emilsoftware-utilities 2.0.0-dev.83 → 2.0.0-dev.85

package/dist/accessi/client/public/index.d.ts

@@ -6,12 +6,12 @@
  * service token). Per quelle usare `accessi/client/admin`.
  */
 import * as generated from '../generated/public';
-import type { AccessiClientConfig } from '../../../accessi-module/Console/accessiFetch';
+import type { AccessiClientConfig } from '../../../accessi-service/console/accessiFetch';
 import { type AccessiScopedClient } from '../createAccessiClient';
 export * from '../generated/public';
-export * from '../../../accessi-module/Console/generated/model';
-export { AccessiRequestError } from '../../../accessi-module/Console/accessiFetch';
-export type { AccessiClientConfig } from '../../../accessi-module/Console/accessiFetch';
+export * from '../../../accessi-service/console/generated/model';
+export { AccessiRequestError } from '../../../accessi-service/console/accessiFetch';
+export type { AccessiClientConfig } from '../../../accessi-service/console/accessiFetch';
 /** Client pubblico con configurazione isolata per istanza. */
 export type AccessiPublicClient = AccessiScopedClient<typeof generated>;
 /** Crea un client delle sole API pubbliche, con base URL e token propri. */

package/dist/accessi/client/public/index.js

@@ -48,8 +48,8 @@ exports.createAccessiPublicClient = createAccessiPublicClient;
 const generated = __importStar(require("../generated/public"));
 const createAccessiClient_1 = require("../createAccessiClient");
 __exportStar(require("../generated/public"), exports);
-__exportStar(require("../../../accessi-module/Console/generated/model"), exports);
-var accessiFetch_1 = require("../../../accessi-module/Console/accessiFetch");
+__exportStar(require("../../../accessi-service/console/generated/model"), exports);
+var accessiFetch_1 = require("../../../accessi-service/console/accessiFetch");
 Object.defineProperty(exports, "AccessiRequestError", { enumerable: true, get: function () { return accessiFetch_1.AccessiRequestError; } });
 /** Crea un client delle sole API pubbliche, con base URL e token propri. */
 function createAccessiPublicClient(config = {}) {

package/dist/accessi/client/public/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/accessi/client/public/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,8DAIC;AA3BD;;;;;;GAMG;AACH,+DAAiD;AAEjD,gEAGgC;AAEhC,sDAAoC;AACpC,kFAAgE;AAChE,6EAAmF;AAA1E,mHAAA,mBAAmB,OAAA;AAM5B,4EAA4E;AAC5E,SAAgB,yBAAyB,CACvC,SAA8B,EAAE;IAEhC,OAAO,IAAA,mDAA6B,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["/**\n * Client per le API pubbliche di Accessi: login, refresh, 2FA, reset password,\n * registrazione pubblica e scambio ticket console.\n *\n * Non include le operazioni amministrative (utenti, ruoli, menu, schema, filtri,\n * service token). Per quelle usare `accessi/client/admin`.\n */\nimport * as generated from '../generated/public';\nimport type { AccessiClientConfig } from '../../../accessi-module/Console/accessiFetch';\nimport {\n  createAccessiClientFromModule,\n  type AccessiScopedClient,\n} from '../createAccessiClient';\n\nexport * from '../generated/public';\nexport * from '../../../accessi-module/Console/generated/model';\nexport { AccessiRequestError } from '../../../accessi-module/Console/accessiFetch';\nexport type { AccessiClientConfig } from '../../../accessi-module/Console/accessiFetch';\n\n/** Client pubblico con configurazione isolata per istanza. */\nexport type AccessiPublicClient = AccessiScopedClient<typeof generated>;\n\n/** Crea un client delle sole API pubbliche, con base URL e token propri. */\nexport function createAccessiPublicClient(\n  config: AccessiClientConfig = {},\n): AccessiPublicClient {\n  return createAccessiClientFromModule(generated, config);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/accessi/client/public/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,8DAIC;AA3BD;;;;;;GAMG;AACH,+DAAiD;AAEjD,gEAGgC;AAEhC,sDAAoC;AACpC,mFAAiE;AACjE,8EAAoF;AAA3E,mHAAA,mBAAmB,OAAA;AAM5B,4EAA4E;AAC5E,SAAgB,yBAAyB,CACvC,SAA8B,EAAE;IAEhC,OAAO,IAAA,mDAA6B,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["/**\n * Client per le API pubbliche di Accessi: login, refresh, 2FA, reset password,\n * registrazione pubblica e scambio ticket console.\n *\n * Non include le operazioni amministrative (utenti, ruoli, menu, schema, filtri,\n * service token). Per quelle usare `accessi/client/admin`.\n */\nimport * as generated from '../generated/public';\nimport type { AccessiClientConfig } from '../../../accessi-service/console/accessiFetch';\nimport {\n  createAccessiClientFromModule,\n  type AccessiScopedClient,\n} from '../createAccessiClient';\n\nexport * from '../generated/public';\nexport * from '../../../accessi-service/console/generated/model';\nexport { AccessiRequestError } from '../../../accessi-service/console/accessiFetch';\nexport type { AccessiClientConfig } from '../../../accessi-service/console/accessiFetch';\n\n/** Client pubblico con configurazione isolata per istanza. */\nexport type AccessiPublicClient = AccessiScopedClient<typeof generated>;\n\n/** Crea un client delle sole API pubbliche, con base URL e token propri. */\nexport function createAccessiPublicClient(\n  config: AccessiClientConfig = {},\n): AccessiPublicClient {\n  return createAccessiClientFromModule(generated, config);\n}\n"]}

