emilsoftware-utilities 2.0.0-dev.83 → 2.0.0-dev.85

package/dist/accessi-service/security/AccessiHttpExceptionFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessiHttpExceptionFilter.js","sourceRoot":"","sources":["../../../src/accessi-service/security/AccessiHttpExceptionFilter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAkG;AAElG,+CAA4D;AAC5D,yCAAsC;AAStC;;;;;GAKG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,KAAK,CAAC,SAAkB,EAAE,IAAmB;;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;QAC7D,IAAI,QAAQ,CAAC,WAAW;YAAE,OAAO;QAEjC,MAAM,MAAM,GAAG,SAAS,YAAY,sBAAa;YAC/C,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE;YACvB,CAAC,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;gBAC9C,CAAC,CAAC,mBAAU,CAAC,mBAAmB;gBAChC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,KAAK,mBAAU,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChG,MAAM,eAAe,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCACpB,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;YAChD,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,WAAW;oBACjC,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBAClC,CAAC,CAAC,sBAAsB;wBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,mBAAmB;4BACrB,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,KAAK,0BAA0B;YACjD,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,IAAI,KAAK,kCAAkC;gBAC3C,CAAC,CAAC,+FAA+F;gBACjG,CAAC,CAAC,WAAW;oBACX,CAAC,CAAC,oDAAoD;oBACtD,CAAC,CAAC,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBACtD,CAAC,CAAC,sCAAsC;wBACxC,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,6BAA6B;4BAC/B,CAAC,CAAC,MAAM,IAAI,mBAAU,CAAC,qBAAqB;gCAC1C,CAAC,CAAC,oCAAoC;gCACtC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAEvC,MAAM,KAAK,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,eAAM,CAAC,qBAAqB,CAAC,CAAC,KAAK,CACrC,QAAQ,MAAM,IAAI,IAAI,KAAK,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAC/F,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1B,CAAC;QAEF,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,iBAC1B,QAAQ,EAAE,OAAO,EACjB,MAAM,EACN,UAAU,EAAE,sBAAU,CAAC,KAAK,EAC5B,IAAI,EACJ,KAAK,EAAE,IAAI,EACX,OAAO,IACJ,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,MAAM,EAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAChE,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,SAAkB;QACnC,IAAI,CAAC,CAAC,SAAS,YAAY,sBAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAA4B,CAAC;IAC7F,CAAC;IAEO,aAAa,CAAC,SAAkB,EAAE,OAAyB;QACjE,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACjF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;QAChF,OAAO,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;CACF,CAAA;AApEY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,cAAK,GAAE;GACK,0BAA0B,CAoEtC","sourcesContent":["import { ArgumentsHost, Catch, ExceptionFilter, HttpException, HttpStatus } from '@nestjs/common';\nimport { Response } from 'express';\nimport { RestUtilities, StatusCode } from '../../Utilities';\nimport { Logger } from '../../Logger';\n\ntype ExceptionPayload = {\n  code?: string;\n  error?: string;\n  message?: string | string[];\n  details?: string[];\n};\n\n/**\n * Finalizes every exception raised before an Accessi controller can reply.\n *\n * This includes invalid JSON, validation-pipe errors and guard failures. The\n * filter deliberately never return SQL, stack traces or provider diagnostics.\n */\n@Catch()\nexport class AccessiHttpExceptionFilter implements ExceptionFilter {\n  catch(exception: unknown, host: ArgumentsHost): void {\n    const response = host.switchToHttp().getResponse<Response>();\n    if (response.headersSent) return;\n\n    const status = exception instanceof HttpException\n      ? exception.getStatus()\n      : RestUtilities.isDatabaseSchemaError(exception)\n        ? HttpStatus.SERVICE_UNAVAILABLE\n        : HttpStatus.INTERNAL_SERVER_ERROR;\n    const payload = this.getPayload(exception);\n    const invalidJson = status === HttpStatus.BAD_REQUEST && this.isInvalidJson(exception, payload);\n    const explicitMessage = typeof payload.message === 'string' ? payload.message : undefined;\n    const code = payload.code\n      ?? (RestUtilities.isDatabaseSchemaError(exception)\n        ? 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n        : invalidJson\n          ? 'ACCESSI_INVALID_JSON'\n          : status === HttpStatus.BAD_REQUEST\n            ? 'ACCESSI_REQUEST_ERROR'\n            : status === HttpStatus.UNAUTHORIZED\n              ? 'ACCESSI_UNAUTHORIZED'\n              : status === HttpStatus.FORBIDDEN\n                ? 'ACCESSI_FORBIDDEN'\n                : 'ACCESSI_INTERNAL_ERROR');\n\n    const message = code === 'ACCESSI_VALIDATION_ERROR'\n      ? 'La richiesta contiene dati non validi.'\n      : code === 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n        ? 'Lo schema del database Accessi non e aggiornato. Eseguire la migrazione database e riprovare.'\n        : invalidJson\n          ? 'Il corpo della richiesta non contiene JSON valido.'\n          : explicitMessage ?? (status === HttpStatus.UNAUTHORIZED\n            ? 'Autenticazione non valida o scaduta.'\n            : status === HttpStatus.FORBIDDEN\n              ? 'Operazione non autorizzata.'\n              : status >= HttpStatus.INTERNAL_SERVER_ERROR\n                ? 'Errore interno del modulo Accessi.'\n                : 'Richiesta non valida.');\n\n    const stack = exception instanceof Error ? exception.stack : undefined;\n    new Logger('[ACCESSI-EXCEPTION]').error(\n      `HTTP ${status} ${code}: ${exception instanceof Error ? exception.message : String(exception)}`,\n      ...(stack ? [stack] : [])\n    );\n\n    response.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: StatusCode.Error,\n      code,\n      error: code,\n      message,\n      ...(payload.details?.length ? { details: payload.details } : {}),\n    });\n  }\n\n  private getPayload(exception: unknown): ExceptionPayload {\n    if (!(exception instanceof HttpException)) return {};\n    const response = exception.getResponse();\n    return typeof response === 'string' ? { message: response } : response as ExceptionPayload;\n  }\n\n  private isInvalidJson(exception: unknown, payload: ExceptionPayload): boolean {\n    const message = exception instanceof Error ? exception.message : payload.message;\n    const text = Array.isArray(message) ? message.join(' ') : String(message ?? '');\n    return /json|unexpected token|expected property name|unterminated string/i.test(text);\n  }\n}\n"]}

package/dist/accessi-service/security/accessControl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-service/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,kCAOC;AAMD,oDAOC;AAOD,0CAIC;AAMD,8DAQC;AAOD,gEAUC;AAGD,kDAOC;AAGD,sDAUC;AAGD,4DAoBC;AAhKD,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,sCAAsC;IAEhD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,WAAW,CACzB,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAkD;IAChF,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,KAA+B,EAC/B,MAAoD,EACpD,OAAO,GAAG,uDAAuD;IAEjE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,IAA8B,EAC9B,OAAqD;IAErD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,2BAAkB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,2BAAkB,CAAC,oEAAoE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,mBAAmB,CACjC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */\nexport interface AuthenticatedAccessiUser {\n  codiceUtente: number;\n  email?: string;\n  flagSuper: boolean;\n  flagAdmin: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\n/**\n * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n */\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n  const payload = (req as Request & { user?: unknown }).user;\n  const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\n  const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\n    ? payloadRecord.userData as Record<string, unknown>\n    : undefined;\n  const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\n  const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\n  const codiceUtente = Number(utente?.codiceUtente);\n\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n    throw new UnauthorizedException('Utente non autenticato.');\n  }\n\n  return {\n    codiceUtente,\n    email: typeof utente?.email === 'string' ? utente.email : undefined,\n    flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n    flagAdmin: normalizeBooleanFlag(utente?.flagAdmin),\n  };\n}\n\n/** Impone il flag superutente: gestione utenti e dei loro grant. */\nexport function ensureSuperUser(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata ai superutenti.',\n): void {\n  if (!user.flagSuper) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */\nexport function ensureAdmin(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori.',\n): void {\n  if (!user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Gestione utenti e assegnazioni: consentita a superutenti e admin.\n * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.\n */\nexport function ensureUserManagement(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori degli utenti.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.\n * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango\n * pari o inferiore, quindi un superutente non puo' toccare un admin.\n */\nexport function accessiUserRank(user: { flagSuper?: boolean; flagAdmin?: boolean }): number {\n  if (user.flagAdmin) return 2;\n  if (user.flagSuper) return 1;\n  return 0;\n}\n\n/**\n * Impone che l'attore possa gestire il target: rango attore >= rango target.\n * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).\n */\nexport function ensureCanManageTargetUser(\n  actor: AuthenticatedAccessiUser,\n  target: { flagSuper?: boolean; flagAdmin?: boolean },\n  message = 'Non puoi gestire un utente di rango superiore al tuo.',\n): void {\n  if (accessiUserRank(actor) < accessiUserRank(target)) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:\n * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza\n * `flagAdmin` gestisce solo `flagSuper`.\n */\nexport function ensurePrivilegeFlagChanges(\n  user: AuthenticatedAccessiUser,\n  changes: { flagSuper?: unknown; flagAdmin?: unknown },\n): void {\n  if (changes.flagAdmin !== undefined && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un admin puo modificare il flag admin.');\n  }\n  if (changes.flagSuper !== undefined && !user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un superutente o un admin puo modificare il flag superutente.');\n  }\n}\n\n/** Accesso alla console: superutenti e admin. */\nexport function ensureConsoleAccess(\n  user: AuthenticatedAccessiUser,\n  message = 'La console richiede un superutente o un admin Accessi.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */\nexport function ensureSelfOrSuperUser(\n  user: AuthenticatedAccessiUser,\n  targetUserCode: number,\n  message = 'Operazione non autorizzata su questo utente.',\n): void {\n  if (user.flagSuper || user.flagAdmin || user.codiceUtente === targetUserCode) {\n    return;\n  }\n\n  throw new ForbiddenException(message);\n}\n\n/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n  statoRegistrazione?: unknown;\n  flagSuper?: unknown;\n  flagAdmin?: unknown;\n  passwordLoginEnabled?: unknown;\n  passwordlessLoginEnabled?: unknown;\n  flagDueFattori?: unknown;\n  roles?: unknown;\n  permissions?: unknown;\n}): boolean {\n  return (\n    user.statoRegistrazione !== undefined ||\n    user.flagSuper !== undefined ||\n    user.flagAdmin !== undefined ||\n    user.passwordLoginEnabled !== undefined ||\n    user.passwordlessLoginEnabled !== undefined ||\n    user.flagDueFattori !== undefined ||\n    user.roles !== undefined ||\n    user.permissions !== undefined\n  );\n}\n"]}

