
+            });
+        },
+        clear() {
+            used.clear();
+            revokedFamilies.clear();
+        },
+    };
+}
+/**
+ * Store Redis per refresh token monouso.
+ *
+ * Il consumo e atomico: due refresh concorrenti dello stesso token producono
+ * un solo successo. La famiglia viene revocata con una chiave separata che
+ * scade insieme ai token che ne fanno parte.
+ */
+function createRedisRefreshTokenRotationStore(options) {
+    var _a, _b;
+    if (!(options === null || options === void 0 ? void 0 : options.client) || typeof options.client.eval !== 'function') {
+        throw new Error('Redis refresh rotation store: client.eval non configurato.');
+    }
+    const keyPrefix = ((_a = options.keyPrefix) !== null && _a !== void 0 ? _a : 'accessi:refresh-used:').replace(/:+$/, ':');
+    const familyKeyPrefix = ((_b = options.familyKeyPrefix) !== null && _b !== void 0 ? _b : 'accessi:refresh-family-revoked:').replace(/:+$/, ':');
+    const client = (0, redisMetrics_1.instrumentAccessiRedisClient)('refresh_token_rotation', options.client);
+    return {
+        consume(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const ttlMs = Math.max(1, Math.trunc(expiresAtMs - Date.now()));
+                const result = yield client.eval(CONSUME_SCRIPT, 1, `${keyPrefix}${jti}`, Date.now(), ttlMs);
+                return parseConsumeResult(result).consumed;
+            });
+        },
+        consumeWithMetadata(jti, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const ttlMs = Math.max(1, Math.trunc(expiresAtMs - Date.now()));
+                const result = yield client.eval(CONSUME_SCRIPT, 1, `${keyPrefix}${jti}`, Date.now(), ttlMs);
+                return parseConsumeResult(result);
+            });
+        },
+        revokeFamily(familyId, expiresAtMs) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const ttlMs = Math.max(0, Math.trunc(expiresAtMs - Date.now()));
+                yield client.eval(REVOKE_FAMILY_SCRIPT, 1, `${familyKeyPrefix}${familyId}`, ttlMs);
+            });
+        },
+        isFamilyRevoked(familyId) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const result = yield client.eval(IS_FAMILY_REVOKED_SCRIPT, 1, `${familyKeyPrefix}${familyId}`);
+                return Number(result) > 0;
+            });
+        },
+        healthCheck() {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    const result = yield client.eval("return redis.call('PING')", 0);
+                    return String(result).toUpperCase() === 'PONG';
+                }
+                catch (_a) {
+                    return false;
+                }
+            });
+        },
+    };
+}
+const defaultMemoryStore = createMemoryRefreshTokenRotationStore();
+function getRefreshTokenRotationStore(options) {
+    var _a, _b, _c;
+    if (((_a = options.refreshTokenRotation) === null || _a === void 0 ? void 0 : _a.enabled) === false)
+        return undefined;
+    if ((_b = options.refreshTokenRotation) === null || _b === void 0 ? void 0 : _b.store)
+        return options.refreshTokenRotation.store;
+    return ((_c = options.refreshTokenRotation) === null || _c === void 0 ? void 0 : _c.enabled) === true ? defaultMemoryStore : undefined;
+}
+/**
+ * True se la famiglia di refresh token e stata revocata. Ritorna false se lo
+ * store non supporta le famiglie (implementazioni legacy).
+ */
+function isRefreshTokenFamilyRevoked(options, familyId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (typeof familyId !== 'string' || familyId.trim() === '')
+            return false;
+        const store = getRefreshTokenRotationStore(options);
+        if (!(store === null || store === void 0 ? void 0 : store.isFamilyRevoked))
+            return false;
+        return store.isFamilyRevoked(familyId);
+    });
+}
+/**
+ * Revoca la famiglia di refresh token fino alla scadenza indicata. Ritorna
+ * false se lo store non supporta le famiglie.
+ */
+function revokeRefreshTokenFamily(options, familyId, expiresAtMs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const store = getRefreshTokenRotationStore(options);
+        if (!(store === null || store === void 0 ? void 0 : store.revokeFamily))
+            return false;
+        yield store.revokeFamily(familyId, expiresAtMs);
+        return true;
+    });
+}
+/** Consumo atomico con metadati, se lo store li supporta. */
+function consumeRefreshToken(options, jti, expiresAtMs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const store = getRefreshTokenRotationStore(options);
+        if (!store)
+            return undefined;
+        if (store.consumeWithMetadata) {
+            return store.consumeWithMetadata(jti, expiresAtMs);
+        }
+        return { consumed: yield store.consume(jti, expiresAtMs) };
+    });
+}
+/** Solo per test: azzera lo store in memoria di default. */
+function clearDefaultRefreshTokenRotations() {
+    defaultMemoryStore.clear();
+}
+//# sourceMappingURL=refreshTokenRotation.js.map

package/dist/accessi-module/security/refreshTokenRotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshTokenRotation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/refreshTokenRotation.ts"],"names":[],"mappings":";;;;;;;;;;;AA+EA,sFAoDC;AAqBD,oFAuDC;AAID,oEAMC;AAMD,kEAQC;AAMD,4DASC;AAGD,kDAWC;AAGD,8EAEC;AAxQD,gEAA6E;AAmD7E,MAAM,cAAc,GAAG;;;;;;;;;CAStB,CAAC;AACF,MAAM,oBAAoB,GACxB,qIAAqI,CAAC;AACxI,MAAM,wBAAwB,GAAG,sCAAsC,CAAC;AAExE,SAAS,kBAAkB,CAAC,MAAe;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,uBACE,QAAQ,IACL,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC9E;IACJ,CAAC;IACD,+DAA+D;IAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;AACnF,CAAC;AAED,SAAgB,qCAAqC;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyD,CAAC;IAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,eAAe,EAAE,CAAC;YACpD,IAAI,SAAS,IAAI,GAAG;gBAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,CAC1B,GAAW,EACX,WAAmB,EACiB,EAAE;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,CAAC,GAAG,CAAC,CAAC;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAA,CAAC;IAEF,OAAO;QACC,OAAO,CAAC,GAAG,EAAE,WAAW;;gBAC5B,OAAO,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChE,CAAC;SAAA;QACD,mBAAmB;QACb,YAAY,CAAC,QAAQ,EAAE,WAAW;;gBACtC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC;SAAA;QACK,eAAe,CAAC,QAAQ;;gBAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC1C,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC5B,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBACjC,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACD,KAAK;YACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,eAAe,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAcD;;;;;;GAMG;AACH,SAAgB,oCAAoC,CAClD,OAA8C;;IAE9C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,CAAC,MAAA,OAAO,CAAC,eAAe,mCAAI,iCAAiC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,IAAA,2CAA4B,EAAC,wBAAwB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAEtF,OAAO;QACC,OAAO,CAAC,GAAG,EAAE,WAAW;;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,cAAc,EACd,CAAC,EACD,GAAG,SAAS,GAAG,GAAG,EAAE,EACpB,IAAI,CAAC,GAAG,EAAE,EACV,KAAK,CACN,CAAC;gBACF,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;YAC7C,CAAC;SAAA;QAEK,mBAAmB,CAAC,GAAG,EAAE,WAAW;;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,cAAc,EACd,CAAC,EACD,GAAG,SAAS,GAAG,GAAG,EAAE,EACpB,IAAI,CAAC,GAAG,EAAE,EACV,KAAK,CACN,CAAC;gBACF,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;SAAA;QAEK,YAAY,CAAC,QAAQ,EAAE,WAAW;;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAChE,MAAM,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,EAAE,GAAG,eAAe,GAAG,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;YACrF,CAAC;SAAA;QAEK,eAAe,CAAC,QAAQ;;gBAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,EAAE,GAAG,eAAe,GAAG,QAAQ,EAAE,CAAC,CAAC;gBAC/F,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;SAAA;QAEK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,qCAAqC,EAAE,CAAC;AAEnE,SAAgB,4BAA4B,CAC1C,OAAuB;;IAEvB,IAAI,CAAA,MAAA,OAAO,CAAC,oBAAoB,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,MAAA,OAAO,CAAC,oBAAoB,0CAAE,KAAK;QAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;IACnF,OAAO,CAAA,MAAA,OAAO,CAAC,oBAAoB,0CAAE,OAAO,MAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,SAAsB,2BAA2B,CAC/C,OAAuB,EACvB,QAAiB;;QAEjB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QACzE,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,eAAe,CAAA;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;CAAA;AAED;;;GAGG;AACH,SAAsB,wBAAwB,CAC5C,OAAuB,EACvB,QAAgB,EAChB,WAAmB;;QAEnB,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,YAAY,CAAA;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,6DAA6D;AAC7D,SAAsB,mBAAmB,CACvC,OAAuB,EACvB,GAAW,EACX,WAAmB;;QAEnB,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;IAC7D,CAAC;CAAA;AAED,4DAA4D;AAC5D,SAAgB,iCAAiC;IAC/C,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\nimport { instrumentAccessiRedisClient } from '../observability/redisMetrics';\n\n/**\n * Store di rotazione refresh token.\n *\n * `consume` e atomico: restituisce true una sola volta per `jti`, poi il token\n * e considerato usato fino alla sua scadenza. In multi-istanza usare Redis.\n */\nexport interface RefreshTokenRotationStore {\n  consume(jti: string, expiresAtMs: number): Promise<boolean>;\n  /**\n   * Come `consume`, ma restituisce anche quando il token era gia stato\n   * consumato: serve a distinguere un retry concorrente da un possibile furto.\n   */\n  consumeWithMetadata?(jti: string, expiresAtMs: number): Promise<RefreshTokenConsumeResult>;\n  /** Revoca l'intera famiglia di refresh token (stesso login). */\n  revokeFamily?(familyId: string, expiresAtMs: number): Promise<void>;\n  /** True se la famiglia e stata revocata per riuso sospetto. */\n  isFamilyRevoked?(familyId: string): Promise<boolean>;\n  /** Health check opzionale per readiness del servizio. */\n  healthCheck?(): Promise<boolean>;\n}\n\n/** Esito del consumo atomico di un refresh token. */\nexport interface RefreshTokenConsumeResult {\n  consumed: boolean;\n  /** Quando il token era gia stato consumato, il timestamp del primo consumo. */\n  consumedAtMs?: number;\n}\n\nexport interface RefreshTokenRotationOptions {\n  /** Default: disabilitata se non viene fornito uno store. */\n  enabled?: boolean;\n  /** Store condiviso (es. Redis) per il monouso tra istanze. */\n  store?: RefreshTokenRotationStore;\n  /**\n   * Finestra entro cui il riuso di un token appena consumato e trattato come\n   * retry concorrente (nessuna revoca famiglia). Default: 10000 ms.\n   */\n  reuseGraceMs?: number;\n  /**\n   * Se true, dopo un riuso rilevato revoca anche tutte le sessioni utente.\n   * Default: false, per non disconnettere dispositivi legittimi.\n   */\n  revokeUserSessionsOnReuse?: boolean;\n}\n\nexport interface MemoryRefreshTokenRotationStore extends RefreshTokenRotationStore {\n  clear(): void;\n}\n\nconst CONSUME_SCRIPT = `\nlocal ttl = tonumber(ARGV[2])\nif not ttl or ttl <= 0 then return nil end\nlocal stored = redis.call('GET', KEYS[1])\nif not stored then\n  redis.call('SET', KEYS[1], ARGV[1], 'PX', ttl)\n  return {1, 0}\nend\nreturn {0, tonumber(stored) or 0}\n`;\nconst REVOKE_FAMILY_SCRIPT =\n  \"if tonumber(ARGV[1]) > 0 then return redis.call('SET', KEYS[1], '1', 'PX', ARGV[1]) else return redis.call('SET', KEYS[1], '1') end\";\nconst IS_FAMILY_REVOKED_SCRIPT = \"return redis.call('EXISTS', KEYS[1])\";\n\nfunction parseConsumeResult(result: unknown): RefreshTokenConsumeResult {\n  if (Array.isArray(result)) {\n    const consumed = Number(result[0]) === 1 || result[0] === true;\n    const consumedAtMs = Number(result[1]);\n    return {\n      consumed,\n      ...(Number.isFinite(consumedAtMs) && consumedAtMs > 0 ? { consumedAtMs } : {}),\n    };\n  }\n  // Client minimali (o store precedenti) rispondono 'OK' / null.\n  return { consumed: result !== null && result !== undefined && result !