package/dist/accessi/client/service/index.d.ts

@@ -5,12 +5,12 @@
  * Pensato per backend fratelli e job: non va distribuito a frontend pubblici.
  */
 import * as generated from '../generated/service';
-import type { AccessiClientConfig } from '../../../accessi-module/Console/accessiFetch';
+import type { AccessiClientConfig } from '../../../accessi-service/console/accessiFetch';
 import { type AccessiScopedClient } from '../createAccessiClient';
 export * from '../generated/service';
-export * from '../../../accessi-module/Console/generated/model';
-export { AccessiRequestError } from '../../../accessi-module/Console/accessiFetch';
-export type { AccessiClientConfig } from '../../../accessi-module/Console/accessiFetch';
+export * from '../../../accessi-service/console/generated/model';
+export { AccessiRequestError } from '../../../accessi-service/console/accessiFetch';
+export type { AccessiClientConfig } from '../../../accessi-service/console/accessiFetch';
 /** Client service-to-service con configurazione isolata per istanza. */
 export type AccessiServiceClient = AccessiScopedClient<typeof generated>;
 /** Crea un client delle API service-to-service, con base URL e token propri. */

package/dist/accessi/client/service/index.js

@@ -47,8 +47,8 @@ exports.createAccessiServiceClient = createAccessiServiceClient;
 const generated = __importStar(require("../generated/service"));
 const createAccessiClient_1 = require("../createAccessiClient");
 __exportStar(require("../generated/service"), exports);
-__exportStar(require("../../../accessi-module/Console/generated/model"), exports);
-var accessiFetch_1 = require("../../../accessi-module/Console/accessiFetch");
+__exportStar(require("../../../accessi-service/console/generated/model"), exports);
+var accessiFetch_1 = require("../../../accessi-service/console/accessiFetch");
 Object.defineProperty(exports, "AccessiRequestError", { enumerable: true, get: function () { return accessiFetch_1.AccessiRequestError; } });
 /** Crea un client delle API service-to-service, con base URL e token propri. */
 function createAccessiServiceClient(config = {}) {