package/dist/accessi-service/security/accessTokenRevocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessTokenRevocation.js","sourceRoot":"","sources":["../../../src/accessi-service/security/accessTokenRevocation.ts"],"names":[],"mappings":";;;;;;;;;;;AAkCA,wFA6BC;AAeD,sFAoCC;AAID,sEAMC;AAGD,kEASC;AAGD,4DAYC;AAGD,oFAQC;AAGD,gFAEC;AAtKD,gEAA6E;AA6B7E,MAAM,aAAa,GACjB,qIAAqI,CAAC;AACxI,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE,SAAgB,sCAAsC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,SAAS,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACC,MAAM,CAAC,GAAG,EAAE,WAAW;;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;SAAA;QACK,SAAS,CAAC,GAAG;;gBACjB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC1C,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACpB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAcD,0DAA0D;AAC1D,SAAgB,qCAAqC,CACnD,OAA+C;;IAE/C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAA,2CAA4B,EAAC,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvF,OAAO;QACC,MAAM,CAAC,GAAG,EAAE,WAAW;;gBAC3B,wEAAwE;gBACxE,0EAA0E;gBAC1E,uCAAuC;gBACvC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBACnD,CAAC,CAAC,KAAK,CAAC;gBACV,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,SAAS,GAAG,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;SAAA;QAEK,SAAS,CAAC,GAAG;;gBACjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,GAAG,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC7E,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;SAAA;QAEK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,sCAAsC,EAAE,CAAC;AAEpE,SAAgB,6BAA6B,CAC3C,OAAuB;;IAEvB,IAAI,CAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,MAAA,OAAO,CAAC,qBAAqB,0CAAE,KAAK;QAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;IACrF,OAAO,CAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,OAAO,MAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED,mDAAmD;AACnD,SAAsB,2BAA2B,CAC/C,OAAuB,EACvB,OAAgC;;QAEhC,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CAAA;AAED,sEAAsE;AACtE,SAAsB,wBAAwB,CAC5C,OAAuB,EACvB,GAAW,EACX,WAAoB;;;QAEpB,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,KAAK,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACnG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IAC7D,CAAC;CAAA;AAED,+EAA+E;AAC/E,SAAsB,oCAAoC,CACxD,OAAuB,EACvB,GAAW,EACX,WAAoB;;QAEpB,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,4DAA4D;AAC5D,SAAgB,kCAAkC;IAChD,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\nimport { instrumentAccessiRedisClient } from '../observability/redisMetrics';\n\n/**\n * Revoca dei singoli access token tramite `jti`.\n *\n * A differenza della revoca per utente, questa annulla un solo token senza\n * toccare le altre sessioni. La chiave scade al massimo a `exp` del token, cosi\n * la memoria usata resta limitata alla durata dei token emessi.\n */\nexport interface AccessTokenRevocationStore {\n  revoke(jti: string, expiresAtMs: number): Promise<void>;\n  isRevoked(jti: string): Promise<boolean>;\n  /** Health check opzionale per readiness del servizio. */\n  healthCheck?(): Promise<boolean>;\n}\n\nexport interface AccessTokenRevocationOptions {\n  /** Default: disabilitata se non viene fornito uno store. */\n  enabled?: boolean;\n  /** Store condiviso (es. Redis) per revocare i token tra istanze. */\n  store?: AccessTokenRevocationStore;\n  /** TTL di default quando `exp` non e noto. Default: 24 ore. */\n  ttlMs?: number;\n}\n\nexport interface MemoryAccessTokenRevocationStore extends AccessTokenRevocationStore {\n  clear(): void;\n}\n\nconst REVOKE_SCRIPT =\n  \"if tonumber(ARGV[1]) > 0 then return redis.call('SET', KEYS[1], '1', 'PX', ARGV[1]) else return redis.call('SET', KEYS[1], '1') end\";\nconst IS_REVOKED_SCRIPT = \"return redis.call('EXISTS', KEYS[1])\";\n\nexport function createMemoryAccessTokenRevocationStore(): MemoryAccessTokenRevocationStore {\n  const revoked = new Map<string, number>();\n  const prune = (now: number) => {\n    for (const [jti, expiresAt] of revoked) {\n      if (expiresAt <= now) revoked.delete(jti);\n    }\n  };\n  return {\n    async revoke(jti, expiresAtMs) {\n      const now = Date.now();\n      prune(now);\n      revoked.set(jti, Math.max(expiresAtMs, now + 1));\n    },\n    async isRevoked(jti) {\n      const expiresAt = revoked.get(jti);\n      if (expiresAt === undefined) return false;\n      if (expiresAt <= Date.now()) {\n        revoked.delete(jti);\n        return false;\n      }\n      return true;\n    },\n    async healthCheck() {\n      return true;\n    },\n    clear() {\n      revoked.clear();\n    },\n  };\n}\n\nexport interface AccessTokenRevocationRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisAccessTokenRevocationStoreOptions {\n  client: AccessTokenRevocationRedisClient;\n  /** Default: `accessi:revoked-token:`. */\n  keyPrefix?: string;\n  /** Default: 24 ore. */\n  ttlMs?: number;\n}\n\n/** Store Redis per la revoca dei singoli access token. */\nexport function createRedisAccessTokenRevocationStore(\n  options: RedisAccessTokenRevocationStoreOptions,\n): AccessTokenRevocationStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis access token revocation store: client.eval non configurato.');\n  }\n\n  const keyPrefix = (options.keyPrefix ?? 'accessi:revoked-token:').replace(/:+$/, ':');\n  const ttlMs = Math.max(0, Math.trunc(options.ttlMs ?? 24 * 60 * 60 * 1000));\n  const client = instrumentAccessiRedisClient('access_token_revocation', options.client);\n\n  return {\n    async revoke(jti, expiresAtMs) {\n      // Se il token e gia scaduto non serve conservare la revoca a lungo: una\n      // chiave senza TTL resterebbe per sempre. Il minimo di 1 ms la fa sparire\n      // subito, come nello store in memoria.\n      const ttl = Number.isFinite(expiresAtMs)\n        ? Math.max(1, Math.trunc(expiresAtMs - Date.now()))\n        : ttlMs;\n      await client.eval(REVOKE_SCRIPT, 1, `${keyPrefix}${jti}`, ttl);\n    },\n\n    async isRevoked(jti) {\n      const result = await client.eval(IS_REVOKED_SCRIPT, 1, `${keyPrefix}${jti}`);\n      return Number(result) > 0;\n    },\n\n    async healthCheck() {\n      try {\n        const result = await client.eval(\"return redis.call('PING')\", 0);\n        return String(result).toUpperCase() === 'PONG';\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n\nconst defaultMemoryStore = createMemoryAccessTokenRevocationStore();\n\nexport function getAccessTokenRevocationStore(\n  options: AccessiOptions,\n): AccessTokenRevocationStore | undefined {\n  if (options.accessTokenRevocation?.enabled === false) return undefined;\n  if (options.accessTokenRevocation?.store) return options.accessTokenRevocation.store;\n  return options.accessTokenRevocation?.enabled === true ? defaultMemoryStore : undefined;\n}\n\n/** True se il `jti` del token risulta revocato. */\nexport async function isAccessiAccessTokenRevoked(\n  options: AccessiOptions,\n  payload: Record<string, unknown>,\n): Promise<boolean> {\n  const store = getAccessTokenRevocationStore(options);\n  if (!store) return false;\n  const jti = typeof payload.jti === 'string' ? payload.jti : undefined;\n  if (!jti) return false;\n  return store.isRevoked(jti);\n}\n\n/** Revoca un singolo access token. Richiede uno store configurato. */\nexport async function revokeAccessiAccessToken(\n  options: AccessiOptions,\n  jti: string,\n  expiresAtMs?: number,\n): Promise<void> {\n  const store = getAccessTokenRevocationStore(options);\n  if (!store) throw new Error('Access token revocation store non configurato.');\n  if (typeof jti !== 'string' || jti.trim() === '') {\n    throw new Error('jti non valido.');\n  }\n  const ttlMs = Math.max(0, Math.trunc(options.accessTokenRevocation?.ttlMs ?? 24 * 60 * 60 * 1000));\n  await store.revoke(jti, expiresAtMs ?? Date.now() + ttlMs);\n}\n\n/** Variante per i flussi applicativi: no-op se la revoca non e configurata. */\nexport async function revokeAccessiAccessTokenIfConfigured(\n  options: AccessiOptions,\n  jti: string,\n  expiresAtMs?: number,\n): Promise<boolean> {\n  if (!getAccessTokenRevocationStore(options)) return false;\n  await revokeAccessiAccessToken(options, jti, expiresAtMs);\n  return true;\n}\n\n/** Solo per test: azzera lo store in memoria di default. */\nexport function clearDefaultAccessTokenRevocations(): void {\n  defaultMemoryStore.clear();\n}\n"]}

package/dist/accessi-service/security/accessiValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessiValidation.js","sourceRoot":"","sources":["../../../src/accessi-service/security/accessiValidation.ts"],"names":[],"mappings":";;AAUA,kEAmBC;AA7BD,2CAAsF;AACtF,+CAA6C;AAE7C;;;;;;GAMG;AACH,SAAgB,2BAA2B;IACzC,OAAO,IAAI,uBAAc,CAAC;QACxB,SAAS,EAAE,IAAI;QACf,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE;YAChB,wBAAwB,EAAE,IAAI;SAC/B;QACD,gBAAgB,EAAE,CAAC,MAAyB,EAAE,EAAE,CAC9C,IAAI,4BAAmB,CAAC;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,sBAAU,CAAC,KAAK;YAC5B,IAAI,EAAE,0BAA0B;YAChC,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,wCAAwC;YACjD,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC;SACzC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,uBAAuB,CAAC,MAAyB,EAAE,UAAU,GAAG,EAAE;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,uBAAuB,CAAC,MAAA,KAAK,CAAC,QAAQ,mCAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { BadRequestException, ValidationError, ValidationPipe } from '@nestjs/common';\nimport { StatusCode } from '../../Utilities';\n\n/**\n * Creates the validation pipe used by every Accessi bootstrap path.\n *\n * It deliberately returns one stable, documented error contract instead of\n * Nest's default array. Consumers can branch on `code`; `details` is safe to\n * display or log because it contains only DTO field names and validation text.\n */\nexport function createAccessiValidationPipe(): ValidationPipe {\n  return new ValidationPipe({\n    whitelist: true,\n    forbidNonWhitelisted: true,\n    transform: true,\n    transformOptions: {\n      enableImplicitConversion: true,\n    },\n    exceptionFactory: (errors: ValidationError[]) =>\n      new BadRequestException({\n        severity: 'error',\n        status: 400,\n        statusCode: StatusCode.Error,\n        code: 'ACCESSI_VALIDATION_ERROR',\n        error: 'ACCESSI_VALIDATION_ERROR',\n        message: 'La richiesta contiene dati non validi.',\n        details: flattenValidationErrors(errors),\n      }),\n  });\n}\n\n/** Converts nested class-validator failures into deterministic client details. */\nfunction flattenValidationErrors(errors: ValidationError[], parentPath = ''): string[] {\n  return errors.flatMap((error) => {\n    const path = parentPath ? `${parentPath}.${error.property}` : error.property;\n    const ownMessages = Object.values(error.constraints ?? {}).map((message) => `${path}: ${message}`);\n    return [...ownMessages, ...flattenValidationErrors(error.children ?? [], path)];\n  });\n}\n"]}