== false };\n}\n\nexport function createMemoryRefreshTokenRotationStore(): MemoryRefreshTokenRotationStore {\n  const used = new Map<string, { expiresAtMs: number; consumedAtMs: number }>();\n  const revokedFamilies = new Map<string, number>();\n\n  const prune = (now: number) => {\n    for (const [jti, entry] of used) {\n      if (entry.expiresAtMs <= now) used.delete(jti);\n    }\n    for (const [familyId, expiresAt] of revokedFamilies) {\n      if (expiresAt <= now) revokedFamilies.delete(familyId);\n    }\n  };\n\n  const consumeWithMetadata = async (\n    jti: string,\n    expiresAtMs: number,\n  ): Promise<RefreshTokenConsumeResult> => {\n    const now = Date.now();\n    prune(now);\n    const existing = used.get(jti);\n    if (existing && existing.expiresAtMs > now) {\n      return { consumed: false, consumedAtMs: existing.consumedAtMs };\n    }\n    used.set(jti, { expiresAtMs, consumedAtMs: now });\n    return { consumed: true };\n  };\n\n  return {\n    async consume(jti, expiresAtMs) {\n      return (await consumeWithMetadata(jti, expiresAtMs)).consumed;\n    },\n    consumeWithMetadata,\n    async revokeFamily(familyId, expiresAtMs) {\n      revokedFamilies.set(familyId, Math.max(expiresAtMs, Date.now() + 1));\n    },\n    async isFamilyRevoked(familyId) {\n      const expiresAt = revokedFamilies.get(familyId);\n      if (expiresAt === undefined) return false;\n      if (expiresAt <= Date.now()) {\n        revokedFamilies.delete(familyId);\n        return false;\n      }\n      return true;\n    },\n    async healthCheck() {\n      return true;\n    },\n    clear() {\n      used.clear();\n      revokedFamilies.clear();\n    },\n  };\n}\n\nexport interface RefreshTokenRotationRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisRefreshTokenRotationStoreOptions {\n  client: RefreshTokenRotationRedisClient;\n  /** Default: `accessi:refresh-used:`. */\n  keyPrefix?: string;\n  /** Default: `accessi:refresh-family-revoked:`. */\n  familyKeyPrefix?: string;\n}\n\n/**\n * Store Redis per refresh token monouso.\n *\n * Il consumo e atomico: due refresh concorrenti dello stesso token producono\n * un solo successo. La famiglia viene revocata con una chiave separata che\n * scade insieme ai token che ne fanno parte.\n */\nexport function createRedisRefreshTokenRotationStore(\n  options: RedisRefreshTokenRotationStoreOptions,\n): RefreshTokenRotationStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis refresh rotation store: client.eval non configurato.');\n  }\n\n  const keyPrefix = (options.keyPrefix ?? 'accessi:refresh-used:').replace(/:+$/, ':');\n  const familyKeyPrefix = (options.familyKeyPrefix ?? 'accessi:refresh-family-revoked:').replace(/:+$/, ':');\n  const client = instrumentAccessiRedisClient('refresh_token_rotation', options.client);\n\n  return {\n    async consume(jti, expiresAtMs) {\n      const ttlMs = Math.max(1, Math.trunc(expiresAtMs - Date.now()));\n      const result = await client.eval(\n        CONSUME_SCRIPT,\n        1,\n        `${keyPrefix}${jti}`,\n        Date.now(),\n        ttlMs,\n      );\n      return parseConsumeResult(result).consumed;\n    },\n\n    async consumeWithMetadata(jti, expiresAtMs) {\n      const ttlMs = Math.max(1, Math.trunc(expiresAtMs - Date.now()));\n      const result = await client.eval(\n        CONSUME_SCRIPT,\n        1,\n        `${keyPrefix}${jti}`,\n        Date.now(),\n        ttlMs,\n      );\n      return parseConsumeResult(result);\n    },\n\n    async revokeFamily(familyId, expiresAtMs) {\n      const ttlMs = Math.max(0, Math.trunc(expiresAtMs - Date.now()));\n      await client.eval(REVOKE_FAMILY_SCRIPT, 1, `${familyKeyPrefix}${familyId}`, ttlMs);\n    },\n\n    async isFamilyRevoked(familyId) {\n      const result = await client.eval(IS_FAMILY_REVOKED_SCRIPT, 1, `${familyKeyPrefix}${familyId}`);\n      return Number(result) > 0;\n    },\n\n    async healthCheck() {\n      try {\n        const result = await client.eval(\"return redis.call('PING')\", 0);\n        return String(result).toUpperCase() === 'PONG';\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n\nconst defaultMemoryStore = createMemoryRefreshTokenRotationStore();\n\nexport function getRefreshTokenRotationStore(\n  options: AccessiOptions,\n): RefreshTokenRotationStore | undefined {\n  if (options.refreshTokenRotation?.enabled === false) return undefined;\n  if (options.refreshTokenRotation?.store) return options.refreshTokenRotation.store;\n  return options.refreshTokenRotation?.enabled === true ? defaultMemoryStore : undefined;\n}\n\n/**\n * True se la famiglia di refresh token e stata revocata. Ritorna false se lo\n * store non supporta le famiglie (implementazioni legacy).\n */\nexport async function isRefreshTokenFamilyRevoked(\n  options: AccessiOptions,\n  familyId: unknown,\n): Promise<boolean> {\n  if (typeof familyId !== 'string' || familyId.trim() === '') return false;\n  const store = getRefreshTokenRotationStore(options);\n  if (!store?.isFamilyRevoked) return false;\n  return store.isFamilyRevoked(familyId);\n}\n\n/**\n * Revoca la famiglia di refresh token fino alla scadenza indicata. Ritorna\n * false se lo store non supporta le famiglie.\n */\nexport async function revokeRefreshTokenFamily(\n  options: AccessiOptions,\n  familyId: string,\n  expiresAtMs: number,\n): Promise<boolean> {\n  const store = getRefreshTokenRotationStore(options);\n  if (!store?.revokeFamily) return false;\n  await store.revokeFamily(familyId, expiresAtMs);\n  return true;\n}\n\n/** Consumo atomico con metadati, se lo store li supporta. */\nexport async function consumeRefreshToken(\n  options: AccessiOptions,\n  jti: string,\n  expiresAtMs: number,\n): Promise<RefreshTokenConsumeResult | undefined> {\n  const store = getRefreshTokenRotationStore(options);\n  if (!store) return undefined;\n  if (store.consumeWithMetadata) {\n    return store.consumeWithMetadata(jti, expiresAtMs);\n  }\n  return { consumed: await store.consume(jti, expiresAtMs) };\n}\n\n/** Solo per test: azzera lo store in memoria di default. */\nexport function clearDefaultRefreshTokenRotations(): void {\n  defaultMemoryStore.clear();\n}\n"]}

package/dist/accessi-module/security/securityHeaders.d.ts

@@ -0,0 +1,89 @@
+import type { NextFunction, Request, Response } from 'express';
+/** Direttive CSP personalizzabili; `false` rimuove la direttiva. */
+export type AccessiCspDirectives = Record<string, string[] | false>;
+/** Opzioni della Content Security Policy di Accessi. */
+export interface AccessiCspOptions {
+    /** `false` disabilita solo la CSP, lasciando gli altri header. Default: abilitata. */
+    enabled?: boolean;
+    /** Invia `Content-Security-Policy-Report-Only` invece dell'header bloccante. */
+    reportOnly?: boolean;
+    /** Endpoint `report-uri` per la raccolta delle violazioni. */
+    reportUri?: string;
+    /** Origini aggiuntive per `connect-src`, es. API su un dominio diverso. */
+    connectSrc?: string[];
+    /**
+     * Override delle direttive (vincono sui default). Per esempio
+     * `{ "img-src": ["'self'", "data:", "https:"] }`.