package/dist/accessi/client/service/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/accessi/client/service/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,gEAIC;AA1BD;;;;;GAKG;AACH,gEAAkD;AAElD,gEAGgC;AAEhC,uDAAqC;AACrC,kFAAgE;AAChE,6EAAmF;AAA1E,mHAAA,mBAAmB,OAAA;AAM5B,gFAAgF;AAChF,SAAgB,0BAA0B,CACxC,SAA8B,EAAE;IAEhC,OAAO,IAAA,mDAA6B,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["/**\n * Client per le API service-to-service di Accessi: gestione dei service token\n * (creazione, rotazione, revoca, elenco) e introspezione degli access token.\n *\n * Pensato per backend fratelli e job: non va distribuito a frontend pubblici.\n */\nimport * as generated from '../generated/service';\nimport type { AccessiClientConfig } from '../../../accessi-module/Console/accessiFetch';\nimport {\n  createAccessiClientFromModule,\n  type AccessiScopedClient,\n} from '../createAccessiClient';\n\nexport * from '../generated/service';\nexport * from '../../../accessi-module/Console/generated/model';\nexport { AccessiRequestError } from '../../../accessi-module/Console/accessiFetch';\nexport type { AccessiClientConfig } from '../../../accessi-module/Console/accessiFetch';\n\n/** Client service-to-service con configurazione isolata per istanza. */\nexport type AccessiServiceClient = AccessiScopedClient<typeof generated>;\n\n/** Crea un client delle API service-to-service, con base URL e token propri. */\nexport function createAccessiServiceClient(\n  config: AccessiClientConfig = {},\n): AccessiServiceClient {\n  return createAccessiClientFromModule(generated, config);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/accessi/client/service/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,gEAIC;AA1BD;;;;;GAKG;AACH,gEAAkD;AAElD,gEAGgC;AAEhC,uDAAqC;AACrC,mFAAiE;AACjE,8EAAoF;AAA3E,mHAAA,mBAAmB,OAAA;AAM5B,gFAAgF;AAChF,SAAgB,0BAA0B,CACxC,SAA8B,EAAE;IAEhC,OAAO,IAAA,mDAA6B,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["/**\n * Client per le API service-to-service di Accessi: gestione dei service token\n * (creazione, rotazione, revoca, elenco) e introspezione degli access token.\n *\n * Pensato per backend fratelli e job: non va distribuito a frontend pubblici.\n */\nimport * as generated from '../generated/service';\nimport type { AccessiClientConfig } from '../../../accessi-service/console/accessiFetch';\nimport {\n  createAccessiClientFromModule,\n  type AccessiScopedClient,\n} from '../createAccessiClient';\n\nexport * from '../generated/service';\nexport * from '../../../accessi-service/console/generated/model';\nexport { AccessiRequestError } from '../../../accessi-service/console/accessiFetch';\nexport type { AccessiClientConfig } from '../../../accessi-service/console/accessiFetch';\n\n/** Client service-to-service con configurazione isolata per istanza. */\nexport type AccessiServiceClient = AccessiScopedClient<typeof generated>;\n\n/** Crea un client delle API service-to-service, con base URL e token propri. */\nexport function createAccessiServiceClient(\n  config: AccessiClientConfig = {},\n): AccessiServiceClient {\n  return createAccessiClientFromModule(generated, config);\n}\n"]}

package/dist/accessi/contracts/dtos.d.ts

@@ -5,4 +5,4 @@
  * OpenAPI di Nest. Sono adatti a backend e test, non a bundle frontend leggeri:
  * per i frontend usare i tipi generati dal client OpenAPI.
  */
-export * from "../../accessi-module/Dtos";
+export * from "../../accessi-service/dtos";

package/dist/accessi/contracts/dtos.js

@@ -21,5 +21,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * OpenAPI di Nest. Sono adatti a backend e test, non a bundle frontend leggeri:
  * per i frontend usare i tipi generati dal client OpenAPI.
  */
-__exportStar(require("../../accessi-module/Dtos"), exports);
+__exportStar(require("../../accessi-service/dtos"), exports);
 //# sourceMappingURL=dtos.js.map

package/dist/accessi/contracts/dtos.js.map

@@ -1 +1 @@
-{"version":3,"file":"dtos.js","sourceRoot":"","sources":["../../../src/accessi/contracts/dtos.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,4DAA0C","sourcesContent":["/**\n * DTO server-side Accessi.\n *\n * Questi modelli usano `class-validator`, `class-transformer` e i decoratori\n * OpenAPI di Nest. Sono adatti a backend e test, non a bundle frontend leggeri:\n * per i frontend usare i tipi generati dal client OpenAPI.\n */\nexport * from \"../../accessi-module/Dtos\";\n"]}
+{"version":3,"file":"dtos.js","sourceRoot":"","sources":["../../../src/accessi/contracts/dtos.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,6DAA2C","sourcesContent":["/**\n * DTO server-side Accessi.\n *\n * Questi modelli usano `class-validator`, `class-transformer` e i decoratori\n * OpenAPI di Nest. Sono adatti a backend e test, non a bundle frontend leggeri:\n * per i frontend usare i tipi generati dal client OpenAPI.\n */\nexport * from \"../../accessi-service/dtos\";\n"]}