package/dist/accessi-service/security/adminBootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminBootstrap.js","sourceRoot":"","sources":["../../../src/accessi-service/security/adminBootstrap.ts"],"names":[],"mappings":";;AAUA,wEAKC;AAGD,wDAEC;AAGD,4DAEC;AAGD,gEAYC;AAxCD,mCAAsD;AAEtD;;;;GAIG;AACH,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC,wEAAwE;AACxE,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,0DAA0D;AAC1D,SAAgB,sBAAsB;IACpC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iFAAiF;AACjF,SAAgB,wBAAwB;IACtC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,0BAA0B,CAAC,SAAkB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAA,wBAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { randomBytes, timingSafeEqual } from 'crypto';\n\n/**\n * Token di bootstrap admin, valido per il singolo processo Accessi.\n * Viene generato al primo accesso (avvio del modulo) e rigenerato a ogni riavvio: non e mai\n * persistito ne restituito via API, e viene stampato solo nel log del backend.\n */\nlet processToken: string | null = null;\n\n/** Genera (una sola volta per processo) il token di bootstrap admin. */\nexport function getOrCreateAdminBootstrapToken(): string {\n  if (!processToken) {\n    processToken = randomBytes(32).toString('hex');\n  }\n  return processToken;\n}\n\n/** Token corrente, oppure null se non ancora generato. */\nexport function getAdminBootstrapToken(): string | null {\n  return processToken;\n}\n\n/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */\nexport function clearAdminBootstrapToken(): void {\n  processToken = null;\n}\n\n/** Confronto a tempo costante del token candidato con quello generato. */\nexport function isValidAdminBootstrapToken(candidate: unknown): boolean {\n  if (!processToken || typeof candidate !== 'string' || candidate.length === 0) {\n    return false;\n  }\n\n  const expected = Buffer.from(processToken, 'utf8');\n  const provided = Buffer.from(candidate, 'utf8');\n  if (expected.length !== provided.length) {\n    return false;\n  }\n\n  return timingSafeEqual(expected, provided);\n}\n"]}

package/dist/accessi-service/security/audit.d.ts

@@ -0,0 +1,84 @@
+/** Record di audit normalizzato e gia redatto. */
+export interface AccessiAuditRecord {
+    event: string;
+    timestamp: string;
+    [key: string]: unknown;
+}
+/** Destinazione di un record di audit. */
+export interface AccessiAuditSink {
+    /** Nome usato nelle metriche di errore del sink. */
+    name?: string;
+    write(record: AccessiAuditRecord): void | Promise<void>;
+}
+export interface AccessiAuditQuery {
+    event?: string;
+    from?: string;
+    to?: string;
+    codiceUtente?: number;
+    limit?: number;
+    offset?: number;
+    order?: 'asc' | 'desc';
+}
+export interface AccessiAuditPage {
+    records: AccessiAuditRecord[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+/** Sink interrogabile dagli endpoint amministrativi e dalla retention. */
+export interface AccessiAuditQueryableSink extends AccessiAuditSink {
+    query(filter?: AccessiAuditQuery): Promise<AccessiAuditPage>;
+    purge(before: Date): Promise<number>;
+}
+/** Opzioni di audit del modulo. */
+export interface AccessiAuditOptions {
+    /** `false` disattiva i sink ma lascia il log strutturato. Default: abilitati. */
+    enabled?: boolean;
+    /** Sink aggiuntivi (HTTP, DB, OpenTelemetry). */
+    sinks?: AccessiAuditSink[];
+    /** Sink interrogabile usato da `/api/accessi/audit`. Default: primo sink queryable. */
+    store?: AccessiAuditQueryableSink;
+    /** Giorni di retention applicati ai sink queryable. Default: nessuna scadenza automatica. */
+    retentionDays?: number;
+    /** Chiavi aggiuntive da redigere, oltre a quelle predefinite. */
+    redact?: string[];
+    /** Etichetta tenant aggiunta a ogni record (multi-tenancy). */
+    tenantId?: string;
+    /** Scrivi anche sul Logger strutturato. Default: true. */
+    logger?: boolean;
+}
+/**
+ * Redige ricorsivamente token, segreti, cookie e header sensibili.
+ *
+ * Limita profondita, lunghezza delle stringhe e numero di elementi per evitare
+ * che un payload applicativo finisca per intero nell'audit.
+ */
+export declare function redactAccessiAuditValue(value: unknown, depth?: number): unknown;
+/**
+ * Configura i sink di audit.
+ *
+ * Chiamato da `AccessiModule.forRoot`. Con `tenantId` la configurazione vale
+ * solo per quel tenant e non sovrascrive quella degli altri: e il presupposto
+ * per il router multi-tenant in-process. Senza `tenantId` aggiorna la
+ * configurazione di default (comportamento single-tenant).
+ */
+export declare function configureAccessiAudit(options: AccessiAuditOptions | undefined): void;
+/**
+ * Configura audit e sink per un tenant specifico (router in-process).
+ *
+ * La configurazione vale quando la richiesta e dentro
+ * `runWithAccessiTenant`/`createAccessiTenantRouter`; gli eventi fuori da un
+ * contesto tenant usano la configurazione di default del processo.
+ */
+export declare function configureAccessiTenantAudit(tenantId: string, options: AccessiAuditOptions | undefined): void;
+/** Ripristina la configurazione iniziale (logger attivo, nessun sink). */
+export declare function resetAccessiAudit(): void;
+/** Sink interrogabile configurato, usato dagli endpoint amministrativi. */
+export declare function getAccessiAuditStore(tenantId?: string): AccessiAuditQueryableSink | undefined;
+/**
+ * Registra un evento di sicurezza.
+ *
+ * Il record viene redatto prima di raggiungere logger e sink. Un sink guasto
+ * non interrompe mai il flusso applicativo.
+ */
+export declare function auditAccessi(event: string, details?: Record<string, unknown>): void;

package/dist/accessi-service/security/audit.js

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactAccessiAuditValue = redactAccessiAuditValue;
+exports.configureAccessiAudit = configureAccessiAudit;
+exports.configureAccessiTenantAudit = configureAccessiTenantAudit;
+exports.resetAccessiAudit = resetAccessiAudit;
+exports.getAccessiAuditStore = getAccessiAuditStore;
+exports.auditAccessi = auditAccessi;
+const Logger_1 = require("../../Logger");
+const metrics_1 = require("../observability/metrics");
+const tenantContext_1 = require("../tenancy/tenantContext");
+const REDACTED = '[REDACTED]';
+const TRUNCATED = '[TRUNCATED]';
+const DEFAULT_REDACTED_KEYS = new Set([
+    'token',
+    'accesstoken',
+    'refreshtoken',
+    'idtoken',
+    'bearer',
+    'jwt',
+    'authorization',
+    'cookie',
+    'setcookie',
+    'password',
+    'passwordhash',
+    'hashedpassword',
+    'resettoken',
+    'secret',
+    'clientsecret',
+    'privatekey',
+    'apikey',
+    'csrf',
+    'csrftoken',
+]);
+const MAX_STRING_LENGTH = 512;
+const MAX_ARRAY_LENGTH = 50;
+const MAX_OBJECT_KEYS = 100;
+const MAX_DEPTH = 4;
+const PURGE_INTERVAL_MS = 60 * 60 * 1000;
+function resolveConfig(options) {
+    var _a, _b;
+    const redactedKeys = new Set(DEFAULT_REDACTED_KEYS);
+    for (const key of (_a = options === null || options === void 0 ? void 0 : options.redact) !== null && _a !== void 0 ? _a : [])
+        redactedKeys.add(normalizedKey(key));
+    const retentionDays = Number(options === null || options === void 0 ? void 0 : options.retentionDays);
+    return Object.assign(Object.assign(Object.assign(Object.assign({ sinks: (options === null || options === void 0 ? void 0 : options.enabled) === false
+            ? []
+            : [
+                ...((options === null || options === void 0 ? void 0 : options.store) ? [options.store] : []),
+                ...((_b = options === null || options === void 0 ? void 0 : options.sinks) !== null && _b !== void 0 ? _b : []).filter((sink) => sink !== (options === null || options === void 0 ? void 0 : options.store)),
+            ], redactedKeys }, (Number.isFinite(retentionDays) && retentionDays > 0 ? { retentionDays } : {})), { loggerEnabled: (options === null || options === void 0 ? void 0 : options.logger) !== false }), ((options === null || options === void 0 ? void 0 : options.tenantId) ? { tenantId: options.tenantId } : {})), { lastPurgeAt: 0 });
+}
+let defaultConfig = resolveConfig(undefined);
+const tenantConfigs = new Map();
+function currentConfig() {
+    const tenantId = (0, tenantContext_1.getAccessiTenantId)();
+    if (tenantId) {
+        const tenantConfig = tenantConfigs.get(tenantId);
+        if (tenantConfig)
+            return tenantConfig;
+    }
+    return defaultConfig;
+}
+function normalizedKey(key) {
+    return key.toLowerCase().replace(/[-_\s]/g, '');
+}
+/**
+ * Redige ricorsivamente token, segreti, cookie e header sensibili.
+ *
+ * Limita profondita, lunghezza delle stringhe e numero di elementi per evitare
+ * che un payload applicativo finisca per intero nell'audit.
+ */
+function redactAccessiAuditValue(value, depth = 0) {
+    return redactValue(value, depth, currentConfig().redactedKeys);
+}
+function redactValue(value, depth, keys) {
+    if (depth > MAX_DEPTH)
+        return TRUNCATED;
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === 'string') {
+        return value.length > MAX_STRING_LENGTH ? `${value.slice(0, MAX_STRING_LENGTH - 3)}...` : value;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'bigint')
+        return value.toString();
+    if (value instanceof Date)
+        return value.toISOString();
+    if (value instanceof Error) {
+        return { name: value.name, message: redactValue(value.message, depth + 1, keys) };
+    }
+    if (Array.isArray(value)) {
+        return value.slice(0, MAX_ARRAY_LENGTH).map((item) => redactValue(item, depth + 1, keys));
+    }
+    if (typeof value === 'object') {
+        const result = {};
+        for (const [key, entry] of Object.entries(value).slice(0, MAX_OBJECT_KEYS)) {
+            result[key] = keys.has(normalizedKey(key))
+                ? REDACTED
+                : redactValue(entry, depth + 1, keys);
+        }
+        return result;
+    }
+    return String(value);
+}
+function redactDetails(details) {
+    return redactAccessiAuditValue(details);
+}
+function reportSinkError(sink, error) {
+    var _a;
+    (0, metrics_1.recordAccessiMetric)('accessi_audit_sink_errors_total', 1, { sink: (_a = sink.name) !== null && _a !== void 0 ? _a : 'unknown' });
+    try {
+        new Logger_1.Logger('AccessiAudit').error(`Audit sink non disponibile${sink.name ? ` (${sink.name})` : ''}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    catch (_b) {
+        // Il logging non deve mai interrompere l'operazione applicativa.