+     */
+    directives?: AccessiCspDirectives;
+    /**
+     * La UI Swagger usa script e stili inline generati a runtime.
+     * Default `true`: la CSP di OpenAPI include `'unsafe-inline'` solo lì.
+     */
+    swaggerUnsafeInline?: boolean;
+}
+/** Header di sicurezza applicati alle rotte Accessi. */
+export interface AccessiSecurityHeadersOptions {
+    /** `false` disabilita tutti gli header gestiti da Accessi. */
+    enabled?: boolean;
+    /** `X-Frame-Options`; `false` non lo invia. Default: `SAMEORIGIN`. */
+    frameOptions?: string | false;
+    /** `Referrer-Policy`; `false` non la invia. Default: `no-referrer`. */
+    referrerPolicy?: string | false;
+    /** `Permissions-Policy`; `false` non la invia. */
+    permissionsPolicy?: string | false;
+    /** `Cache-Control` della shell console. Default: `no-store, max-age=0`. */
+    cacheControl?: string | false;
+    /** CSP; `false` la disabilita. Default: abilitata. */
+    contentSecurityPolicy?: false | AccessiCspOptions;
+}
+export type AccessiSecurityHeadersSetting = boolean | AccessiSecurityHeadersOptions;
+export interface ResolvedAccessiCsp {
+    reportOnly: boolean;
+    reportUri?: string;
+    connectSrc: string[];
+    directives: AccessiCspDirectives;
+    swaggerUnsafeInline: boolean;
+}
+export interface ResolvedAccessiSecurityHeaders {
+    frameOptions: string;
+    referrerPolicy: string;
+    permissionsPolicy: string;
+    cacheControl: string;
+    contentSecurityPolicy: false | ResolvedAccessiCsp;
+}
+/** Superficie della risposta: cambia solo la CSP, non gli altri header. */
+export type AccessiCspSurface = 'console' | 'openapi' | 'api';
+/**
+ * Risolve la configurazione degli header. `undefined` e `true` equivalgono ai
+ * default; `false` disabilita tutto. La forma booleana storica resta valida.
+ */
+export declare function resolveAccessiSecurityHeaders(setting: AccessiSecurityHeadersSetting | undefined): ResolvedAccessiSecurityHeaders | undefined;
+/**
+ * Costruisce la CSP per la superficie richiesta.
+ *
+ * La console usa un nonce per i due script inline della shell; la UI Swagger
+ * richiede `'unsafe-inline'` (documentato in `docs/security-headers.md`) e non
+ * riceve mai il nonce della console.
+ */
+export declare function buildAccessiContentSecurityPolicy(resolved: ResolvedAccessiSecurityHeaders, surface: AccessiCspSurface, options?: {
+    nonce?: string;
+    connectSrc?: string[];
+}): string | undefined;
+/** Applica l'header CSP corretto per la superficie, se configurata. */
+export declare function applyAccessiContentSecurityPolicy(res: Pick<Response, 'setHeader'>, resolved: ResolvedAccessiSecurityHeaders, surface: AccessiCspSurface, options?: {
+    nonce?: string;
+    connectSrc?: string[];
+}): string | undefined;
+/** Header comuni (frame, referrer, permessi) senza la CSP. */
+export declare function applyAccessiBaseSecurityHeaders(res: Pick<Response, 'setHeader'>, resolved: ResolvedAccessiSecurityHeaders): void;
+/**
+ * Middleware per host Express/Nest.
+ *
+ * Applica gli header solo alle rotte Accessi. La CSP della console viene
+ * sovrascritta dal controller con il nonce della richiesta; per la UI OpenAPI
+ * vale la variante Swagger.
+ */
+export declare function createAccessiSecurityHeadersMiddleware(setting: AccessiSecurityHeadersSetting | undefined, isAccessiRoute: (path: string) => boolean, options?: {
+    isOpenApiUi?: (path: string) => boolean;
+}): ((req: Request, res: Response, next: NextFunction) => void) | undefined;

package/dist/accessi-module/security/securityHeaders.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAccessiSecurityHeaders = resolveAccessiSecurityHeaders;
+exports.buildAccessiContentSecurityPolicy = buildAccessiContentSecurityPolicy;
+exports.applyAccessiContentSecurityPolicy = applyAccessiContentSecurityPolicy;
+exports.applyAccessiBaseSecurityHeaders = applyAccessiBaseSecurityHeaders;
+exports.createAccessiSecurityHeadersMiddleware = createAccessiSecurityHeadersMiddleware;
+const DEFAULTS = {
+    frameOptions: 'SAMEORIGIN',
+    referrerPolicy: 'no-referrer',
+    permissionsPolicy: 'camera=(), microphone=(), geolocation=()',
+    cacheControl: 'no-store, max-age=0',
+};
+/**
+ * Risolve la configurazione degli header. `undefined` e `true` equivalgono ai
+ * default; `false` disabilita tutto. La forma booleana storica resta valida.
