emilsoftware-utilities 2.0.0-dev.83 → 2.0.0-dev.85

package/dist/accessi-service/security/validateOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateOptions.js","sourceRoot":"","sources":["../../../src/accessi-service/security/validateOptions.ts"],"names":[],"mappings":";;AAuCA,wDAoLC;AAGD,8DAQC;AAtOD,mCAAyC;AAEzC,+CAIuB;AAYvB,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC/D,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,OAAuB;;IAC5D,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAoC,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAEvF,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe,CAAA,EAAE,CAAC;QAC9B,QAAQ,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,CAAC;IAChC,MAAM,MAAM,GAAG,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,EAAE,mCAAmC,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC9B,UAAU,CAAC,yBAAyB,EAAE,uDAAuD,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,EAAE,CAAC;QACpB,QAAQ,CAAC,6BAA6B,EAAE,sCAAsC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,mCAAI,OAAO,CAAC;IAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,MAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,EAAE,CAAC;YACtC,UAAU,CACR,uCAAuC,EACvC,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAA,EAAE,CAAC;YACrB,QAAQ,CAAC,iCAAiC,EAAE,4CAA4C,SAAS,GAAG,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAA,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAA,EAAE,CAAC;YACxC,QAAQ,CAAC,gCAAgC,EAAE,2CAA2C,SAAS,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,KAAK,CAAA,EAAE,CAAC;YAChB,UAAU,CAAC,4BAA4B,EAAE,uDAAuD,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,CAAA,EAAE,CAAC;YACnB,UAAU,CACR,2BAA2B,EAC3B,sEAAsE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,kBAAkB,mCAAI,EAAE,CAAC;IACnD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,UAAU,CACR,qCAAqC,EACrC,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,IAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,KAAK;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,YAAY,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YACvC,IAAI,CAAC;gBACH,IAAA,wBAAe,EAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC;YAAC,WAAM,CAAC;gBACP,QAAQ,CACN,kCAAkC,EAClC,sBAAsB,KAAK,yCAAyC,CACrE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,UAAU,CACR,qCAAqC,EACrC,sBAAsB,KAAK,0DAA0D,CACtF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,UAAU,CACR,wCAAwC,EACxC,sBAAsB,KAAK,YAAY,QAAQ,CAAC,KAAK,0CAA0C,CAChG,CAAC;gBACF,OAAO;YACT,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,EAAE,CAAC;QACjB,UAAU,CAAC,4BAA4B,EAAE,oDAAoD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,CAAA,EAAE,CAAC;QACnB,UAAU,CAAC,8BAA8B,EAAE,sDAAsD,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,CAAA,EAAE,CAAC;QAC5B,QAAQ,CAAC,gCAAgC,EAAE,+BAA+B,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7C,UAAU,CAAC,6BAA6B,EAAE,mDAAmD,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9C,UAAU,CAAC,kCAAkC,EAAE,yDAAyD,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0BAA0B,CAAC,EAAE,CAAC;QACpD,UAAU,CAAC,yCAAyC,EAAE,+DAA+D,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,KAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,UAAU,CAAC,iCAAiC,EAAE,kDAAkD,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,mBAAmB,0CAAE,KAAK,KAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjG,QAAQ,CAAC,mCAAmC,EAAE,0DAA0D,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,mBAAmB,0CAAE,KAAK,KAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACpG,QAAQ,CAAC,qCAAqC,EAAE,6DAA6D,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9F,QAAQ,CAAC,wCAAwC,EAAE,8CAA8C,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACpG,QAAQ,CAAC,0CAA0C,EAAE,iDAAiD,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,0CAAE,KAAK,MAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,QAAQ,CAAC,mCAAmC,EAAE,0CAA0C,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,6CAA+B,EAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;IAClE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,IAAA,gCAAkB,EAAC,UAAU,CAAC,CAAC;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,IAAI,CAAC,IAAA,sCAAwB,EAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,QAAQ,CACN,kCAAkC,EAClC,mBAAmB,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACjD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACzC,QAAQ,CACN,oCAAoC,EACpC,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACzD,QAAQ,CACN,4CAA4C,EAC5C,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,kCAAkC,EAAE,mCAAmC,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,kCAAkC,EAAE,oCAAoC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,kCAAkC,EAAE,iCAAiC,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC9B,UAAU,CACR,mCAAmC,EACnC,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5B,UAAU,CACR,oCAAoC,EACpC,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,gBAAgB,CAAA,IAAI,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAC3D,UAAU,CACR,sCAAsC,EACtC,8EAA8E,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,SAAgB,yBAAyB,CAAC,OAAuB;IAC/D,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;AACJ,CAAC","sourcesContent":["import { createPublicKey } from 'crypto';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n  accessiCookieNames,\n  isValidAccessiCookieName,\n  resolveAccessiAuthCookieOptions,\n} from './authCookies';\n\nexport interface AccessiOptionsValidationIssue {\n  code: string;\n  message: string;\n}\n\nexport interface AccessiOptionsValidationResult {\n  errors: AccessiOptionsValidationIssue[];\n  warnings: AccessiOptionsValidationIssue[];\n}\n\nfunction isHttpUrl(value: string | undefined): boolean {\n  if (!value) return false;\n  try {\n    const url = new URL(value);\n    return url.protocol === 'http:' || url.protocol === 'https:';\n  } catch {\n    return false;\n  }\n}\n\nfunction positive(value: number | undefined): boolean {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0;\n}\n\n/**\n * Validazione fail-fast della configurazione Accessi.\n *\n * `createAccessiService` usa `assertValidAccessiOptions`; i bootstrap esistenti\n * possono usare `validateAccessiOptions` per loggare warning senza rompere il\n * comportamento storico.\n */\nexport function validateAccessiOptions(options: AccessiOptions): AccessiOptionsValidationResult {\n  const errors: AccessiOptionsValidationIssue[] = [];\n  const warnings: AccessiOptionsValidationIssue[] = [];\n\n  const addError = (code: string, message: string) => errors.push({ code, message });\n  const addWarning = (code: string, message: string) => warnings.push({ code, message });\n\n  if (!options?.databaseOptions) {\n    addError('ACCESSI_DB_OPTIONS_MISSING', 'databaseOptions e obbligatorio.');\n  }\n\n  const jwt = options?.jwtOptions;\n  const secret = jwt?.secret || process.env.ACC_JWT_SECRET;\n  if (!secret) {\n    addError('ACCESSI_JWT_SECRET_MISSING', 'jwtOptions.secret e obbligatorio.');\n  } else if (secret.length < 32) {\n    addWarning('ACCESSI_JWT_SECRET_WEAK', 'jwtOptions.secret dovrebbe avere almeno 32 caratteri.');\n  }\n\n  if (!jwt?.expiresIn) {\n    addError('ACCESSI_JWT_EXPIRES_MISSING', 'jwtOptions.expiresIn e obbligatorio.');\n  }\n\n  const algorithm = jwt?.algorithm ?? 