+    }
+}
+function writeToSink(sink, record) {
+    try {
+        const result = sink.write(record);
+        if (result && typeof result.catch === 'function') {
+            result.catch((error) => reportSinkError(sink, error));
+        }
+    }
+    catch (error) {
+        reportSinkError(sink, error);
+    }
+}
+function maybePurge(config) {
+    if (!config.retentionDays || config.retentionDays <= 0)
+        return;
+    const now = Date.now();
+    if (now - config.lastPurgeAt < PURGE_INTERVAL_MS)
+        return;
+    config.lastPurgeAt = now;
+    const before = new Date(now - config.retentionDays * 24 * 60 * 60 * 1000);
+    for (const sink of config.sinks) {
+        if (typeof sink.purge !== 'function')
+            continue;
+        try {
+            const result = sink.purge(before);
+            if (result && typeof result.catch === 'function') {
+                result.catch((error) => reportSinkError(sink, error));
+            }
+        }
+        catch (error) {
+            reportSinkError(sink, error);
+        }
+    }
+}
+/**
+ * Configura i sink di audit.
+ *
+ * Chiamato da `AccessiModule.forRoot`. Con `tenantId` la configurazione vale
+ * solo per quel tenant e non sovrascrive quella degli altri: e il presupposto
+ * per il router multi-tenant in-process. Senza `tenantId` aggiorna la
+ * configurazione di default (comportamento single-tenant).
+ */
+function configureAccessiAudit(options) {
+    defaultConfig = resolveConfig(options);
+}
+/**
+ * Configura audit e sink per un tenant specifico (router in-process).
+ *
+ * La configurazione vale quando la richiesta e dentro
+ * `runWithAccessiTenant`/`createAccessiTenantRouter`; gli eventi fuori da un
+ * contesto tenant usano la configurazione di default del processo.
+ */
+function configureAccessiTenantAudit(tenantId, options) {
+    if (!tenantId)
+        throw new Error('configureAccessiTenantAudit: tenantId obbligatorio.');
+    tenantConfigs.set(tenantId, resolveConfig(Object.assign(Object.assign({}, (options !== null && options !== void 0 ? options : {})), { tenantId })));
+}
+/** Ripristina la configurazione iniziale (logger attivo, nessun sink). */
+function resetAccessiAudit() {
+    defaultConfig = resolveConfig(undefined);
+    tenantConfigs.clear();
+}
+/** Sink interrogabile configurato, usato dagli endpoint amministrativi. */
+function getAccessiAuditStore(tenantId) {
+    var _a;
+    const resolvedTenant = tenantId !== null && tenantId !== void 0 ? tenantId : (0, tenantContext_1.getAccessiTenantId)();
+    const config = resolvedTenant
+        ? (_a = tenantConfigs.get(resolvedTenant)) !== null && _a !== void 0 ? _a : defaultConfig
+        : defaultConfig;
+    return config.sinks.find((sink) => typeof sink.query === 'function'
+        && typeof sink.purge === 'function');
+}
+/**
+ * Registra un evento di sicurezza.
+ *
+ * Il record viene redatto prima di raggiungere logger e sink. Un sink guasto
+ * non interrompe mai il flusso applicativo.
+ */
+function auditAccessi(event, details = {}) {
+    const config = currentConfig();
+    const contextTenant = (0, tenantContext_1.getAccessiTenantId)();
+    const tenantId = contextTenant !== null && contextTenant !== void 0 ? contextTenant : config.tenantId;
+    const record = Object.assign(Object.assign({ event, timestamp: new Date().toISOString() }, (tenantId ? { tenant: tenantId } : {})), redactDetails(details !== null && details !== void 0 ? details : {}));
+    if (config.loggerEnabled) {
+        try {
+            new Logger_1.Logger('AccessiAudit').warning(JSON.stringify(record));
+        }
+        catch (_a) {
+            // Il logging non deve mai interrompere l'operazione applicativa.
+        }
+    }
+    for (const sink of config.sinks)
+        writeToSink(sink, record);
+    maybePurge(config);
+}
+//# sourceMappingURL=audit.js.map

package/dist/accessi-service/security/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/accessi-service/security/audit.ts"],"names":[],"mappings":";;AA4IA,0DAEC;AAkFD,sDAEC;AASD,kEAMC;AAGD,8CAGC;AAGD,oDASC;AAQD,oCAqBC;AAhSD,yCAAsC;AACtC,sDAA+D;AAC/D,4DAA8D;AAyD9D,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO;IACP,aAAa;IACb,cAAc;IACd,SAAS;IACT,QAAQ;IACR,KAAK;IACL,eAAe;IACf,QAAQ;IACR,WAAW;IACX,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,MAAM;IACN,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAWzC,SAAS,aAAa,CAAC,OAAwC;;IAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,EAAE;QAAE,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,CAAC,CAAC;IACrD,iEACE,KAAK,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,MAAK,KAAK;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,GAAG,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAK,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,CAAC;aACpE,EACL,YAAY,IACT,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACjF,aAAa,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,MAAK,KAAK,KACrC,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,EAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC5D,WAAW,EAAE,CAAC,IACd;AACJ,CAAC;AAED,IAAI,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsC,CAAC;AAEpE,SAAS,aAAa;IACpB,MAAM,QAAQ,GAAG,IAAA,kCAAkB,GAAE,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;IACxC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC/D,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,YAAY,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa,EAAE,IAAiB;IACnE,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;YACtG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACxC,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC;IACrD,OAAO,uBAAuB,CAAC,OAAO,CAA4B,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,IAAsB,EAAE,KAAc;;IAC7D,IAAA,6BAAmB,EAAC,iCAAiC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAA,IAAI,CAAC,IAAI,mCAAI,SAAS,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC;QACH,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAC9B,6BAA6B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7H,CAAC;IACJ,CAAC;IAAC,WAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB,EAAE,MAA0B;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,IAAI,OAAQ,MAAwB,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACnE,MAAwB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAkC;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC;QAAE,OAAO;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,iBAAiB;QAAE,OAAO;IACzD,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU;YAAE,SAAS;QAC9E,IAAI,CAAC;YACH,MAAM,MAAM,GAAI,IAAkC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,MAAM,IAAI,OAAQ,MAA0B,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACrE,MAA0B,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,OAAwC;IAC5E,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,2BAA2B,CACzC,QAAgB,EAChB,OAAwC;IAExC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACtF,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,iCAAM,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,KAAE,QAAQ,IAAG,CAAC,CAAC;AAC/E,CAAC;AAED,0EAA0E;AAC1E,SAAgB,iBAAiB;IAC/B,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,2EAA2E;AAC3E,SAAgB,oBAAoB,CAAC,QAAiB;;IACpD,MAAM,cAAc,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,IAAA,kCAAkB,GAAE,CAAC;IACxD,MAAM,MAAM,GAAG,cAAc;QAC3B,CAAC,CAAC,MAAA,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,mCAAI,aAAa;QACpD,CAAC,CAAC,aAAa,CAAC;IAClB,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAqC,EAAE,CACnE,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU;WAC5D,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAa,EAAE,UAAmC,EAAE;IAC/E,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,aAAa,GAAG,IAAA,kCAAkB,GAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,MAAM,CAAC,QAAQ,CAAC;IAClD,MAAM,MAAM,iCACV,KAAK,EACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAChC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACtC,aAAa,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAChC,CAAC;IAEF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,WAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3D,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC","sourcesContent":["import { Logger } from '../../Logger';\nimport { recordAccessiMetric } from '../observability/metrics';\nimport { getAccessiTenantId } from '../tenancy/tenantContext';\n\n/** Record di audit normalizzato e gia redatto. */\nexport interface AccessiAuditRecord {\n  event: string;\n  timestamp: string;\n  [key: string]: unknown;\n}\n\n/** Destinazione di un record di audit. */\nexport interface AccessiAuditSink {\n  /** Nome usato nelle metriche di errore del sink. */\n  name?: string;\n  write(record: AccessiAuditRecord): void | Promise<void>;\n}\n\nexport interface AccessiAuditQuery {\n  event?: string;\n  from?: string;\n  to?: string;\n  codiceUtente?: number;\n  limit?: number;\n  offset?: number;\n  order?: 'asc' | 'desc';\n}\n\nexport interface AccessiAuditPage {\n  records: AccessiAuditRecord[];\n  total: number;\n  limit: number;\n  offset: number;\n}\n\n/** Sink interrogabile dagli endpoint amministrativi e dalla retention. */\nexport interface AccessiAuditQueryableSink extends AccessiAuditSink {\n  query(filter?: AccessiAuditQuery): Promise<AccessiAuditPage>;\n  purge(before: Date): Promise<number>;\n}\n\n/** Opzioni di audit del modulo. */\nexport interface AccessiAuditOptions {\n  /** `false` disattiva i sink ma lascia il log strutturato. Default: abilitati. */\n  enabled?: boolean;\n  /** Sink aggiuntivi (HTTP, DB, OpenTelemetry). */\n  sinks?: AccessiAuditSink[];\n  /** Sink interrogabile usato da `/api/accessi/audit`. Default: primo sink queryable. */\n  store?: AccessiAuditQueryableSink;\n  /** Giorni di retention applicati ai sink queryable. Default: nessuna scadenza automatica. */\n  retentionDays?: number;\n  /** Chiavi aggiuntive da redigere, oltre a quelle predefinite. */\n  redact?: string[];\n  /** Etichetta tenant aggiunta a ogni record (multi-tenancy). */\n  tenantId?: string;\n  /** Scrivi anche sul Logger strutturato. Default: true. */\n  logger?: boolean;\n}\n\nconst REDACTED = '[REDACTED]';\nconst TRUNCATED = '[TRUNCATED]';\n\nconst DEFAULT_REDACTED_KEYS = new Set([\n  'token',\n  'accesstoken',\n  'refreshtoken',\n  'idtoken',\n  'bearer',\n  'jwt',\n  'authorization',\n  'cookie',\n  'setcookie',\n  'password',\n  'passwordhash',\n  'hashedpassword',\n  'resettoken',\n  'secret',\n  'clientsecret',\n  'privatekey',\n  'apikey',\n  'csrf',\n  'csrftoken',\n]);\n\nconst MAX_STRING_LENGTH = 512;\nconst MAX_ARRAY_LENGTH = 50;\nconst MAX_OBJECT_KEYS = 100;\nconst MAX_DEPTH = 4;\nconst PURGE_INTERVAL_MS = 60 * 60 * 1000;\n\ninterface ResolvedAccessiAuditConfig {\n  sinks: AccessiAuditSink[];\n  redactedKeys: Set<string>;\n  retentionDays?: number;\n  loggerEnabled: boolean;\n  tenantId?: string;\n  lastPurgeAt: number;\n}\n\nfunction resolveConfig(options: AccessiAuditOptions | undefined): ResolvedAccessiAuditConfig {\n  const redactedKeys = new Set(DEFAULT_REDACTED_KEYS);\n  for (const key of options?.redact ?? []) redactedKeys.add(normalizedKey(key));\n  const retentionDays = Number(options?.retentionDays);\n  return {\n    sinks: options?.enabled === false\n      ? []\n      : [\n          ...