+ */
+function resolveAccessiSecurityHeaders(setting) {
+    var _a, _b, _c, _d, _e, _f;
+    if (setting === false)
+        return undefined;
+    const options = setting === true || setting === undefined ? {} : setting;
+    if (options.enabled === false)
+        return undefined;
+    const csp = options.contentSecurityPolicy;
+    return {
+        frameOptions: options.frameOptions === false ? '' : ((_a = options.frameOptions) !== null && _a !== void 0 ? _a : DEFAULTS.frameOptions),
+        referrerPolicy: options.referrerPolicy === false ? '' : ((_b = options.referrerPolicy) !== null && _b !== void 0 ? _b : DEFAULTS.referrerPolicy),
+        permissionsPolicy: options.permissionsPolicy === false
+            ? ''
+            : ((_c = options.permissionsPolicy) !== null && _c !== void 0 ? _c : DEFAULTS.permissionsPolicy),
+        cacheControl: options.cacheControl === false ? '' : ((_d = options.cacheControl) !== null && _d !== void 0 ? _d : DEFAULTS.cacheControl),
+        contentSecurityPolicy: csp === false || (csp === null || csp === void 0 ? void 0 : csp.enabled) === false
+            ? false
+            : Object.assign(Object.assign({ reportOnly: (csp === null || csp === void 0 ? void 0 : csp.reportOnly) === true }, ((csp === null || csp === void 0 ? void 0 : csp.reportUri) ? { reportUri: csp.reportUri } : {})), { connectSrc: (_e = csp === null || csp === void 0 ? void 0 : csp.connectSrc) !== null && _e !== void 0 ? _e : [], directives: (_f = csp === null || csp === void 0 ? void 0 : csp.directives) !== null && _f !== void 0 ? _f : {}, swaggerUnsafeInline: (csp === null || csp === void 0 ? void 0 : csp.swaggerUnsafeInline) !== false }),
+    };
+}
+function frameAncestors(frameOptions) {
+    switch (frameOptions.toUpperCase()) {
+        case 'DENY':
+            return "'none'";
+        case 'SAMEORIGIN':
+        default:
+            return "'self'";
+    }
+}
+const BASE_DIRECTIVES = {
+    'default-src': ["'self'"],
+    'base-uri': ["'none'"],
+    'object-src': ["'none'"],
+    'form-action': ["'self'"],
+    'img-src': ["'self'", 'data:'],
+    'font-src': ["'self'"],
+    'style-src': ["'self'"],
+    'script-src': ["'self'"],
+    'connect-src': ["'self'"],
+};
+function listOf(directives, name) {
+    const value = directives[name];
+    return Array.isArray(value) ? value : [];
+}
+/**
+ * Costruisce la CSP per la superficie richiesta.
+ *
+ * La console usa un nonce per i due script inline della shell; la UI Swagger
+ * richiede `'unsafe-inline'` (documentato in `docs/security-headers.md`) e non
+ * riceve mai il nonce della console.
+ */
+function buildAccessiContentSecurityPolicy(resolved, surface, options = {}) {
+    var _a;
+    const csp = resolved.contentSecurityPolicy;
+    if (!csp)
+        return undefined;
+    const directives = {};
+    for (const [name, value] of Object.entries(BASE_DIRECTIVES)) {
+        directives[name] = Array.isArray(value) ? [...value] : value;
+    }
+    if (resolved.frameOptions) {
+        directives['frame-ancestors'] = [frameAncestors(resolved.frameOptions)];
+    }
+    const connectSrc = new Set([...listOf(directives, 'connect-src'), ...csp.connectSrc, ...((_a = options.connectSrc) !== null && _a !== void 0 ? _a : [])]);
+    directives['connect-src'] = [...connectSrc];
+    if (surface === 'console') {
+        if (options.nonce) {
+            directives['script-src'] = [...listOf(directives, 'script-src'), `'nonce-${options.nonce}'`];
+        }
+    }
+    else if (surface === 'openapi' && csp.swaggerUnsafeInline) {
+        directives['script-src'] = [...listOf(directives, 'script-src'), "'unsafe-inline'"];
+        directives['style-src'] = [...listOf(directives, 'style-src'), "'unsafe-inline'"];
+    }
+    for (const [name, value] of Object.entries(csp.directives)) {
+        if (value === false)
+            delete directives[name];
+        else
+            directives[name] = [...value];
+    }
+    if (csp.reportUri)
+        directives['report-uri'] = [csp.reportUri];
+    return Object.entries(directives)
+        .filter(([, value]) => value !== false && value.length > 0)
+        .map(([name, value]) => `${name} ${value.join(' ')}`)
+        .join('; ');
+}
+/** Applica l'header CSP corretto per la superficie, se configurata. */
+function applyAccessiContentSecurityPolicy(res, resolved, surface, options = {}) {
+    const csp = resolved.contentSecurityPolicy;
+    if (!csp)
+        return undefined;
+    const policy = buildAccessiContentSecurityPolicy(resolved, surface, options);
+    if (!policy)
+        return undefined;
+    res.setHeader(csp.reportOnly ? 'Content-Security-Policy-Report-Only' : 'Content-Security-Policy', policy);
+    return policy;
+}
+/** Header comuni (frame, referrer, permessi) senza la CSP. */
+function applyAccessiBaseSecurityHeaders(res, resolved) {
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    if (resolved.frameOptions)
+        res.setHeader('X-Frame-Options', resolved.frameOptions);
+    if (resolved.referrerPolicy)
+        res.setHeader('Referrer-Policy', resolved.referrerPolicy);
+    if (resolved.permissionsPolicy)
+        res.setHeader('Permissions-Policy', resolved.permissionsPolicy);
+}
+/**
+ * Middleware per host Express/Nest.
+ *
+ * Applica gli header solo alle rotte Accessi. La CSP della console viene
+ * sovrascritta dal controller con il nonce della richiesta; per la UI OpenAPI
+ * vale la variante Swagger.