'HS256';\n  if (algorithm.startsWith('HS')) {\n    if (jwt?.privateKey || jwt?.publicKey) {\n      addWarning(\n        'ACCESSI_JWT_ASYMMETRIC_KEYS_WITH_HMAC',\n        'Sono configurate chiavi asimmetriche ma algorithm e HS256: verranno ignorate.',\n      );\n    }\n  } else {\n    if (!jwt?.privateKey) {\n      addError('ACCESSI_JWT_PRIVATE_KEY_MISSING', `jwtOptions.privateKey e obbligatoria per ${algorithm}.`);\n    }\n    if (!jwt?.publicKey && !jwt?.privateKey) {\n      addError('ACCESSI_JWT_PUBLIC_KEY_MISSING', `jwtOptions.publicKey e obbligatoria per ${algorithm}.`);\n    }\n    if (!jwt?.keyId) {\n      addWarning('ACCESSI_JWT_KEY_ID_MISSING', 'jwtOptions.keyId e consigliato per la rotazione JWKS.');\n    }\n    if (!jwt?.jwksPath) {\n      addWarning(\n        'ACCESSI_JWKS_PATH_DEFAULT',\n        'jwksPath non configurato: verra usato accessi/.well-known/jwks.json.',\n      );\n    }\n  }\n\n  const previousKeys = jwt?.previousPublicKeys ?? [];\n  if (previousKeys.length > 0 && algorithm.startsWith('HS')) {\n    addWarning(\n      'ACCESSI_JWT_PREVIOUS_KEYS_WITH_HMAC',\n      'previousPublicKeys e configurato ma algorithm e HS*: le chiavi verranno ignorate.',\n    );\n  }\n  if (!algorithm.startsWith('HS') && previousKeys.length > 0) {\n    const knownKeyIds = new Set<string>();\n    if (jwt?.keyId) knownKeyIds.add(jwt.keyId);\n    previousKeys.forEach((previous, index) => {\n      try {\n        createPublicKey(previous.publicKey);\n      } catch {\n        addError(\n          'ACCESSI_JWT_PREVIOUS_KEY_INVALID',\n          `previousPublicKeys[${index}] non e una chiave pubblica PEM valida.`,\n        );\n      }\n      if (!previous.keyId) {\n        addWarning(\n          'ACCESSI_JWT_PREVIOUS_KEY_ID_MISSING',\n          `previousPublicKeys[${index}] non ha keyId: verra usato il fingerprint della chiave.`,\n        );\n        return;\n      }\n      if (knownKeyIds.has(previous.keyId)) {\n        addWarning(\n          'ACCESSI_JWT_PREVIOUS_KEY_DUPLICATE_KID',\n          `previousPublicKeys[${index}].keyId \"${previous.keyId}\" e duplicato: vince la chiave corrente.`,\n        );\n        return;\n      }\n      knownKeyIds.add(previous.keyId);\n    });\n  }\n\n  if (!jwt?.issuer) {\n    addWarning('ACCESSI_JWT_ISSUER_MISSING', 'jwtOptions.issuer e consigliato in multi-servizio.');\n  }\n  if (!jwt?.audience) {\n    addWarning('ACCESSI_JWT_AUDIENCE_MISSING', 'jwtOptions.audience e consigliato in multi-servizio.');\n  }\n\n  if (!options?.encryptionKey) {\n    addError('ACCESSI_ENCRYPTION_KEY_MISSING', 'encryptionKey e obbligatoria.');\n  } else if (options.encryptionKey.length < 16) {\n    addWarning('ACCESSI_ENCRYPTION_KEY_WEAK', 'encryptionKey dovrebbe avere almeno 16 caratteri.');\n  }\n\n  if (!isHttpUrl(options?.confirmationEmailUrl)) {\n    addWarning('ACCESSI_CONFIRMATION_URL_INVALID', 'confirmationEmailUrl dovrebbe essere un URL http/https.');\n  }\n  if (!isHttpUrl(options?.confirmationEmailReturnUrl)) {\n    addWarning('ACCESSI_CONFIRMATION_RETURN_URL_INVALID', 'confirmationEmailReturnUrl dovrebbe essere un URL http/https.');\n  }\n  if (options?.publicBaseUrl && !isHttpUrl(options.publicBaseUrl)) {\n    addWarning('ACCESSI_PUBLIC_BASE_URL_INVALID', 'publicBaseUrl dovrebbe essere un URL http/https.');\n  }\n\n  if (options?.publicAuthRateLimit?.login && !positive(options.publicAuthRateLimit.login.windowMs)) {\n    addError('ACCESSI_RATE_LIMIT_WINDOW_INVALID', 'publicAuthRateLimit.login.windowMs deve essere positivo.');\n  }\n  if (options?.publicAuthRateLimit?.login && !positive(options.publicAuthRateLimit.login.maxAttempts)) {\n    addError('ACCESSI_RATE_LIMIT_ATTEMPTS_INVALID', 'publicAuthRateLimit.login.maxAttempts deve essere positivo.');\n  }\n  if (options?.edgeRateLimit) {\n    if (options.edgeRateLimit.windowMs !