(options?.store ? [options.store] : []),\n          ...(options?.sinks ?? []).filter((sink) => sink !== options?.store),\n        ],\n    redactedKeys,\n    ...(Number.isFinite(retentionDays) && retentionDays > 0 ? { retentionDays } : {}),\n    loggerEnabled: options?.logger !== false,\n    ...(options?.tenantId ? { tenantId: options.tenantId } : {}),\n    lastPurgeAt: 0,\n  };\n}\n\nlet defaultConfig = resolveConfig(undefined);\nconst tenantConfigs = new Map<string, ResolvedAccessiAuditConfig>();\n\nfunction currentConfig(): ResolvedAccessiAuditConfig {\n  const tenantId = getAccessiTenantId();\n  if (tenantId) {\n    const tenantConfig = tenantConfigs.get(tenantId);\n    if (tenantConfig) return tenantConfig;\n  }\n  return defaultConfig;\n}\n\nfunction normalizedKey(key: string): string {\n  return key.toLowerCase().replace(/[-_\\s]/g, '');\n}\n\n/**\n * Redige ricorsivamente token, segreti, cookie e header sensibili.\n *\n * Limita profondita, lunghezza delle stringhe e numero di elementi per evitare\n * che un payload applicativo finisca per intero nell'audit.\n */\nexport function redactAccessiAuditValue(value: unknown, depth = 0): unknown {\n  return redactValue(value, depth, currentConfig().redactedKeys);\n}\n\nfunction redactValue(value: unknown, depth: number, keys: Set<string>): unknown {\n  if (depth > MAX_DEPTH) return TRUNCATED;\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return value.length > MAX_STRING_LENGTH ? `${value.slice(0, MAX_STRING_LENGTH - 3)}...` : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'bigint') return value.toString();\n  if (value instanceof Date) return value.toISOString();\n  if (value instanceof Error) {\n    return { name: value.name, message: redactValue(value.message, depth + 1, keys) };\n  }\n  if (Array.isArray(value)) {\n    return value.slice(0, MAX_ARRAY_LENGTH).map((item) => redactValue(item, depth + 1, keys));\n  }\n  if (typeof value === 'object') {\n    const result: Record<string, unknown> = {};\n    for (const [key, entry] of Object.entries(value as Record<string, unknown>).slice(0, MAX_OBJECT_KEYS)) {\n      result[key] = keys.has(normalizedKey(key))\n        ? REDACTED\n        : redactValue(entry, depth + 1, keys);\n    }\n    return result;\n  }\n  return String(value);\n}\n\nfunction redactDetails(details: Record<string, unknown>): Record<string, unknown> {\n  return redactAccessiAuditValue(details) as Record<string, unknown>;\n}\n\nfunction reportSinkError(sink: AccessiAuditSink, error: unknown): void {\n  recordAccessiMetric('accessi_audit_sink_errors_total', 1, { sink: sink.name ?? 'unknown' });\n  try {\n    new Logger('AccessiAudit').error(\n      `Audit sink non disponibile${sink.name ? ` (${sink.name})` : ''}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  } catch {\n    // Il logging non deve mai interrompere l'operazione applicativa.\n  }\n}\n\nfunction writeToSink(sink: AccessiAuditSink, record: AccessiAuditRecord): void {\n  try {\n    const result = sink.write(record);\n    if (result && typeof (result as Promise<void>).catch === 'function') {\n      (result as Promise<void>).catch((error) => reportSinkError(sink, error));\n    }\n  } catch (error) {\n    reportSinkError(sink, error);\n  }\n}\n\nfunction maybePurge(config: ResolvedAccessiAuditConfig): void {\n  if (!config.retentionDays || config.retentionDays <= 0) return;\n  const now = Date.now();\n  if (now - config.lastPurgeAt < PURGE_INTERVAL_MS) return;\n  config.lastPurgeAt = now;\n  const before = new Date(now - config.retentionDays * 24 * 60 * 60 * 1000);\n  for (const sink of config.sinks) {\n    if (typeof (sink as AccessiAuditQueryableSink).purge !== 'function') continue;\n    try {\n      const result = (sink as AccessiAuditQueryableSink).purge(before);\n      if (result && typeof (result as Promise<number>).catch === 'function') {\n        (result as Promise<number>).catch((error) => reportSinkError(sink, error));\n      }\n    } catch (error) {\n      reportSinkError(sink, error);\n    }\n  }\n}\n\n/**\n * Configura i sink di audit.\n *\n * Chiamato da `AccessiModule.forRoot`. Con `tenantId` la configurazione vale\n * solo per quel tenant e non sovrascrive quella degli altri: e il presupposto\n * per il router multi-tenant in-process. Senza `tenantId` aggiorna la\n * configurazione di default (comportamento single-tenant).\n */\nexport function configureAccessiAudit(options: AccessiAuditOptions | undefined): void {\n  defaultConfig = resolveConfig(options);\n}\n\n/**\n * Configura audit e sink per un tenant specifico (router in-process).\n *\n * La configurazione vale quando la richiesta e dentro\n * `runWithAccessiTenant`/`createAccessiTenantRouter`; gli eventi fuori da un\n * contesto tenant usano la configurazione di default del processo.\n */\nexport function configureAccessiTenantAudit(\n  tenantId: string,\n  options: AccessiAuditOptions | undefined,\n): void {\n  if (!tenantId) throw new Error('configureAccessiTenantAudit: tenantId obbligatorio.');\n  tenantConfigs.set(tenantId, resolveConfig({ ...(options ?? {}), tenantId }));\n}\n\n/** Ripristina la configurazione iniziale (logger attivo, nessun sink). */\nexport function resetAccessiAudit(): void {\n  defaultConfig = resolveConfig(undefined);\n  tenantConfigs.clear();\n}\n\n/** Sink interrogabile configurato, usato dagli endpoint amministrativi. */\nexport function getAccessiAuditStore(tenantId?: string): AccessiAuditQueryableSink | undefined {\n  const resolvedTenant = tenantId ?? getAccessiTenantId();\n  const config = resolvedTenant\n    ? tenantConfigs.get(resolvedTenant) ?? defaultConfig\n    : defaultConfig;\n  return config.sinks.find((sink): sink is AccessiAuditQueryableSink =>\n    typeof (sink as AccessiAuditQueryableSink).query === 'function'\n    && typeof (sink as AccessiAuditQueryableSink).purge === 'function',\n  );\n}\n\n/**\n * Registra un evento di sicurezza.\n *\n * Il record viene redatto prima di raggiungere logger e sink. Un sink guasto\n * non interrompe mai il flusso applicativo.\n */\nexport function auditAccessi(event: string, details: Record<string, unknown> = {}): void {\n  const config = currentConfig();\n  const contextTenant = getAccessiTenantId();\n  const tenantId = contextTenant ?? config.tenantId;\n  const record: AccessiAuditRecord = {\n    event,\n    timestamp: new Date().toISOString(),\n    ...(tenantId ? { tenant: tenantId } : {}),\n    ...redactDetails(details ?? {}),\n  };\n\n  if (config.loggerEnabled) {\n    try {\n      new Logger('AccessiAudit').warning(JSON.stringify(record));\n    } catch {\n      // Il logging non deve mai interrompere l'operazione applicativa.\n    }\n  }\n\n  for (const sink of config.sinks) writeToSink(sink, record);\n  maybePurge(config);\n}\n"]}

package/dist/accessi-service/security/auditSinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditSinks.js","sourceRoot":"","sources":["../../../src/accessi-service/security/auditSinks.ts"],"names":[],"mappings":";;;;;;;;;;;AA+EA,oEAsCC;AAWD,gEA+BC;AAOD,wEAKC;AAwDD,kEAqCC;AAjQD,gEAA6E;AAG7E,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,SAAS,GAAG,IAAK,CAAC;AAExB,SAAS,cAAc,CAAC,QAA2B,EAAE;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAe,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,MAA0B;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,MAA0B,EAAE,KAAwB;IACnE,IAAI,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,KAAK,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACzG,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,OAA6B,EAAE,KAAwB;IACvE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAC9C,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAA0B;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAuB,CAAC;AAClE,CAAC;AAkBD;;;;;GAKG;AACH,SAAgB,4BAA4B,CAC1C,UAAyC,EAAE;;IAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,KAAM,CAAC,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAA,OAAO,CAAC,WAAW,mCAAI,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAI,CAAC,GAAG,CAAC;IACpC,IAAI,OAAO,GAAyB,EAAE,CAAC;IAEvC,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,WAAW,CAAC;QACtC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,MAAA,OAAO,CAAC,IAAI,mCAAI,QAAQ;QAC9B,KAAK,CAAC,MAAM;YACV,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAClC,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU;gBAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;YACtF,YAAY,EAAE,CAAC;QACjB,CAAC;QACK,KAAK;iEAAC,KAAK,GAAG,EAAE;gBACpB,YAAY,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;SAAA;QACK,KAAK,CAAC,MAAY;;gBACtB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;gBACnC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;gBACtE,OAAO,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YACtC,CAAC;SAAA;QACD,GAAG;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;QACD,KAAK;YACH,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,SAAgB,0BAA0B,CACxC,OAAoC;;IAEpC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAA;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACzE,OAAO;QACL,IAAI,EAAE,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM;QACtB,KAAK,CAAC,MAAM;;;gBAChB,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,UAAU,CAAC,KAAK,CAAC;gBACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAA,OAAO,CAAC,SAAS,mCAAI,IAAI,CAAC,CAAC;gBAChF,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;wBAC5C,MAAM,EAAE,MAAM;wBACd,OAAO,kBACL,cAAc,EAAE,kBAAkB,IAC/B,CAAC,MAAA,OAAO,CAAC,OAAO,mCAAI,EAAE,CAAC,CAC3B;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;wBAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;oBACnE,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,YAAY,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,8BAA8B,CAC5C,KAA2D,EAC3D,IAAI,GAAG,UAAU;IAEjB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAaD,MAAM,kBAAkB,GAAG;;;;;;CAM1B,CAAC;AAEF,MAAM,iBAAiB,GAAG,6CAA6C,CAAC;AAExE,MAAM,oBAAoB,GAAG;;;;;;;;CAQ5B,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAuB,CAAC;YACvD,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACvF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,WAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,OAAqC;;IAErC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,2CAA4B,EAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC;IACnF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,KAAM,CAAC,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,WAAW,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAEjG,MAAM,OAAO,GAAG,GAAwC,EAAE,gDACxD,OAAA,iBAAiB,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA,GAAA,CAAC;IAElE,OAAO;QACL,IAAI,EAAE,MAAA,OAAO,CAAC,IAAI,mCAAI,OAAO;QACvB,KAAK,CAAC,MAAM;;gBAChB,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACjG,CAAC;SAAA;QACK,KAAK;iEAAC,KAAK,GAAG,EAAE;gBACpB,OAAO,QAAQ,CAAC,MAAM,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;SAAA;QACK,KAAK,CAAC,MAAY;;gBACtB,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC7C,IAAI,OAAO,KAAK,CAAC;oBAAE,OAAO,CAAC,CAAC;gBAC5B,MAAM,MAAM,CAAC,IAAI,CACf,oBAAoB,EACpB,CAAC,EACD,GAAG,EACH,WAAW,EACX,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAChD,CAAC;gBACF,OAAO,OAAO,CAAC;YACjB,CAAC;SAAA;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AccessiAuditPage,\n  