package/dist/accessi/contracts/index.d.ts

@@ -5,12 +5,12 @@
  * Contiene solo tipi, enum e helper puri condivisibili da backend, frontend e
  * resource server.
  */
-export { StatoRegistrazione, StatoRegistrazioneValues } from "../../accessi-module/Dtos/StatoRegistrazione";
-export { TipoAbilitazione } from "../../accessi-module/Dtos/TipoAbilitazione";
-export { accessiRequirement, buildRequirementTree, evaluateRequirement, RequirementEvaluationError, } from "../../accessi-module/middleware/accessiRequirements";
-export type { AccessiGrant, GrantsResult, AccessiPermissionRequirement, AccessiAllRequirement, AccessiAnyRequirement, AccessiNotRequirement, AccessiCustomRequirement, AccessiRequirementNode, AccessiAuthorizationOptions, AccessiCustomRequirementContext, AccessiCustomRequirementHandler, } from "../../accessi-module/middleware/accessiRequirements";
-export { extractAccessiBearerToken, resolveCodiceUtenteFromTokenPayload, buildAuthenticatedTokenPayload, isLoginAsTokenPayload, isAccessiTokenAllowedForUser, isAuthenticatedUserEnabledForJwt, } from "../../accessi-module/security/authenticatedToken";
-export type { AccessiAuthenticatedUserSnapshot, } from "../../accessi-module/security/authenticatedToken";
+export { StatoRegistrazione, StatoRegistrazioneValues } from "../../accessi-service/dtos/StatoRegistrazione";
+export { TipoAbilitazione } from "../../accessi-service/dtos/TipoAbilitazione";
+export { accessiRequirement, buildRequirementTree, evaluateRequirement, RequirementEvaluationError, } from "../../accessi-service/middleware/accessiRequirements";
+export type { AccessiGrant, GrantsResult, AccessiPermissionRequirement, AccessiAllRequirement, AccessiAnyRequirement, AccessiNotRequirement, AccessiCustomRequirement, AccessiRequirementNode, AccessiAuthorizationOptions, AccessiCustomRequirementContext, AccessiCustomRequirementHandler, } from "../../accessi-service/middleware/accessiRequirements";
+export { extractAccessiBearerToken, resolveCodiceUtenteFromTokenPayload, buildAuthenticatedTokenPayload, isLoginAsTokenPayload, isAccessiTokenAllowedForUser, isAuthenticatedUserEnabledForJwt, } from "../../accessi-service/security/authenticatedToken";
+export type { AccessiAuthenticatedUserSnapshot, } from "../../accessi-service/security/authenticatedToken";
 /** Payload di un access token Accessi verificato. Le claim extra restano disponibili. */
 export interface AccessiAccessTokenPayload extends Record<string, unknown> {
     /** Obbligatorio: distingue un access token da reset token e token 2FA. */