== undefined && !positive(options.edgeRateLimit.windowMs)) {\n      addError('ACCESSI_EDGE_RATE_LIMIT_WINDOW_INVALID', 'edgeRateLimit.windowMs deve essere positivo.');\n    }\n    if (options.edgeRateLimit.maxAttempts !== undefined && !positive(options.edgeRateLimit.maxAttempts)) {\n      addError('ACCESSI_EDGE_RATE_LIMIT_ATTEMPTS_INVALID', 'edgeRateLimit.maxAttempts deve essere positivo.');\n    }\n  }\n  if (options?.consoleEntry?.ttlMs !== undefined && !positive(options.consoleEntry.ttlMs)) {\n    addError('ACCESSI_CONSOLE_ENTRY_TTL_INVALID', 'consoleEntry.ttlMs deve essere positivo.');\n  }\n\n  const authCookie = resolveAccessiAuthCookieOptions(options ?? {});\n  if (authCookie) {\n    const names = accessiCookieNames(authCookie);\n    names.forEach((name, index) => {\n      if (!isValidAccessiCookieName(name)) {\n        addError(\n          'ACCESSI_AUTH_COOKIE_NAME_INVALID',\n          `Il nome cookie \"${names[index]}\" non e valido.`,\n        );\n      }\n    });\n    if (new Set(names).size !== names.length) {\n      addError(\n        'ACCESSI_AUTH_COOKIE_NAME_DUPLICATE',\n        'I nomi dei cookie access, refresh e CSRF devono essere diversi.',\n      );\n    }\n    if (authCookie.sameSite === 'none' && !authCookie.secure) {\n      addError(\n        'ACCESSI_AUTH_COOKIE_SAMESITE_NONE_INSECURE',\n        'SameSite=None richiede secure: true.',\n      );\n    }\n    if (!authCookie.accessPath.startsWith('/')) {\n      addError('ACCESSI_AUTH_COOKIE_PATH_INVALID', 'accessPath deve iniziare con \"/\".');\n    }\n    if (!authCookie.refreshPath.startsWith('/')) {\n      addError('ACCESSI_AUTH_COOKIE_PATH_INVALID', 'refreshPath deve iniziare con \"/\".');\n    }\n    if (!authCookie.csrfPath.startsWith('/')) {\n      addError('ACCESSI_AUTH_COOKIE_PATH_INVALID', 'csrfPath deve iniziare con \"/\".');\n    }\n    if (authCookie.csrf === 'off') {\n      addWarning(\n        'ACCESSI_AUTH_COOKIE_CSRF_DISABLED',\n        'CSRF disattivato in modalita cookie: l host deve applicare una propria protezione.',\n      );\n    }\n    if (authCookie.exposeTokens) {\n      addWarning(\n        'ACCESSI_AUTH_COOKIE_TOKENS_EXPOSED',\n        'exposeTokens restituisce i token nel body: riduce il beneficio di httpOnly.',\n      );\n    }\n    if (!jwt?.refreshExpiresIn && authCookie.refreshFromCookie) {\n      addWarning(\n        'ACCESSI_AUTH_COOKIE_REFRESH_DISABLED',\n        'refreshFromCookie e attivo ma jwtOptions.refreshExpiresIn non e configurato.',\n      );\n    }\n  }\n\n  return { errors, warnings };\n}\n\n/** Lancia un errore aggregato se la configurazione non e valida. */\nexport function assertValidAccessiOptions(options: AccessiOptions): void {\n  const result = validateAccessiOptions(options);\n  if (result.errors.length === 0) return;\n  throw new Error(\n    `Configurazione Accessi non valida:\\n${result.errors\n      .map((issue) => `- ${issue.code}: ${issue.message}`)\n      .join('\\n')}`,\n  );\n}\n"]}

package/dist/accessi-service/services/admin-bootstrap-service/AdminBootstrapService.d.ts

@@ -0,0 +1,33 @@
+import type { AccessiOptions } from '../../AccessiModule';
+import { AuthService } from '../auth-service/AuthService';
+import { UserService } from '../user-service/UserService';
+export interface BootstrapAdminResult {
+    codiceUtente: number;
+    email: string;
+    /** Presente solo quando la password e stata generata dal server. */
+    password?: string;
+    passwordGenerated: boolean;
+}
+/**
+ * Crea il primo utente admin tramite il token casuale di avvio. Non invia email di conferma:
+ * l'utente nasce in stato CONF e con password impostata (fornita o generata). Il token e monouso
+ * e valido solo per il processo corrente.