AccessiAuditQuery,\n  AccessiAuditQueryableSink,\n  AccessiAuditRecord,\n  AccessiAuditSink,\n} from './audit';\nimport { instrumentAccessiRedisClient } from '../observability/redisMetrics';\nimport type { AccessiRedisEvalClient } from '../observability/redisMetrics';\n\nconst DEFAULT_LIMIT = 100;\nconst MAX_LIMIT = 1_000;\n\nfunction normalizeQuery(query: AccessiAuditQuery = {}): Required<Pick<AccessiAuditQuery, 'limit' | 'offset' | 'order'>> {\n  const limit = Number.isFinite(query.limit)\n    ? Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query.limit as number)))\n    : DEFAULT_LIMIT;\n  const offset = Number.isFinite(query.offset) ? Math.max(0, Math.trunc(query.offset as number)) : 0;\n  return { limit, offset, order: query.order === 'asc' ? 'asc' : 'desc' };\n}\n\nfunction recordTime(record: AccessiAuditRecord): number {\n  const time = Date.parse(record.timestamp);\n  return Number.isFinite(time) ? time : 0;\n}\n\nfunction matches(record: AccessiAuditRecord, query: AccessiAuditQuery): boolean {\n  if (query.event && record.event !== query.event) return false;\n  if (query.codiceUtente !== undefined && Number(record.codiceUtente) !== query.codiceUtente) return false;\n  const time = recordTime(record);\n  if (query.from) {\n    const from = Date.parse(query.from);\n    if (Number.isFinite(from) && time < from) return false;\n  }\n  if (query.to) {\n    const to = Date.parse(query.to);\n    if (Number.isFinite(to) && time > to) return false;\n  }\n  return true;\n}\n\nfunction paginate(records: AccessiAuditRecord[], query: AccessiAuditQuery): AccessiAuditPage {\n  const { limit, offset, order } = normalizeQuery(query);\n  const filtered = records.filter((record) => matches(record, query));\n  const ordered = order === 'asc' ? filtered : [...filtered].reverse();\n  return {\n    records: ordered.slice(offset, offset + limit),\n    total: filtered.length,\n    limit,\n    offset,\n  };\n}\n\nfunction cloneRecord(record: AccessiAuditRecord): AccessiAuditRecord {\n  return JSON.parse(JSON.stringify(record)) as AccessiAuditRecord;\n}\n\n/** Opzioni del sink in memoria. */\nexport interface MemoryAccessiAuditSinkOptions {\n  name?: string;\n  /** Numero massimo di record conservati. Default: 10000. */\n  maxRecords?: number;\n  /** Retention in millisecondi. Default: nessuna scadenza. */\n  retentionMs?: number;\n  /** Orologio iniettabile per i test. */\n  now?: () => number;\n}\n\nexport interface MemoryAccessiAuditSink extends AccessiAuditQueryableSink {\n  all(): AccessiAuditRecord[];\n  clear(): void;\n}\n\n/**\n * Sink in memoria con query e retention.\n *\n * Adatto a sviluppo, test e singola istanza. Per piu istanze usare\n * `createRedisAccessiAuditSink` o un sink esterno.\n */\nexport function createMemoryAccessiAuditSink(\n  options: MemoryAccessiAuditSinkOptions = {},\n): MemoryAccessiAuditSink {\n  const maxRecords = Math.max(1, Math.trunc(options.maxRecords ?? 10_000));\n  const retentionMs = Math.max(0, Number(options.retentionMs ?? 0));\n  const now = options.now ?? Date.now;\n  let records: AccessiAuditRecord[] = [];\n\n  const purgeExpired = (): void => {\n    if (!retentionMs) return;\n    const threshold = now() - retentionMs;\n    records = records.filter((record) => recordTime(record) >= threshold);\n  };\n\n  return {\n    name: options.name ?? 'memory',\n    write(record) {\n      records.push(cloneRecord(record));\n      if (records.length > maxRecords) records = records.slice(records.length - maxRecords);\n      purgeExpired();\n    },\n    async query(query = {}) {\n      purgeExpired();\n      return paginate(records, query);\n    },\n    async purge(before: Date) {\n      const threshold = before.getTime();\n      const beforeCount = records.length;\n      records = records.filter((record) => recordTime(record) >= threshold);\n      return beforeCount - records.length;\n    },\n    all() {\n      return records.map(cloneRecord);\n    },\n    clear() {\n      records = [];\n    },\n  };\n}\n\n/** Sink HTTP: inoltra ogni record a un endpoint esterno (SIEM, collector). */\nexport interface HttpAccessiAuditSinkOptions {\n  name?: string;\n  url: string;\n  headers?: Record<string, string>;\n  fetch?: typeof fetch;\n  timeoutMs?: number;\n}\n\nexport function createHttpAccessiAuditSink(\n  options: HttpAccessiAuditSinkOptions,\n): AccessiAuditSink {\n  if (!options?.url) throw new Error('Audit sink HTTP: url obbligatoria.');\n  return {\n    name: options.name ?? 'http',\n    async write(record) {\n      const fetchImpl = options.fetch ?? globalThis.fetch;\n      if (typeof fetchImpl !== 'function') {\n        throw new Error('Audit sink HTTP: fetch non disponibile.');\n      }\n      const controller = new AbortController();\n      const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 3000);\n      try {\n        const response = await fetchImpl(options.url, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            ...(options.headers ?? {}),\n          },\n          body: JSON.stringify(record),\n          signal: controller.signal,\n        });\n        if (!response.ok) {\n          throw new Error(`Audit sink HTTP: risposta ${response.status}.`);\n        }\n      } finally {\n        clearTimeout(timeout);\n      }\n    },\n  };\n}\n\n/**\n * Adattatore per database, OpenTelemetry o qualunque destinazione custom.\n *\n * La callback riceve un record gia redatto e serializzabile.\n */\nexport function createCallbackAccessiAuditSink(\n  write: (record: AccessiAuditRecord) => void | Promise<void>,\n  name = 'callback',\n): AccessiAuditSink {\n  return { name, write };\n}\n\nexport interface RedisAccessiAuditSinkOptions {\n  client: AccessiRedisEvalClient;\n  name?: string;\n  /** Default: `accessi:audit:`. */\n  keyPrefix?: string;\n  /** Numero massimo di record. Default: 10000. */\n  maxRecords?: number;\n  /** Retention Redis in millisecondi. Default: 30 giorni. */\n  retentionMs?: number;\n}\n\nconst REDIS_WRITE_SCRIPT = `\nlocal key = KEYS[1]\nredis.call('RPUSH', key, ARGV[1])\nredis.call('LTRIM', key, -tonumber(ARGV[2]), -1)\nredis.call('PEXPIRE', key, ARGV[3])\nreturn 1\n`;\n\nconst REDIS_READ_SCRIPT = `return redis.call('LRANGE', KEYS[1], 0, -1)`;\n\nconst REDIS_REWRITE_SCRIPT = `\nlocal key = KEYS[1]\nredis.call('DEL', key)\nfor i = 2, #ARGV do\n  redis.call('RPUSH', key, ARGV[i])\nend\nredis.call('PEXPIRE', key, ARGV[1])\nreturn #ARGV - 1\n`;\n\nfunction parseRedisRecords(value: unknown): AccessiAuditRecord[] {\n  if (!Array.isArray(value)) return [];\n  const records: AccessiAuditRecord[] = [];\n  for (const entry of value) {\n    if (typeof entry !== 'string') continue;\n    try {\n      const parsed = JSON.parse(entry) as AccessiAuditRecord;\n      if (parsed && typeof parsed.event === 'string' && typeof parsed.timestamp === 'string') {\n        records.push(parsed);\n      }\n    } catch {\n      // Un record corrotto non deve bloccare query ed export.\n    }\n  }\n  return records;\n}\n\n/**\n * Sink Redis persistente, condiviso tra istanze e interrogabile.\n *\n * Usa una lista con `LTRIM` per limitare i record e `PEXPIRE` per la retention.\n * Le query leggono la lista e filtrano lato applicazione.\n */\nexport function createRedisAccessiAuditSink(\n  options: RedisAccessiAuditSinkOptions,\n): AccessiAuditQueryableSink {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Audit sink Redis: client.eval non configurato.');\n  }\n  const client = instrumentAccessiRedisClient('audit', options.client);\n  const key = `${(options.keyPrefix ?? 'accessi:audit:').replace(/:*$/, ':')}events`;\n  const maxRecords = Math.max(1, Math.trunc(options.maxRecords ?? 10_000));\n  const retentionMs = Math.max(1_000, Math.trunc(options.retentionMs ?? 30 * 24 * 60 * 60 * 1000));\n\n  const readAll = async (): Promise<AccessiAuditRecord[]> =>\n    parseRedisRecords(await client.eval(REDIS_READ_SCRIPT, 1, key));\n\n  return {\n    name: options.name ?? 'redis',\n    async write(record) {\n      await client.eval(REDIS_WRITE_SCRIPT, 1, key, JSON.stringify(record), maxRecords, retentionMs);\n    },\n    async query(query = {}) {\n      return paginate(await readAll(), query);\n    },\n    async purge(before: Date) {\n      const records = await readAll();\n      const kept = records.filter((record) => recordTime(record) >= before.getTime());\n      const removed = records.length - kept.length;\n      if (removed === 0) return 0;\n      await client.eval(\n        REDIS_REWRITE_SCRIPT,\n        1,\n        key,\n        retentionMs,\n        ...kept.map((record) => JSON.stringify(record)),\n      );\n      return removed;\n    },\n  };\n}\n"]}