package/dist/accessi/contracts/index.js

@@ -8,17 +8,17 @@ exports.isAuthenticatedUserEnabledForJwt = exports.isAccessiTokenAllowedForUser
  * Contiene solo tipi, enum e helper puri condivisibili da backend, frontend e
  * resource server.
  */
-var StatoRegistrazione_1 = require("../../accessi-module/Dtos/StatoRegistrazione");
+var StatoRegistrazione_1 = require("../../accessi-service/dtos/StatoRegistrazione");
 Object.defineProperty(exports, "StatoRegistrazione", { enumerable: true, get: function () { return StatoRegistrazione_1.StatoRegistrazione; } });
 Object.defineProperty(exports, "StatoRegistrazioneValues", { enumerable: true, get: function () { return StatoRegistrazione_1.StatoRegistrazioneValues; } });
-var TipoAbilitazione_1 = require("../../accessi-module/Dtos/TipoAbilitazione");
+var TipoAbilitazione_1 = require("../../accessi-service/dtos/TipoAbilitazione");
 Object.defineProperty(exports, "TipoAbilitazione", { enumerable: true, get: function () { return TipoAbilitazione_1.TipoAbilitazione; } });
-var accessiRequirements_1 = require("../../accessi-module/middleware/accessiRequirements");
+var accessiRequirements_1 = require("../../accessi-service/middleware/accessiRequirements");
 Object.defineProperty(exports, "accessiRequirement", { enumerable: true, get: function () { return accessiRequirements_1.accessiRequirement; } });
 Object.defineProperty(exports, "buildRequirementTree", { enumerable: true, get: function () { return accessiRequirements_1.buildRequirementTree; } });
 Object.defineProperty(exports, "evaluateRequirement", { enumerable: true, get: function () { return accessiRequirements_1.evaluateRequirement; } });
 Object.defineProperty(exports, "RequirementEvaluationError", { enumerable: true, get: function () { return accessiRequirements_1.RequirementEvaluationError; } });
-var authenticatedToken_1 = require("../../accessi-module/security/authenticatedToken");
+var authenticatedToken_1 = require("../../accessi-service/security/authenticatedToken");
 Object.defineProperty(exports, "extractAccessiBearerToken", { enumerable: true, get: function () { return authenticatedToken_1.extractAccessiBearerToken; } });
 Object.defineProperty(exports, "resolveCodiceUtenteFromTokenPayload", { enumerable: true, get: function () { return authenticatedToken_1.resolveCodiceUtenteFromTokenPayload; } });
 Object.defineProperty(exports, "buildAuthenticatedTokenPayload", { enumerable: true, get: function () { return authenticatedToken_1.buildAuthenticatedTokenPayload; } });