+ */
+export declare class AdminBootstrapService {
+    private readonly options;
+    private readonly userService;
+    private readonly authService;
+    private readonly logger;
+    constructor(options: AccessiOptions, userService: UserService, authService: AuthService);
+    /** Indica se il backend ha abilitato l'area "crea utente admin". */
+    isEnabled(): boolean;
+    bootstrap(request: {
+        token?: string;
+        email?: string;
+        nome?: string;
+        cognome?: string;
+        password?: string;
+        superUser?: boolean;
+    }): Promise<BootstrapAdminResult>;
+    private generatePassword;
+}

package/dist/accessi-service/services/admin-bootstrap-service/AdminBootstrapService.js

@@ -0,0 +1,106 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var AdminBootstrapService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminBootstrapService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const Logger_1 = require("../../../Logger");
+const StatoRegistrazione_1 = require("../../dtos/StatoRegistrazione");
+const AuthService_1 = require("../auth-service/AuthService");
+const UserService_1 = require("../user-service/UserService");
+const adminBootstrap_1 = require("../../security/adminBootstrap");
+/**
+ * Crea il primo utente admin tramite il token casuale di avvio. Non invia email di conferma:
+ * l'utente nasce in stato CONF e con password impostata (fornita o generata). Il token e monouso
+ * e valido solo per il processo corrente.
+ */
+let AdminBootstrapService = AdminBootstrapService_1 = class AdminBootstrapService {
+    constructor(options, userService, authService) {
+        this.options = options;
+        this.userService = userService;
+        this.authService = authService;
+        this.logger = new Logger_1.Logger(AdminBootstrapService_1.name);
+    }
+    /** Indica se il backend ha abilitato l'area "crea utente admin". */
+    isEnabled() {
+        var _a;
+        return ((_a = this.options.adminBootstrap) === null || _a === void 0 ? void 0 : _a.enabled) === true;
+    }
+    bootstrap(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            if (!this.isEnabled()) {
+                throw new common_1.ForbiddenException({
+                    code: 'ACCESSI_ADMIN_BOOTSTRAP_DISABLED',
+                    message: 'Il bootstrap admin non e abilitato in questa istanza Accessi.',
+                });
+            }
+            if (!(0, adminBootstrap_1.isValidAdminBootstrapToken)(request === null || request === void 0 ? void 0 : request.token)) {
+                throw new common_1.UnauthorizedException({
+                    code: 'ACCESSI_ADMIN_BOOTSTRAP_TOKEN_INVALID',
+                    message: 'Token di bootstrap non valido.',
+                });
+            }
+            const email = typeof (request === null || request === void 0 ? void 0 : request.email) === 'string' ? request.email.trim().toLowerCase() : '';
+            if (!email) {
+                throw new common_1.BadRequestException({
+                    code: 'ACCESSI_ADMIN_BOOTSTRAP_EMAIL_REQUIRED',
+                    message: "L'email e obbligatoria per creare l'utente admin.",
+                });
+            }
+            const superUser = (_a = request === null || request === void 0 ? void 0 : request.superUser) !== null && _a !== void 0 ? _a : ((_b = this.options.adminBootstrap) === null || _b === void 0 ? void 0 : _b.superUser) !== false;
+            const providedPassword = typeof (request === null || request === void 0 ? void 0 : request.password) === 'string' ? request.password : '';
+            const password = providedPassword.length > 0 ? providedPassword : this.generatePassword();
+            const passwordGenerated = providedPassword.length === 0;
+            const codiceUtente = yield this.userService.register({
+                email,
+                nome: request === null || request === void 0 ? void 0 : request.nome,
+                cognome: request === null || request === void 0 ? void 0 : request.cognome,
+                flagAdmin: true,
+                flagSuper: superUser,
+            }, { allowPrivilegedFields: true, initialState: StatoRegistrazione_1.StatoRegistrazione.CONF });
+            yield this.authService.setPassword(codiceUtente, password);
+            // Monouso: un bootstrap riuscito invalida il token fino al prossimo riavvio.