package/dist/accessi-service/security/authCookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authCookies.js","sourceRoot":"","sources":["../../../src/accessi-service/security/authCookies.ts"],"names":[],"mappings":";;AAiGA,0EAqBC;AAGD,4DAgBC;AAGD,sDAEC;AAGD,0DAIC;AAsCD,sDA6BC;AAGD,0DAkBC;AAqBD,0DAYC;AAGD,wDAOC;AAGD,0EAKC;AAGD,4EAKC;AA4BD,8EAqDC;AAGD,4DAEC;AAGD,gDAEC;AAnYD,mCAAsD;AAGtD,+CAAmD;AA6DnD,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAErD,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,KAAc;IACxB,eAAe,EAAE,gBAAgB;IACjC,gBAAgB,EAAE,iBAAiB;IACnC,aAAa,EAAE,cAAc;IAC7B,UAAU,EAAE,cAAc;IAC1B,WAAW,EAAE,mBAAmB;IAChC,QAAQ,EAAE,GAAG;IACb,cAAc,EAAE,cAAc;IAC9B,IAAI,EAAE,eAAwB;IAC9B,YAAY,EAAE,KAAK;IACnB,iBAAiB,EAAE,IAAI;CACxB,CAAC;AAEF,0FAA0F;AAC1F,MAAM,iBAAiB,GAAG;IACxB,yBAAyB;IACzB,2BAA2B;IAC3B,0CAA0C;IAC1C,qCAAqC;IACrC,qCAAqC;IACrC,mCAAmC;IACnC,qBAAqB;IACrB,sCAAsC;IACtC,4BAA4B;CAC7B,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnE,0FAA0F;AAC1F,SAAgB,+BAA+B,CAC7C,OAA2C;;IAE3C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAEpD,qCACE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,EAC5B,QAAQ,EAAE,MAAA,GAAG,CAAC,QAAQ,mCAAI,QAAQ,CAAC,QAAQ,IACxC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7C,eAAe,EAAE,MAAA,GAAG,CAAC,eAAe,mCAAI,QAAQ,CAAC,eAAe,EAChE,gBAAgB,EAAE,MAAA,GAAG,CAAC,gBAAgB,mCAAI,QAAQ,CAAC,gBAAgB,EACnE,aAAa,EAAE,MAAA,GAAG,CAAC,aAAa,mCAAI,QAAQ,CAAC,aAAa,EAC1D,UAAU,EAAE,MAAA,GAAG,CAAC,UAAU,mCAAI,QAAQ,CAAC,UAAU,EACjD,WAAW,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,QAAQ,CAAC,WAAW,EACpD,QAAQ,EAAE,MAAA,GAAG,CAAC,QAAQ,mCAAI,QAAQ,CAAC,QAAQ,EAC3C,cAAc,EAAE,CAAC,MAAA,GAAG,CAAC,cAAc,mCAAI,QAAQ,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,EAC7E,IAAI,EAAE,MAAA,GAAG,CAAC,IAAI,mCAAI,QAAQ,CAAC,IAAI,EAC/B,YAAY,EAAE,GAAG,CAAC,YAAY,KAAK,IAAI,EACvC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,KAAK,KAAK,IAClD;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAgB,wBAAwB,CAAC,MAA0B;IACjE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,SAAS;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,qDAAqD;AACrD,SAAgB,uBAAuB,CAAC,IAAY;IAClD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACvC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAA,qBAAS,EAAC,KAAK,CAAmC,CAAC;IACnE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,KAAa,EACb,OAOC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClF,KAAK,CAAC,IAAI,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,GAA6B,EAAE,MAAc;IACjE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,4DAA4D;AAC5D,SAAgB,qBAAqB,CACnC,GAA6B,EAC7B,MAAwC,EACxC,MAA4B;IAE5B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,8CACrE,IAAI,EAAE,MAAM,CAAC,UAAU,IACpB,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;YACjD,CAAC,CAAC,EAAE,aAAa,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC,KACP,QAAQ,EAAE,IAAI,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,KACtB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACnD,CAAC,CAAC;IACN,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,OAAO,8CACvE,IAAI,EAAE,MAAM,CAAC,WAAW,IACrB,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS;YAClD,CAAC,CAAC,EAAE,aAAa,EAAE,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC,KACP,QAAQ,EAAE,IAAI,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,KACtB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACnD,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAgB,uBAAuB,CACrC,GAA6B,EAC7B,MAAwC;IAExC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;QACzB,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC;QAC3C,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC;QAC7C,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC;KAC/B,EAAE,CAAC;QACX,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,EAAE,kBACxC,IAAI,EACJ,aAAa,EAAE,CAAC,EAChB,QAAQ,EAAE,IAAI,KAAK,MAAM,CAAC,aAAa,EACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IACtB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACnD,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAYD,SAAS,iBAAiB,CAAC,KAAiD;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,GAA6B,EAC7B,MAAoD,EACpD,MAAS;IAET,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE;QACjC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC;KAChD,CAAC,CAAC;IACH,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,SAAgB,sBAAsB,CACpC,MAAoD,EACpD,MAAmD;IAEnD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY;QAAE,OAAO;IAC3C,OAAO,MAAM,CAAC,KAAK,CAAC;IACpB,OAAO,MAAM,CAAC,YAAY,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,SAAgB,+BAA+B,CAC7C,MAA0B,EAC1B,MAAwC;IAExC,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AAClE,CAAC;AAED,yCAAyC;AACzC,SAAgB,gCAAgC,CAC9C,MAA0B,EAC1B,MAAwC;IAExC,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,GAAa;IAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG;QACX,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,mCAAmC;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,iCAAiC,CAC/C,OAA2C,EAC3C,cAAyC;IAEzC,MAAM,MAAM,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClD,SAAS,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClD,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,kBAC/D,IAAI,EAAE,MAAM,CAAC,QAAQ,EACrB,QAAQ,EAAE,KAAK,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IACtB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACnD,CAAC,CAAC;QACN,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,SAAS,EAAE,CAAC;YACjD,uEAAuE;YACvE,sDAAsD;YACtD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,gBAAgB,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ;eACjE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7C,IAAI,WAAW,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACrC,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,UAAU,WAAW,EAAE,CAAC;YAEpD,IACE,MAAM,CAAC,IAAI,KAAK,eAAe;mBAC5B,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;mBACjC,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EACrC,CAAC;gBACD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;oBAC/D,SAAS,CAAC,GAAG,CAAC,CAAC;oBACf,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAgB,wBAAwB,CAAC,IAAY;IACnD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,kFAAkF;AAClF,SAAgB,kBAAkB,CAAC,MAAwC;IACzE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;AACjF,CAAC","sourcesContent":["import { randomBytes, timingSafeEqual } from 'crypto';\nimport type { NextFunction, Request, Response } from 'express';\nimport type * as jwt from 'jsonwebtoken';\nimport { decode as decodeJwt } from 'jsonwebtoken';\nimport type { AccessiOptions } from '../AccessiModule';\n\n/** Modalita di autenticazione via cookie httpOnly. */\nexport interface AccessiAuthCookieOptions {\n  /** Default `true`: la sola presenza dell'oggetto abilita la modalita cookie. */\n  enabled?: boolean;\n  /** `Secure` sui cookie. Default `true`; disattivare solo in sviluppo locale HTTP. */\n  secure?: boolean;\n  /** Default `lax`. Per SPA su altro dominio serve `none` insieme a `secure: true`. */\n  sameSite?: 'strict' | 'lax' | 'none';\n  /** Dominio dei cookie, opzionale. */\n  domain?: string;\n  /** Nome del cookie con l'access token. Default `accessi_access`. */\n  accessTokenName?: string;\n  /** Nome del cookie con il refresh token. Default `accessi_refresh`. */\n  refreshTokenName?: string;\n  /** Nome del cookie CSRF leggibile dal client. Default `accessi_csrf`. */\n  csrfTokenName?: string;\n  /** Path del cookie access. Default `/api/accessi`. */\n  accessPath?: string;\n  /** Path del cookie refresh. Default `/api/accessi/auth`. */\n  refreshPath?: string;\n  /** Path del cookie CSRF. Default `/`. */\n  csrfPath?: string;\n  /** Header CSRF richiesto. Default `x-csrf-token`. */\n  csrfHeaderName?: string;\n  /** `double-submit` (default) oppure `off` per host che gestiscono CSRF altrove. */\n  csrf?: 'double-submit' | 'off';\n  /**\n   * Restituisce comunque i token nel body JSON. Default `false`: in modalita\n   * cookie i token restano solo negli header httpOnly.\n   */\n  exposeTokens?: boolean;\n  /** Legge il refresh token dal cookie quando il body non lo contiene. Default `true`. */\n  refreshFromCookie?: boolean;\n}\n\nexport type AccessiAuthCookieSetting = AccessiAuthCookieOptions;\n\nexport interface ResolvedAccessiAuthCookieOptions {\n  secure: boolean;\n  sameSite: 'strict' | 'lax' | 'none';\n  domain?: string;\n  accessTokenName: string;\n  refreshTokenName: string;\n  csrfTokenName: string;\n  accessPath: string;\n  refreshPath: string;\n  csrfPath: string;\n  csrfHeaderName: string;\n  csrf: 'double-submit' | 'off';\n  exposeTokens: boolean;\n  refreshFromCookie: boolean;\n}\n\nexport interface AccessiAuthTokenPair {\n  access?: string;\n  refresh?: string;\n}\n\nconst COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nconst DEFAULTS = {\n  secure: true,\n  sameSite: 'lax' as const,\n  accessTokenName: 'accessi_access',\n  refreshTokenName: 'accessi_refresh',\n  csrfTokenName: 'accessi_csrf',\n  accessPath: '/api/accessi',\n  refreshPath: '/api/accessi/auth',\n  csrfPath: '/',\n  csrfHeaderName: 'x-csrf-token',\n  csrf: 'double-submit' as const,\n  exposeTokens: false,\n  refreshFromCookie: true,\n};\n\n/** Percorsi pubblici che non richiedono il token CSRF (non hanno ancora una sessione). */\nconst CSRF_EXEMPT_PATHS = [\n  '/api/accessi/auth/login',\n  '/api/accessi/auth/refresh',\n  '/api/accessi/auth/confirm-reset-password',\n  '/api/accessi/auth/two-factor/verify',\n  '/api/accessi/auth/two-factor/resend',\n  '/api/accessi/auth/bootstrap-admin',\n  '/api/accessi/email/',\n  '/api/accessi/federated-auth/exchange',\n  '/api/accessi/user/register',\n];\n\nconst UNSAFE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);\n\n/** Risolve la configurazione dei cookie; `undefined` quando la modalita e disattivata. */\nexport function resolveAccessiAuthCookieOptions(\n  options: Pick<AccessiOptions, 'authCookie'>,\n): ResolvedAccessiAuthCookieOptions | undefined {\n  const raw = options.authCookie;\n  if (!raw || raw.enabled === false) return undefined;\n\n  return {\n    secure: raw.secure !== false,\n    sameSite: raw.sameSite ?? DEFAULTS.sameSite,\n    ...(raw.domain ? { domain: raw.domain } : {}),\n    accessTokenName: raw.accessTokenName ?? DEFAULTS.accessTokenName,\n    refreshTokenName: raw.refreshTokenName ?? DEFAULTS.refreshTokenName,\n    csrfTokenName: raw.csrfTokenName ?? DEFAULTS.csrfTokenName,\n    accessPath: raw.accessPath ?? DEFAULTS.accessPath,\n    refreshPath: raw.refreshPath ?? DEFAULTS.refreshPath,\n    csrfPath: raw.csrfPath ?? DEFAULTS.csrfPath,\n    csrfHeaderName: (raw.csrfHeaderName ?? DEFAULTS.csrfHeaderName).toLowerCase(),\n    csrf: raw.csrf ?? DEFAULTS.csrf,\n    exposeTokens: raw.exposeTokens === true,\n    refreshFromCookie: raw.refreshFromCookie !