package/dist/accessi/contracts/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/contracts/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,mFAA4G;AAAnG,wHAAA,kBAAkB,OAAA;AAAE,8HAAA,wBAAwB,OAAA;AACrD,+EAA8E;AAArE,oHAAA,gBAAgB,OAAA;AAEzB,2FAK6D;AAJ3D,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,0HAAA,mBAAmB,OAAA;AACnB,iIAAA,0BAA0B,OAAA;AAiB5B,uFAO0D;AANxD,+HAAA,yBAAyB,OAAA;AACzB,yIAAA,mCAAmC,OAAA;AACnC,oIAAA,8BAA8B,OAAA;AAC9B,2HAAA,qBAAqB,OAAA;AACrB,kIAAA,4BAA4B,OAAA;AAC5B,sIAAA,gCAAgC,OAAA","sourcesContent":["/**\n * Contratti Accessi browser-safe.\n *\n * Questo entry point non importa NestJS, il database, SMTP o servizi server.\n * Contiene solo tipi, enum e helper puri condivisibili da backend, frontend e\n * resource server.\n */\nexport { StatoRegistrazione, StatoRegistrazioneValues } from \"../../accessi-module/Dtos/StatoRegistrazione\";\nexport { TipoAbilitazione } from \"../../accessi-module/Dtos/TipoAbilitazione\";\n\nexport {\n  accessiRequirement,\n  buildRequirementTree,\n  evaluateRequirement,\n  RequirementEvaluationError,\n} from \"../../accessi-module/middleware/accessiRequirements\";\n\nexport type {\n  AccessiGrant,\n  GrantsResult,\n  AccessiPermissionRequirement,\n  AccessiAllRequirement,\n  AccessiAnyRequirement,\n  AccessiNotRequirement,\n  AccessiCustomRequirement,\n  AccessiRequirementNode,\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  AccessiCustomRequirementHandler,\n} from \"../../accessi-module/middleware/accessiRequirements\";\n\nexport {\n  extractAccessiBearerToken,\n  resolveCodiceUtenteFromTokenPayload,\n  buildAuthenticatedTokenPayload,\n  isLoginAsTokenPayload,\n  isAccessiTokenAllowedForUser,\n  isAuthenticatedUserEnabledForJwt,\n} from \"../../accessi-module/security/authenticatedToken\";\n\nexport type {\n  AccessiAuthenticatedUserSnapshot,\n} from \"../../accessi-module/security/authenticatedToken\";\n\n/** Payload di un access token Accessi verificato. Le claim extra restano disponibili. */\nexport interface AccessiAccessTokenPayload extends Record<string, unknown> {\n  /** Obbligatorio: distingue un access token da reset token e token 2FA. */\n  typ: \"access\";\n  /** Metodi di autenticazione usati (es. `password`, `otp`, `login_as`). */\n  amr?: string[];\n  codiceUtente?: number;\n  utente?: Record<string, unknown>;\n  userData?: { utente?: Record<string, unknown> };\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/contracts/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,oFAA6G;AAApG,wHAAA,kBAAkB,OAAA;AAAE,8HAAA,wBAAwB,OAAA;AACrD,gFAA+E;AAAtE,oHAAA,gBAAgB,OAAA;AAEzB,4FAK8D;AAJ5D,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,0HAAA,mBAAmB,OAAA;AACnB,iIAAA,0BAA0B,OAAA;AAiB5B,wFAO2D;AANzD,+HAAA,yBAAyB,OAAA;AACzB,yIAAA,mCAAmC,OAAA;AACnC,oIAAA,8BAA8B,OAAA;AAC9B,2HAAA,qBAAqB,OAAA;AACrB,kIAAA,4BAA4B,OAAA;AAC5B,sIAAA,gCAAgC,OAAA","sourcesContent":["/**\n * Contratti Accessi browser-safe.\n *\n * Questo entry point non importa NestJS, il database, SMTP o servizi server.\n * Contiene solo tipi, enum e helper puri condivisibili da backend, frontend e\n * resource server.\n */\nexport { StatoRegistrazione, StatoRegistrazioneValues } from \"../../accessi-service/dtos/StatoRegistrazione\";\nexport { TipoAbilitazione } from \"../../accessi-service/dtos/TipoAbilitazione\";\n\nexport {\n  accessiRequirement,\n  buildRequirementTree,\n  evaluateRequirement,\n  RequirementEvaluationError,\n} from \"../../accessi-service/middleware/accessiRequirements\";\n\nexport type {\n  AccessiGrant,\n  GrantsResult,\n  AccessiPermissionRequirement,\n  AccessiAllRequirement,\n  AccessiAnyRequirement,\n  AccessiNotRequirement,\n  AccessiCustomRequirement,\n  AccessiRequirementNode,\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  AccessiCustomRequirementHandler,\n} from \"../../accessi-service/middleware/accessiRequirements\";\n\nexport {\n  extractAccessiBearerToken,\n  resolveCodiceUtenteFromTokenPayload,\n  buildAuthenticatedTokenPayload,\n  isLoginAsTokenPayload,\n  isAccessiTokenAllowedForUser,\n  isAuthenticatedUserEnabledForJwt,\n} from \"../../accessi-service/security/authenticatedToken\";\n\nexport type {\n  AccessiAuthenticatedUserSnapshot,\n} from \"../../accessi-service/security/authenticatedToken\";\n\n/** Payload di un access token Accessi verificato. Le claim extra restano disponibili. */\nexport interface AccessiAccessTokenPayload extends Record<string, unknown> {\n  /** Obbligatorio: distingue un access token da reset token e token 2FA. */\n  typ: \"access\";\n  /** Metodi di autenticazione usati (es. `password`, `otp`, `login_as`). */\n  amr?: string[];\n  codiceUtente?: number;\n  utente?: Record<string, unknown>;\n  userData?: { utente?: Record<string, unknown> };\n}\n"]}

package/dist/accessi/resource-server/core.d.ts

@@ -4,3 +4,16 @@ export * from "./errors";
 export * from "./token";
 export * from "./introspection";
 export * from "./runtime";
+/**
+ * Store di revoca condivisibili con Accessi Service.
+ *
+ * Un backend fratello che riceve le stesse istanze (o le ricrea sullo stesso
+ * Redis) applica revoche per utente, per `jti` e per famiglia di refresh token
+ * senza importare l'intero entry point `accessi/server`.
+ */
+export { createMemorySessionRevocationStore, createRedisSessionRevocationStore, } from "../../accessi-service/security/sessionRevocation";
+export type { MemorySessionRevocationStore, RedisSessionRevocationStoreOptions, SessionRevocationStore, } from "../../accessi-service/security/sessionRevocation";
+export { createMemoryAccessTokenRevocationStore, createRedisAccessTokenRevocationStore, } from "../../accessi-service/security/accessTokenRevocation";
+export type { AccessTokenRevocationStore, MemoryAccessTokenRevocationStore, RedisAccessTokenRevocationStoreOptions, } from "../../accessi-service/security/accessTokenRevocation";
+export { createMemoryRefreshTokenRotationStore, createRedisRefreshTokenRotationStore, } from "../../accessi-service/security/refreshTokenRotation";
+export type { MemoryRefreshTokenRotationStore, RefreshTokenRotationStore, RedisRefreshTokenRotationStoreOptions, } from "../../accessi-service/security/refreshTokenRotation";