+ */
+function createAccessiSecurityHeadersMiddleware(setting, isAccessiRoute, options = {}) {
+    const resolved = resolveAccessiSecurityHeaders(setting);
+    if (!resolved)
+        return undefined;
+    return (req, res, next) => {
+        var _a;
+        if (!isAccessiRoute(req.path)) {
+            next();
+            return;
+        }
+        applyAccessiBaseSecurityHeaders(res, resolved);
+        if (resolved.contentSecurityPolicy) {
+            const surface = ((_a = options.isOpenApiUi) === null || _a === void 0 ? void 0 : _a.call(options, req.path))
+                ? 'openapi'
+                : req.path.startsWith('/api/accessi/console')
+                    ? 'console'
+                    : 'api';
+            applyAccessiContentSecurityPolicy(res, resolved, surface);
+        }
+        next();
+    };
+}
+//# sourceMappingURL=securityHeaders.js.map

package/dist/accessi-module/security/securityHeaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityHeaders.js","sourceRoot":"","sources":["../../../src/accessi-module/security/securityHeaders.ts"],"names":[],"mappings":";;AA2EA,sEAyBC;AAoCD,8EAsCC;AAGD,8EAeC;AAGD,0EAQC;AASD,wFAwBC;AA5KD,MAAM,QAAQ,GAAG;IACf,YAAY,EAAE,YAAY;IAC1B,cAAc,EAAE,aAAa;IAC7B,iBAAiB,EAAE,0CAA0C;IAC7D,YAAY,EAAE,qBAAqB;CAC3B,CAAC;AAEX;;;GAGG;AACH,SAAgB,6BAA6B,CAC3C,OAAkD;;IAElD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAkC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACxG,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,GAAG,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAC1C,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAA,OAAO,CAAC,YAAY,mCAAI,QAAQ,CAAC,YAAY,CAAC;QACnG,cAAc,EAAE,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAA,OAAO,CAAC,cAAc,mCAAI,QAAQ,CAAC,cAAc,CAAC;QAC3G,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,KAAK,KAAK;YACpD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,MAAA,OAAO,CAAC,iBAAiB,mCAAI,QAAQ,CAAC,iBAAiB,CAAC;QAC7D,YAAY,EAAE,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAA,OAAO,CAAC,YAAY,mCAAI,QAAQ,CAAC,YAAY,CAAC;QACnG,qBAAqB,EAAE,GAAG,KAAK,KAAK,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,MAAK,KAAK;YAC5D,CAAC,CAAC,KAAK;YACP,CAAC,+BACG,UAAU,EAAE,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,MAAK,IAAI,IACjC,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,EAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACvD,UAAU,EAAE,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,mCAAI,EAAE,EACjC,UAAU,EAAE,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,mCAAI,EAAE,EACjC,mBAAmB,EAAE,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,mBAAmB,MAAK,KAAK,GACxD;KACN,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,YAAoB;IAC1C,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC;QAClB,KAAK,YAAY,CAAC;QAClB;YACE,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAyB;IAC5C,aAAa,EAAE,CAAC,QAAQ,CAAC;IACzB,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,aAAa,EAAE,CAAC,QAAQ,CAAC;IACzB,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC9B,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,WAAW,EAAE,CAAC,QAAQ,CAAC;IACvB,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,aAAa,EAAE,CAAC,QAAQ,CAAC;CAC1B,CAAC;AAEF,SAAS,MAAM,CAAC,UAAgC,EAAE,IAAY;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iCAAiC,CAC/C,QAAwC,EACxC,OAA0B,EAC1B,UAAqD,EAAE;;IAEvD,MAAM,GAAG,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5D,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1B,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrH,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IAE5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC5D,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACpF,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;;YACxC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,CAAC,SAAS;QAAE,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAE9D,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAK,KAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;SAClE,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAgB,iCAAiC,CAC/C,GAAgC,EAChC,QAAwC,EACxC,OAA0B,EAC1B,UAAqD,EAAE;IAEvD,MAAM,GAAG,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,iCAAiC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,GAAG,CAAC,SAAS,CACX,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,yBAAyB,EAClF,MAAM,CACP,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8DAA8D;AAC9D,SAAgB,+BAA+B,CAC7C,GAAgC,EAChC,QAAwC;IAExC,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,YAAY;QAAE,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,cAAc;QAAE,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IACvF,IAAI,QAAQ,CAAC,iBAAiB;QAAE,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sCAAsC,CACpD,OAAkD,EAClD,cAAyC,EACzC,UAAuD,EAAE;IAEzD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;;QAC/D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,+BAA+B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YACnC,MAAM,OAAO,GAAsB,CAAA,MAAA,OAAO,CAAC,WAAW,wDAAG,GAAG,CAAC,IAAI,CAAC;gBAChE,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC;oBAC3C,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,KAAK,CAAC;YACZ,iCAAiC,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\n/** Direttive CSP personalizzabili; `false` rimuove la direttiva. */\nexport type AccessiCspDirectives = Record<string, string[] | false>;\n\n/** Opzioni della Content Security Policy di Accessi. */\nexport interface AccessiCspOptions {\n  /** `false` disabilita solo la CSP, lasciando gli altri header. Default: abilitata. */\n  enabled?: boolean;\n  /** Invia `Content-Security-Policy-Report-Only` invece dell'header bloccante. */\n  reportOnly?: boolean;\n  /** Endpoint `report-uri` per la raccolta delle violazioni. */\n  reportUri?: string;\n  /** Origini aggiuntive per `connect-src`, es. API su un dominio diverso. */\n  connectSrc?: string[];\n  /**\n   * Override delle direttive (vincono sui default). Per esempio\n   * `{ \"img-src\": [\"'self'\", \"data:\", \"https:\"] }`.\n   */\n  directives?: AccessiCspDirectives;\n  /**\n   * La UI Swagger usa script e stili inline generati a runtime.\n   * Default `true`: la CSP di OpenAPI include `'unsafe-inline'` solo lì.