== false,\n  };\n}\n\n/** Legge i cookie senza aggiungere la dipendenza `cookie-parser`. */\nexport function parseAccessiCookieHeader(header: string | undefined): Record<string, string> {\n  const cookies: Record<string, string> = {};\n  if (!header) return cookies;\n  for (const part of header.split(';')) {\n    const separator = part.indexOf('=');\n    if (separator < 0) continue;\n    const name = part.slice(0, separator).trim();\n    if (!name) continue;\n    const rawValue = part.slice(separator + 1).trim();\n    try {\n      cookies[name] = decodeURIComponent(rawValue);\n    } catch {\n      cookies[name] = rawValue;\n    }\n  }\n  return cookies;\n}\n\n/** True per richieste che modificano stato (dove serve il CSRF). */\nexport function isAccessiUnsafeMethod(method: string): boolean {\n  return UNSAFE_METHODS.has(method.toUpperCase());\n}\n\n/** True per gli endpoint pubblici esenti da CSRF. */\nexport function isAccessiCsrfExemptPath(path: string): boolean {\n  return CSRF_EXEMPT_PATHS.some((exempt) =>\n    exempt.endsWith('/') ? path.startsWith(exempt) : path === exempt,\n  );\n}\n\nfunction tokenMaxAgeSeconds(token: string | undefined): number | undefined {\n  if (!token) return undefined;\n  const decoded = decodeJwt(token) as jwt.JwtPayload | string | null;\n  if (!decoded || typeof decoded === 'string') return undefined;\n  const exp = Number(decoded.exp);\n  if (!Number.isFinite(exp)) return undefined;\n  return Math.max(0, Math.floor(exp - Date.now() / 1000));\n}\n\nfunction serializeCookie(\n  name: string,\n  value: string,\n  options: {\n    path: string;\n    maxAgeSeconds?: number;\n    httpOnly?: boolean;\n    secure: boolean;\n    sameSite: 'strict' | 'lax' | 'none';\n    domain?: string;\n  },\n): string {\n  const parts = [`${name}=${encodeURIComponent(value)}`, `Path=${options.path}`];\n  if (options.domain) parts.push(`Domain=${options.domain}`);\n  if (options.maxAgeSeconds !== undefined) parts.push(`Max-Age=${options.maxAgeSeconds}`);\n  if (options.httpOnly) parts.push('HttpOnly');\n  if (options.secure) parts.push('Secure');\n  const sameSite = { strict: 'Strict', lax: 'Lax', none: 'None' }[options.sameSite];\n  parts.push(`SameSite=${sameSite}`);\n  return parts.join('; ');\n}\n\nfunction appendCookie(res: Pick<Response, 'append'>, cookie: string): void {\n  res.append('Set-Cookie', cookie);\n}\n\n/** Imposta i cookie access, refresh e (se assente) CSRF. */\nexport function setAccessiAuthCookies(\n  res: Pick<Response, 'append'>,\n  config: ResolvedAccessiAuthCookieOptions,\n  tokens: AccessiAuthTokenPair,\n): void {\n  if (tokens.access) {\n    appendCookie(res, serializeCookie(config.accessTokenName, tokens.access, {\n      path: config.accessPath,\n      ...(tokenMaxAgeSeconds(tokens.access) !== undefined\n        ? { maxAgeSeconds: tokenMaxAgeSeconds(tokens.access) }\n        : {}),\n      httpOnly: true,\n      secure: config.secure,\n      sameSite: config.sameSite,\n      ...(config.domain ? { domain: config.domain } : {}),\n    }));\n  }\n  if (tokens.refresh) {\n    appendCookie(res, serializeCookie(config.refreshTokenName, tokens.refresh, {\n      path: config.refreshPath,\n      ...(tokenMaxAgeSeconds(tokens.refresh) !== undefined\n        ? { maxAgeSeconds: tokenMaxAgeSeconds(tokens.refresh) }\n        : {}),\n      httpOnly: true,\n      secure: config.secure,\n      sameSite: config.sameSite,\n      ...(config.domain ? { domain: config.domain } : {}),\n    }));\n  }\n}\n\n/** Cancella i cookie di sessione (logout/revoca). */\nexport function clearAccessiAuthCookies(\n  res: Pick<Response, 'append'>,\n  config: ResolvedAccessiAuthCookieOptions,\n): void {\n  for (const [name, path] of [\n    [config.accessTokenName, config.accessPath],\n    [config.refreshTokenName, config.refreshPath],\n    [config.csrfTokenName, config.csrfPath],\n  ] as const) {\n    appendCookie(res, serializeCookie(name, '', {\n      path,\n      maxAgeSeconds: 0,\n      httpOnly: name !== config.csrfTokenName,\n      secure: config.secure,\n      sameSite: config.sameSite,\n      ...(config.domain ? { domain: config.domain } : {}),\n    }));\n  }\n}\n\nexport interface AccessiAuthTokenValue {\n  value?: string;\n}\n\n/** Forma comune dei risultati di auth: stringa o `TokenResult` di Accessi. */\nexport interface AccessiAuthResultLike {\n  token?: string | AccessiAuthTokenValue;\n  refreshToken?: string | AccessiAuthTokenValue;\n}\n\nfunction accessiTokenValue(token: string | AccessiAuthTokenValue | undefined): string | undefined {\n  if (typeof token === 'string') return token === '' ? undefined : token;\n  return token?.value;\n}\n\n/**\n * Prepara la risposta di login/refresh: imposta i cookie e rimuove i token dal\n * body quando la modalita cookie non prevede `exposeTokens`.\n */\nexport function applyAccessiAuthCookies<T extends AccessiAuthResultLike>(\n  res: Pick<Response, 'append'>,\n  config: ResolvedAccessiAuthCookieOptions | undefined,\n  result: T,\n): T {\n  if (!config) return result;\n  setAccessiAuthCookies(res, config, {\n    access: accessiTokenValue(result.token),\n    refresh: accessiTokenValue(result.refreshToken),\n  });\n  hideAccessiLoginTokens(config, result);\n  return result;\n}\n\n/** Rimuove i token dal `LoginResult` quando la modalita cookie li nasconde. */\nexport function hideAccessiLoginTokens(\n  config: ResolvedAccessiAuthCookieOptions | undefined,\n  result: { token?: unknown; refreshToken?: unknown },\n): void {\n  if (!config || config.exposeTokens) return;\n  delete result.token;\n  delete result.refreshToken;\n}\n\n/** Legge l'access token dal cookie (per test e per host senza middleware). */\nexport function getAccessiAccessTokenFromCookie(\n  header: string | undefined,\n  config: ResolvedAccessiAuthCookieOptions,\n): string | undefined {\n  return parseAccessiCookieHeader(header)[config.accessTokenName];\n}\n\n/** Legge il refresh token dal cookie. */\nexport function getAccessiRefreshTokenFromCookie(\n  header: string | undefined,\n  config: ResolvedAccessiAuthCookieOptions,\n): string | undefined {\n  return parseAccessiCookieHeader(header)[config.refreshTokenName];\n}\n\nfunction safeEqual(left: string, right: string): boolean {\n  const a = Buffer.from(left);\n  const b = Buffer.from(right);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\nfunction csrfError(res: Response): void {\n  res.status(403).json({\n    severity: 'error',\n    status: 403,\n    statusCode: 2,\n    code: 'AUTH_CSRF_INVALID',\n    error: 'AUTH_CSRF_INVALID',\n    message: 'Token CSRF mancante o non valido.',\n  });\n}\n\n/**\n * Middleware della modalita cookie.\n *\n * - copia l'access token dal cookie nell'header `Authorization`, cosi guard,\n *   middleware e controller esistenti funzionano senza modifiche;\n * - garantisce un cookie CSRF double-submit leggibile dal client;\n * - blocca le richieste autenticate via cookie che modificano stato senza\n *   l'header CSRF, salvo endpoint pubblici di bootstrap della sessione.\n */\nexport function createAccessiAuthCookieMiddleware(\n  options: Pick<AccessiOptions, 'authCookie'>,\n  isAccessiRoute: (path: string) => boolean,\n): ((req: Request, res: Response, next: NextFunction) => void) | undefined {\n  const config = resolveAccessiAuthCookieOptions(options);\n  if (!config) return undefined;\n\n  return (req: Request, res: Response, next: NextFunction): void => {\n    if (!isAccessiRoute(req.path)) {\n      next();\n      return;\n    }\n\n    const cookies = parseAccessiCookieHeader(req.headers.cookie);\n    let csrfToken = cookies[config.csrfTokenName];\n    if (!csrfToken && config.csrf === 'double-submit') {\n      csrfToken = randomBytes(32).toString('base64url');\n      appendCookie(res, serializeCookie(config.csrfTokenName, csrfToken, {\n        path: config.csrfPath,\n        httpOnly: false,\n        secure: config.secure,\n        sameSite: config.sameSite,\n        ...(config.domain ? { domain: config.domain } : {}),\n      }));\n    }\n    if (config.csrf === 'double-submit' && csrfToken) {\n      // Rende il token leggibile anche a una SPA su altra origine (via CORS,\n      // con `Access-Control-Expose-Headers: X-CSRF-Token`).\n      res.setHeader('X-CSRF-Token', csrfToken);\n    }\n\n    const accessToken = cookies[config.accessTokenName];\n    const hasAuthorization = typeof req.headers.authorization === 'string'\n      && req.headers.authorization.trim() !== '';\n    if (accessToken && !hasAuthorization) {\n      req.headers.authorization = `Bearer ${accessToken}`;\n\n      if (\n        config.csrf === 'double-submit'\n        && isAccessiUnsafeMethod(req.method)\n        && !isAccessiCsrfExemptPath(req.path)\n      ) {\n        const headerValue = req.headers[config.csrfHeaderName];\n        const provided = Array.isArray(headerValue) ? headerValue[0] : headerValue;\n        if (!csrfToken || !provided || !safeEqual(provided, csrfToken)) {\n          csrfError(res);\n          return;\n        }\n      }\n    }\n\n    next();\n  };\n}\n\n/** True se il nome cookie e valido per l'header `Set-Cookie`. */\nexport function isValidAccessiCookieName(name: string): boolean {\n  return COOKIE_NAME.test(name);\n}\n\n/** Helpers per le combinazioni di cookie supportate (usati dalla validazione). */\nexport function accessiCookieNames(config: ResolvedAccessiAuthCookieOptions): string[] {\n  return [config.accessTokenName, config.refreshTokenName, config.csrfTokenName];\n}\n"]}

package/dist/accessi-service/security/authenticatedToken.d.ts

@@ -0,0 +1,31 @@
+import { StatoRegistrazione } from '../dtos/StatoRegistrazione';
+/** Stato autorevole minimo riletto dal database per ogni verifica JWT. */
+export interface AccessiAuthenticatedUserSnapshot {
+    codiceUtente: number;
+    email?: string;
+    statoRegistrazione: StatoRegistrazione;
+    flagSuper: boolean;
+    flagAdmin: boolean;
+    flagDueFattori?: boolean;
+    passwordlessLoginEnabled?: boolean;
+    passwordLoginEnabled?: boolean;
+}
+/** Shared, strict Bearer parsing for the Nest guard and Express middleware. */
+export declare function extractAccessiBearerToken(header: unknown): string | undefined;
+/** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */
+export declare function resolveCodiceUtenteFromTokenPayload(decoded: unknown, expectedType?: 'access' | 'refresh'): number | undefined;
+/**
+ * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.
+ * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.
+ */
+export declare function buildAuthenticatedTokenPayload(decoded: unknown, utente: AccessiAuthenticatedUserSnapshot): Record<string, unknown>;
+/**
+ * Riconosce i token emessi dalla console per l'accesso temporaneo "Login as".
+ * L'attore ha gia completato l'autenticazione amministrativa, quindi il token
+ * non richiede un ulteriore codice email anche se il target ha la 2FA attiva.
+ */
+export declare function isLoginAsTokenPayload(decoded: unknown): boolean;
+/** Enabling 2FA invalidates sessions which have not completed the required verification. */
+export declare function isAccessiTokenAllowedForUser(decoded: unknown, user: AccessiAuthenticatedUserSnapshot): boolean;
+/** Un JWT puo essere usato soltanto da utenti nello stato confermato, indipendentemente dalla sua scadenza. */
+export declare function isAuthenticatedUserEnabledForJwt(utente: AccessiAuthenticatedUserSnapshot | null | undefined): utente is AccessiAuthenticatedUserSnapshot;