+            (0, adminBootstrap_1.clearAdminBootstrapToken)();
+            this.logger.info(`Utente admin di bootstrap creato: ${email} (codice ${codiceUtente}). Token invalidato.`);
+            return {
+                codiceUtente,
+                email,
+                password: passwordGenerated ? password : undefined,
+                passwordGenerated,
+            };
+        });
+    }
+    generatePassword() {
+        return `Aa1!${(0, crypto_1.randomBytes)(9).toString('base64url')}`;
+    }
+};
+exports.AdminBootstrapService = AdminBootstrapService;
+exports.AdminBootstrapService = AdminBootstrapService = AdminBootstrapService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object, UserService_1.UserService,
+        AuthService_1.AuthService])
+], AdminBootstrapService);
+//# sourceMappingURL=AdminBootstrapService.js.map

package/dist/accessi-service/services/admin-bootstrap-service/AdminBootstrapService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminBootstrapService.js","sourceRoot":"","sources":["../../../../src/accessi-service/services/admin-bootstrap-service/AdminBootstrapService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoH;AACpH,mCAAqC;AACrC,4CAAyC;AAEzC,sEAAmE;AACnE,6DAA0D;AAC1D,6DAA0D;AAC1D,kEAAqG;AAUrG;;;;GAIG;AAEI,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAGhC,YAC6B,OAAwC,EAClD,WAAwB,EACxB,WAAwB;QAFG,YAAO,GAAP,OAAO,CAAgB;QAClD,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;QAL1B,WAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAM9D,CAAC;IAEJ,oEAAoE;IACpE,SAAS;;QACP,OAAO,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,cAAc,0CAAE,OAAO,MAAK,IAAI,CAAC;IACvD,CAAC;IAEK,SAAS,CAAC,OAAoH;;;YAClI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,kCAAkC;oBACxC,OAAO,EAAE,+DAA+D;iBACzE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,IAAA,2CAA0B,EAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,8BAAqB,CAAC;oBAC9B,IAAI,EAAE,uCAAuC;oBAC7C,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,4BAAmB,CAAC;oBAC5B,IAAI,EAAE,wCAAwC;oBAC9C,OAAO,EAAE,mDAAmD;iBAC7D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,SAAS,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,mCAAI,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,cAAc,0CAAE,SAAS,MAAK,KAAK,CAAC;YACzF,MAAM,gBAAgB,GAAG,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1F,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC;YAExD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAClD;gBACE,KAAK;gBACL,IAAI,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI;gBACnB,OAAO,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO;gBACzB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,SAAS;aACrB,EACD,EAAE,qBAAqB,EAAE,IAAI,EAAE,YAAY,EAAE,uCAAkB,CAAC,IAAI,EAAE,CACvE,CAAC;YAEF,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAE3D,6EAA6E;YAC7E,IAAA,yCAAwB,GAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,KAAK,YAAY,YAAY,sBAAsB,CAAC,CAAC;YAE3G,OAAO;gBACL,YAAY;gBACZ,KAAK;gBACL,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAClD,iBAAiB;aAClB,CAAC;QACJ,CAAC;KAAA;IAEO,gBAAgB;QACtB,OAAO,OAAO,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACvD,CAAC;CACF,CAAA;AAtEY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACX,yBAAW;GANhC,qBAAqB,CAsEjC","sourcesContent":["import { BadRequestException, ForbiddenException, Inject, Injectable, UnauthorizedException } from '@nestjs/common';\nimport { randomBytes } from 'crypto';\nimport { Logger } from '../../../Logger';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { StatoRegistrazione } from '../../dtos/StatoRegistrazione';\nimport { AuthService } from '../auth-service/AuthService';\nimport { UserService } from '../user-service/UserService';\nimport { clearAdminBootstrapToken, isValidAdminBootstrapToken } from '../../security/adminBootstrap';\n\nexport interface BootstrapAdminResult {\n  codiceUtente: number;\n  email: string;\n  /** Presente solo quando la password e stata generata dal server. */\n  password?: string;\n  passwordGenerated: boolean;\n}\n\n/**\n * Crea il primo utente admin tramite il token casuale di avvio. Non invia email di conferma:\n * l'utente nasce in stato CONF e con password impostata (fornita o generata). Il token e monouso\n * e valido solo per il processo corrente.