\n   */\n  swaggerUnsafeInline?: boolean;\n}\n\n/** Header di sicurezza applicati alle rotte Accessi. */\nexport interface AccessiSecurityHeadersOptions {\n  /** `false` disabilita tutti gli header gestiti da Accessi. */\n  enabled?: boolean;\n  /** `X-Frame-Options`; `false` non lo invia. Default: `SAMEORIGIN`. */\n  frameOptions?: string | false;\n  /** `Referrer-Policy`; `false` non la invia. Default: `no-referrer`. */\n  referrerPolicy?: string | false;\n  /** `Permissions-Policy`; `false` non la invia. */\n  permissionsPolicy?: string | false;\n  /** `Cache-Control` della shell console. Default: `no-store, max-age=0`. */\n  cacheControl?: string | false;\n  /** CSP; `false` la disabilita. Default: abilitata. */\n  contentSecurityPolicy?: false | AccessiCspOptions;\n}\n\nexport type AccessiSecurityHeadersSetting = boolean | AccessiSecurityHeadersOptions;\n\nexport interface ResolvedAccessiCsp {\n  reportOnly: boolean;\n  reportUri?: string;\n  connectSrc: string[];\n  directives: AccessiCspDirectives;\n  swaggerUnsafeInline: boolean;\n}\n\nexport interface ResolvedAccessiSecurityHeaders {\n  frameOptions: string;\n  referrerPolicy: string;\n  permissionsPolicy: string;\n  cacheControl: string;\n  contentSecurityPolicy: false | ResolvedAccessiCsp;\n}\n\n/** Superficie della risposta: cambia solo la CSP, non gli altri header. */\nexport type AccessiCspSurface = 'console' | 'openapi' | 'api';\n\nconst DEFAULTS = {\n  frameOptions: 'SAMEORIGIN',\n  referrerPolicy: 'no-referrer',\n  permissionsPolicy: 'camera=(), microphone=(), geolocation=()',\n  cacheControl: 'no-store, max-age=0',\n} as const;\n\n/**\n * Risolve la configurazione degli header. `undefined` e `true` equivalgono ai\n * default; `false` disabilita tutto. La forma booleana storica resta valida.\n */\nexport function resolveAccessiSecurityHeaders(\n  setting: AccessiSecurityHeadersSetting | undefined,\n): ResolvedAccessiSecurityHeaders | undefined {\n  if (setting === false) return undefined;\n  const options: AccessiSecurityHeadersOptions = setting === true || setting === undefined ? {} : setting;\n  if (options.enabled === false) return undefined;\n\n  const csp = options.contentSecurityPolicy;\n  return {\n    frameOptions: options.frameOptions === false ? '' : (options.frameOptions ?? DEFAULTS.frameOptions),\n    referrerPolicy: options.referrerPolicy === false ? '' : (options.referrerPolicy ?? DEFAULTS.referrerPolicy),\n    permissionsPolicy: options.permissionsPolicy === false\n      ? ''\n      : (options.permissionsPolicy ?? DEFAULTS.permissionsPolicy),\n    cacheControl: options.cacheControl === false ? '' : (options.cacheControl ?? DEFAULTS.cacheControl),\n    contentSecurityPolicy: csp === false || csp?.enabled === false\n      ? false\n      : {\n          reportOnly: csp?.reportOnly === true,\n          ...(csp?.reportUri ? { reportUri: csp.reportUri } : {}),\n          connectSrc: csp?.connectSrc ?? [],\n          directives: csp?.directives ?? {},\n          swaggerUnsafeInline: csp?.swaggerUnsafeInline !== false,\n        },\n  };\n}\n\nfunction frameAncestors(frameOptions: string): string {\n  switch (frameOptions.toUpperCase()) {\n    case 'DENY':\n      return \"'none'\";\n    case 'SAMEORIGIN':\n    default:\n      return \"'self'\";\n  }\n}\n\nconst BASE_DIRECTIVES: AccessiCspDirectives = {\n  'default-src': [\"'self'\"],\n  'base-uri': [\"'none'\"],\n  'object-src': [\"'none'\"],\n  'form-action': [\"'self'\"],\n  'img-src': [\"'self'\", 'data:'],\n  'font-src': [\"'self'\"],\n  'style-src': [\"'self'\"],\n  'script-src': [\"'self'\"],\n  'connect-src': [\"'self'\"],\n};\n\nfunction listOf(directives: AccessiCspDirectives, name: string): string[] {\n  const value = directives[name];\n  return Array.isArray(value) ? value : [];\n}\n\n/**\n * Costruisce la CSP per la superficie richiesta.\n *\n * La console usa un nonce per i due script inline della shell; la UI Swagger\n * richiede `'unsafe-inline'` (documentato in `docs/security-headers.md`) e non\n * riceve mai il nonce della console.\n */\nexport function buildAccessiContentSecurityPolicy(\n  resolved: ResolvedAccessiSecurityHeaders,\n  surface: AccessiCspSurface,\n  options: { nonce?: string; connectSrc?: string[] } = {},\n): string | undefined {\n  const csp = resolved.contentSecurityPolicy;\n  if (!csp) return undefined;\n\n  const directives: AccessiCspDirectives = {};\n  for (const [name, value] of Object.entries(BASE_DIRECTIVES)) {\n    directives[name] = Array.isArray(value) ? [...value] : value;\n  }\n  if (resolved.frameOptions) {\n    directives['frame-ancestors'] = [frameAncestors(resolved.frameOptions)];\n  }\n\n  const connectSrc = new Set([...listOf(directives, 'connect-src'), ...csp.connectSrc, ...(options.connectSrc ?? [])]);\n  directives['connect-src'] = [...connectSrc];\n\n  if (surface === 'console') {\n    if (options.nonce) {\n      directives['script-src'] = [...listOf(directives, 'script-src'), `'nonce-${options.nonce}'`];\n    }\n  } else if (surface === 'openapi' && csp.swaggerUnsafeInline) {\n    directives['script-src'] = [...listOf(directives, 'script-src'), \"'unsafe-inline'\"];\n    directives['style-src'] = [...listOf(directives, 'style-src'), \"'unsafe-inline'\"];\n  }\n\n  for (const [name, value] of Object.entries(csp.directives)) {\n    if (value === false) delete directives[name];\n    else directives[name] = [...value];\n  }\n  if (csp.reportUri) directives['report-uri'] = [csp.reportUri];\n\n  return Object.entries(directives)\n    .filter(([, value]) => value !== false && value.length > 0)\n    .map(([name, value]) => `${name} ${(value as string[]).join(' ')}`)\n    .join('; ');\n}\n\n/** Applica l'header CSP corretto per la superficie, se configurata. */\nexport function applyAccessiContentSecurityPolicy(\n  res: Pick<Response, 'setHeader'>,\n  resolved: ResolvedAccessiSecurityHeaders,\n  surface: AccessiCspSurface,\n  options: { nonce?: string; connectSrc?: string[] } = {},\n): string | undefined {\n  const csp = resolved.contentSecurityPolicy;\n  if (!csp) return undefined;\n  const policy = buildAccessiContentSecurityPolicy(resolved, surface, options);\n  if (!policy) return undefined;\n  res.setHeader(\n    csp.reportOnly ? 'Content-Security-Policy-Report-Only' : 'Content-Security-Policy',\n    policy,\n  );\n  return policy;\n}\n\n/** Header comuni (frame, referrer, permessi) senza la CSP. */\nexport function applyAccessiBaseSecurityHeaders(\n  res: Pick<Response, 'setHeader'>,\n  resolved: ResolvedAccessiSecurityHeaders,\n): void {\n  res.setHeader('X-Content-Type-Options', 'nosniff');\n  if (resolved.frameOptions) res.setHeader('X-Frame-Options', resolved.frameOptions);\n  if (resolved.referrerPolicy) res.setHeader('Referrer-Policy', resolved.referrerPolicy);\n  if (resolved.permissionsPolicy) res.setHeader('Permissions-Policy', resolved.permissionsPolicy);\n}\n\n/**\n * Middleware per host Express/Nest.