package/dist/accessi/resource-server/core.js

@@ -14,10 +14,27 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRedisRefreshTokenRotationStore = exports.createMemoryRefreshTokenRotationStore = exports.createRedisAccessTokenRevocationStore = exports.createMemoryAccessTokenRevocationStore = exports.createRedisSessionRevocationStore = exports.createMemorySessionRevocationStore = void 0;
 __exportStar(require("./types"), exports);
 __exportStar(require("./keys"), exports);
 __exportStar(require("./errors"), exports);
 __exportStar(require("./token"), exports);
 __exportStar(require("./introspection"), exports);
 __exportStar(require("./runtime"), exports);
+/**
+ * Store di revoca condivisibili con Accessi Service.
+ *
+ * Un backend fratello che riceve le stesse istanze (o le ricrea sullo stesso
+ * Redis) applica revoche per utente, per `jti` e per famiglia di refresh token
+ * senza importare l'intero entry point `accessi/server`.
+ */
+var sessionRevocation_1 = require("../../accessi-service/security/sessionRevocation");
+Object.defineProperty(exports, "createMemorySessionRevocationStore", { enumerable: true, get: function () { return sessionRevocation_1.createMemorySessionRevocationStore; } });
+Object.defineProperty(exports, "createRedisSessionRevocationStore", { enumerable: true, get: function () { return sessionRevocation_1.createRedisSessionRevocationStore; } });
+var accessTokenRevocation_1 = require("../../accessi-service/security/accessTokenRevocation");
+Object.defineProperty(exports, "createMemoryAccessTokenRevocationStore", { enumerable: true, get: function () { return accessTokenRevocation_1.createMemoryAccessTokenRevocationStore; } });
+Object.defineProperty(exports, "createRedisAccessTokenRevocationStore", { enumerable: true, get: function () { return accessTokenRevocation_1.createRedisAccessTokenRevocationStore; } });
+var refreshTokenRotation_1 = require("../../accessi-service/security/refreshTokenRotation");
+Object.defineProperty(exports, "createMemoryRefreshTokenRotationStore", { enumerable: true, get: function () { return refreshTokenRotation_1.createMemoryRefreshTokenRotationStore; } });
+Object.defineProperty(exports, "createRedisRefreshTokenRotationStore", { enumerable: true, get: function () { return refreshTokenRotation_1.createRedisRefreshTokenRotationStore; } });
 //# sourceMappingURL=core.js.map