\n */\n@Injectable()\nexport class AdminBootstrapService {\n  private readonly logger = new Logger(AdminBootstrapService.name);\n\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n    private readonly userService: UserService,\n    private readonly authService: AuthService,\n  ) {}\n\n  /** Indica se il backend ha abilitato l'area \"crea utente admin\". */\n  isEnabled(): boolean {\n    return this.options.adminBootstrap?.enabled === true;\n  }\n\n  async bootstrap(request: { token?: string; email?: string; nome?: string; cognome?: string; password?: string; superUser?: boolean }): Promise<BootstrapAdminResult> {\n    if (!this.isEnabled()) {\n      throw new ForbiddenException({\n        code: 'ACCESSI_ADMIN_BOOTSTRAP_DISABLED',\n        message: 'Il bootstrap admin non e abilitato in questa istanza Accessi.',\n      });\n    }\n\n    if (!isValidAdminBootstrapToken(request?.token)) {\n      throw new UnauthorizedException({\n        code: 'ACCESSI_ADMIN_BOOTSTRAP_TOKEN_INVALID',\n        message: 'Token di bootstrap non valido.',\n      });\n    }\n\n    const email = typeof request?.email === 'string' ? request.email.trim().toLowerCase() : '';\n    if (!email) {\n      throw new BadRequestException({\n        code: 'ACCESSI_ADMIN_BOOTSTRAP_EMAIL_REQUIRED',\n        message: \"L'email e obbligatoria per creare l'utente admin.\",\n      });\n    }\n\n    const superUser = request?.superUser ?? this.options.adminBootstrap?.superUser !== false;\n    const providedPassword = typeof request?.password === 'string' ? request.password : '';\n    const password = providedPassword.length > 0 ? providedPassword : this.generatePassword();\n    const passwordGenerated = providedPassword.length === 0;\n\n    const codiceUtente = await this.userService.register(\n      {\n        email,\n        nome: request?.nome,\n        cognome: request?.cognome,\n        flagAdmin: true,\n        flagSuper: superUser,\n      },\n      { allowPrivilegedFields: true, initialState: StatoRegistrazione.CONF },\n    );\n\n    await this.authService.setPassword(codiceUtente, password);\n\n    // Monouso: un bootstrap riuscito invalida il token fino al prossimo riavvio.\n    clearAdminBootstrapToken();\n    this.logger.info(`Utente admin di bootstrap creato: ${email} (codice ${codiceUtente}). Token invalidato.`);\n\n    return {\n      codiceUtente,\n      email,\n      password: passwordGenerated ? password : undefined,\n      passwordGenerated,\n    };\n  }\n\n  private generatePassword(): string {\n    return `Aa1!${randomBytes(9).toString('base64url')}`;\n  }\n}\n"]}

package/dist/accessi-service/services/auth-service/AuthService.d.ts

@@ -0,0 +1,127 @@
+import { TwoFactorService } from '../two-factor-service/TwoFactorService';
+import type { AccessiOptions } from "../../AccessiModule";
+import { LoginRequest } from "../../dtos/LoginRequest";
+import { LoginResult } from "../../dtos/LoginResponse";
+import { UserService } from "../user-service/UserService";
+import { FiltriService } from "../filtri-service/FiltriService";
+import { TokenResult } from '../../dtos/TokenResult';
+/** Error code deliberately returned when a user is configured as SSO-only. */
+export declare const PASSWORD_LOGIN_DISABLED = "PASSWORD_LOGIN_DISABLED";
+/** Esito di una verifica token usata dall'endpoint di introspection. */
+export interface AccessiTokenIntrospectionResult {
+    active: boolean;
+    codiceUtente?: number;
+    payload?: Record<string, unknown>;
+}
+interface AccessiTokenIssueOptions {
+    /** Sovrascrive jwtOptions.expiresIn per token a durata ridotta (es. Login as). */
+    expiresIn?: string | number;
+    /** Claim aggiuntive, per esempio l'attore che ha generato un token di impersonazione. */
+    extraClaims?: Record<string, unknown>;
+}
+export declare class AuthService {
+    private userService;
+    private filtriService;
+    private readonly accessiOptions;
+    private readonly twoFactorService;
+    private readonly logger;
+    constructor(userService: UserService, filtriService: FiltriService, accessiOptions: AccessiOptions, twoFactorService: TwoFactorService);
+    private refreshPasswordExpiration;
+    private isMockDemoUserEnabled;
+    private createToken;
+    /** Creates the normal internal JWT consumed by all existing Accessi guards. */
+    createAccessiToken(utente: LoginResult['utente'], methods?: string[], tokenOptions?: AccessiTokenIssueOptions): TokenResult;
+    /** Emette il refresh token quando `jwtOptions.refreshExpiresIn` e configurato. */
+    createRefreshToken(utente: LoginResult['utente'], methods?: string[], tokenOptions?: AccessiTokenIssueOptions): TokenResult | undefined;
+    /** Crea la coppia access + refresh token usata da login, 2FA e SSO. */
+    createTokenPair(utente: LoginResult['utente'], methods?: string[], options?: {
+        familyId?: string;
+    }): {
+        access: TokenResult;
+        refresh?: TokenResult;
+    };
+    /**
+     * Emette l'access token per l'utente target, con l'attore registrato nelle
+     * claim `act` e `loginAs`. La durata e' quella standard di jwtOptions.expiresIn.