\n *\n * Applica gli header solo alle rotte Accessi. La CSP della console viene\n * sovrascritta dal controller con il nonce della richiesta; per la UI OpenAPI\n * vale la variante Swagger.\n */\nexport function createAccessiSecurityHeadersMiddleware(\n  setting: AccessiSecurityHeadersSetting | undefined,\n  isAccessiRoute: (path: string) => boolean,\n  options: { isOpenApiUi?: (path: string) => boolean } = {},\n): ((req: Request, res: Response, next: NextFunction) => void) | undefined {\n  const resolved = resolveAccessiSecurityHeaders(setting);\n  if (!resolved) return undefined;\n\n  return (req: Request, res: Response, next: NextFunction): void => {\n    if (!isAccessiRoute(req.path)) {\n      next();\n      return;\n    }\n    applyAccessiBaseSecurityHeaders(res, resolved);\n    if (resolved.contentSecurityPolicy) {\n      const surface: AccessiCspSurface = options.isOpenApiUi?.(req.path)\n        ? 'openapi'\n        : req.path.startsWith('/api/accessi/console')\n          ? 'console'\n          : 'api';\n      applyAccessiContentSecurityPolicy(res, resolved, surface);\n    }\n    next();\n  };\n}\n"]}

package/dist/accessi-module/security/serviceTokenGuard.d.ts

@@ -0,0 +1,27 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { Request } from 'express';
+import type { AccessiOptions } from '../AccessiModule';
+import { ServiceTokenService, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';
+/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */
+export declare const SERVICE_TOKEN_SCOPES_METADATA = "accessi:service-token-scopes";
+/** Richiede che il token di servizio presenti tutti gli scope indicati. */
+export declare const RequireServiceTokenScopes: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<string>;
+export type AccessiServiceTokenRequest = Request & {
+    accessiServiceToken?: VerifiedServiceToken;
+};
+/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */
+export declare function getAccessiServiceToken(req: Request): VerifiedServiceToken;
+/**
+ * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.
+ *
+ * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano
+ * con `@RequireServiceTokenScopes('ia')`.
+ */
+export declare class ServiceTokenGuard implements CanActivate {
+    private readonly serviceTokenService;
+    private readonly reflector;
+    private readonly accessiOptions;
+    constructor(serviceTokenService: ServiceTokenService, reflector: Reflector, accessiOptions: AccessiOptions);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/accessi-module/security/serviceTokenGuard.js

@@ -0,0 +1,90 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceTokenGuard = exports.RequireServiceTokenScopes = exports.SERVICE_TOKEN_SCOPES_METADATA = void 0;
+exports.getAccessiServiceToken = getAccessiServiceToken;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const ServiceTokenService_1 = require("../Services/ServiceTokenService/ServiceTokenService");
+const authenticatedToken_1 = require("./authenticatedToken");
+const serviceTokenRateLimit_1 = require("./serviceTokenRateLimit");
+/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */
+exports.SERVICE_TOKEN_SCOPES_METADATA = 'accessi:service-token-scopes';
+/** Richiede che il token di servizio presenti tutti gli scope indicati. */
+const RequireServiceTokenScopes = (...scopes) => (0, common_1.SetMetadata)(exports.SERVICE_TOKEN_SCOPES_METADATA, scopes);
+exports.RequireServiceTokenScopes = RequireServiceTokenScopes;
+/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */
+function getAccessiServiceToken(req) {
+    const verified = req.accessiServiceToken;
+    if (!verified) {
+        throw new common_1.UnauthorizedException('Token di servizio non verificato.');
+    }
+    return verified;
+}
+/**
+ * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.
+ *
+ * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano
+ * con `@RequireServiceTokenScopes('ia')`.
+ */
+let ServiceTokenGuard = class ServiceTokenGuard {
+    constructor(serviceTokenService, reflector, accessiOptions) {
+        this.serviceTokenService = serviceTokenService;
+        this.reflector = reflector;
+        this.accessiOptions = accessiOptions;
+    }
+    canActivate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e;
+            const request = context.switchToHttp().getRequest();
+            const ip = (_c = (_a = request.ip) !== null && _a !== void 0 ? _a : (_b = request.socket) === null || _b === void 0 ? void 0 : _b.remoteAddress) !== null && _c !== void 0 ? _c : 'unknown';
+            yield (0, serviceTokenRateLimit_1.assertServiceTokenRateLimit)(ip, (_d = this.accessiOptions.serviceTokens) === null || _d === void 0 ? void 0 : _d.rateLimitStore);
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(request.headers['authorization']);
+            if (!token) {
+                throw new common_1.UnauthorizedException('Token di servizio mancante.');
+            }
+            const verified = yield this.serviceTokenService.verify(token, { ip });
+            if (!verified) {
+                throw new common_1.UnauthorizedException('Token di servizio non valido, scaduto o revocato.');
+            }
+            request.accessiServiceToken = verified;
+            const requiredScopes = (_e = this.reflector.getAllAndOverride(exports.SERVICE_TOKEN_SCOPES_METADATA, [
+                context.getHandler(),
+                context.getClass(),
+            ])) !== null && _e !== void 0 ? _e : [];
+            const missingScope = requiredScopes.find((scope) => !(0, ServiceTokenService_1.serviceTokenHasScope)(verified.scopes, scope));
+            if (missingScope) {
+                throw new common_1.ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);
+            }
+            return true;
+        });
+    }
+};
+exports.ServiceTokenGuard = ServiceTokenGuard;
+exports.ServiceTokenGuard = ServiceTokenGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [ServiceTokenService_1.ServiceTokenService,
+        core_1.Reflector, Object])
+], ServiceTokenGuard);
+//# sourceMappingURL=serviceTokenGuard.js.map