+     */
+    createLoginAsToken(utente: LoginResult['utente'], actor: {
+        codiceUtente: number;
+        email?: string;
+    }): TokenResult;
+    /** Builds the standard login response for a user authenticated by a supported method. */
+    getLoginResultForUser(codiceUtente: number, scope?: string): Promise<LoginResult>;
+    /** Users without a row retain the historic password-login enabled default. */
+    private isPasswordLoginEnabled;
+    /**
+     * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.
+     * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.
+     * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.
+     */
+    login(request: LoginRequest): Promise<LoginResult>;
+    /**
+     * Verifica un access token Accessi senza sollevare eccezioni per token invalidi.
+     *
+     * Gli errori di configurazione o database continuano a propagarsi: un problema
+     * infrastrutturale non deve essere confuso con un token scaduto.
+     */
+    introspectAccessToken(token: string): Promise<AccessiTokenIntrospectionResult>;
+    /**
+     * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.
+     * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.
+     */
+    getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>>;
+    /**
+     * Scambia un refresh token valido con una nuova coppia access + refresh.
+     *
+     * Il refresh token non e accettato dai guard API: ha `typ: "refresh"`.
+     */
+    refreshAccessToken(refreshToken: string): Promise<LoginResult>;
+    /**
+     * Gestisce il riuso di un refresh token gia consumato.
+     *
+     * Il riuso entro `reuseGraceMs` e trattato come retry concorrente del client e
+     * non revoca nulla. Oltre la finestra e considerato un possibile furto: viene
+     * revocata l'intera famiglia (stesso login) e, solo se esplicitamente
+     * configurato, anche le altre sessioni dell'utente.
+     */
+    private handleRefreshTokenReuse;
+    /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */
+    beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult>;
+    private validateTwoFactorProof;
+    verifyTwoFactor(challengeId: string, code: string, scope?: string): Promise<LoginResult>;
+    resendTwoFactor(challengeId: string): Promise<LoginResult>;
+    /**
+     * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.
+     * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di
+     * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.
+     * Con `revokeSessions` (default true) invalida le sessioni precedenti: un cambio password deve
+     * interrompere i token gia emessi.
+     */
+    setPassword(codiceUtente: number, nuovaPassword: string, options?: {
+        enforcePolicy?: boolean;
+        revokeSessions?: boolean;
+    }): Promise<import("../../../Orm").Row[]>;
+    /**
+     * Revoca le sessioni dopo un evento che deve invalidare i token esistenti.
+     * Best effort: un errore dello store non deve annullare l'operazione gia
+     * persistita (cambio password, blocco, cancellazione).
+     */
+    private revokeSessionsAfterSecurityChange;
+    /**
+     * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.
+     * E idempotente: hash moderni e gia migrati vengono ignorati.
+     */
+    migrateLegacyEncryptedPasswords(): Promise<void>;
+    /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */
+    verifyPassword(codiceUtente: number, plainPassword: string): Promise<boolean>;
+    /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */
+    getAdminUser(): Promise<LoginResult>;
+    /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */
+    getDemoUser(): LoginResult;
+    /**
+     * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.
+     * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.
+     */
+    confirmResetPassword(token: string, newPassword: string): Promise<void>;
+}
+export {};