package/dist/accessi/resource-server/core.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/core.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,yCAAuB;AACvB,2CAAyB;AACzB,0CAAwB;AACxB,kDAAgC;AAChC,4CAA0B","sourcesContent":["export * from \"./types\";\nexport * from \"./keys\";\nexport * from \"./errors\";\nexport * from \"./token\";\nexport * from \"./introspection\";\nexport * from \"./runtime\";\n"]}
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/core.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,yCAAuB;AACvB,2CAAyB;AACzB,0CAAwB;AACxB,kDAAgC;AAChC,4CAA0B;AAE1B;;;;;;GAMG;AACH,sFAG0D;AAFxD,uIAAA,kCAAkC,OAAA;AAClC,sIAAA,iCAAiC,OAAA;AAOnC,8FAG8D;AAF5D,+IAAA,sCAAsC,OAAA;AACtC,8IAAA,qCAAqC,OAAA;AAOvC,4FAG6D;AAF3D,6IAAA,qCAAqC,OAAA;AACrC,4IAAA,oCAAoC,OAAA","sourcesContent":["export * from \"./types\";\nexport * from \"./keys\";\nexport * from \"./errors\";\nexport * from \"./token\";\nexport * from \"./introspection\";\nexport * from \"./runtime\";\n\n/**\n * Store di revoca condivisibili con Accessi Service.\n *\n * Un backend fratello che riceve le stesse istanze (o le ricrea sullo stesso\n * Redis) applica revoche per utente, per `jti` e per famiglia di refresh token\n * senza importare l'intero entry point `accessi/server`.\n */\nexport {\n  createMemorySessionRevocationStore,\n  createRedisSessionRevocationStore,\n} from \"../../accessi-service/security/sessionRevocation\";\nexport type {\n  MemorySessionRevocationStore,\n  RedisSessionRevocationStoreOptions,\n  SessionRevocationStore,\n} from \"../../accessi-service/security/sessionRevocation\";\nexport {\n  createMemoryAccessTokenRevocationStore,\n  createRedisAccessTokenRevocationStore,\n} from \"../../accessi-service/security/accessTokenRevocation\";\nexport type {\n  AccessTokenRevocationStore,\n  MemoryAccessTokenRevocationStore,\n  RedisAccessTokenRevocationStoreOptions,\n} from \"../../accessi-service/security/accessTokenRevocation\";\nexport {\n  createMemoryRefreshTokenRotationStore,\n  createRedisRefreshTokenRotationStore,\n} from \"../../accessi-service/security/refreshTokenRotation\";\nexport type {\n  MemoryRefreshTokenRotationStore,\n  RefreshTokenRotationStore,\n  RedisRefreshTokenRotationStoreOptions,\n} from \"../../accessi-service/security/refreshTokenRotation\";\n"]}

package/dist/accessi/resource-server/express.js

@@ -13,7 +13,7 @@ exports.toAccessiResourceServerError = toAccessiResourceServerError;
 exports.sendAccessiResourceServerError = sendAccessiResourceServerError;
 exports.createAccessiAuthMiddleware = createAccessiAuthMiddleware;
 exports.createAccessiAuthMiddlewareFromRuntime = createAccessiAuthMiddlewareFromRuntime;
-const audit_1 = require("../../accessi-module/security/audit");
+const audit_1 = require("../../accessi-service/security/audit");
 const errors_1 = require("./errors");
 const runtime_1 = require("./runtime");
 /** Normalizza un errore sconosciuto nel contratto di errore Accessi. */

package/dist/accessi/resource-server/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/express.ts"],"names":[],"mappings":";;;;;;;;;;;AAQA,oEAGC;AAGD,wEAUC;AAQD,kEAuBC;AAGD,wFAqBC;AA9ED,+DAAmE;AACnE,qCAAwE;AACxE,uCAAoF;AAIpF,wEAAwE;AACxE,SAAgB,4BAA4B,CAAC,KAAc;IACzD,IAAI,KAAK,YAAY,mCAA0B;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;AAClG,CAAC;AAED,wFAAwF;AACxF,SAAgB,8BAA8B,CAAC,GAAa,EAAE,KAAc;IAC1E,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACxC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,IAAI;QACtB,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAErD,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;oBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YACD,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sCAAsC,CACpD,OAAqC;IAErC,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;oBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YACD,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from \"express\";\nimport { auditAccessi } from \"../../accessi-module/security/audit\";\nimport { AccessiResourceServerError, accessiAuthError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerRuntime } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\n/** Normalizza un errore sconosciuto nel contratto di errore Accessi. */\nexport function toAccessiResourceServerError(error: unknown): AccessiResourceServerError {\n  if (error instanceof AccessiResourceServerError) return error;\n  return accessiAuthError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n}\n\n/** Invia la risposta di errore Accessi senza esporre stack trace o dettagli interni. */\nexport function sendAccessiResourceServerError(res: Response, error: unknown): Response {\n  const normalized = toAccessiResourceServerError(error);\n  return res.status(normalized.status).json({\n    severity: \"error\",\n    status: normalized.status,\n    statusCode: 2,\n    code: normalized.code,\n    error: normalized.code,\n    message: normalized.message,\n  });\n}\n\n/**\n * Middleware Express per backend che non possiedono il database Accessi.\n *\n * Popola `req.user`, `req.data` e `req.accessi`; con una policy di autorizzazione\n * popola anche `req.userGrants`.\n */\nexport function createAccessiAuthMiddleware(\n  options: AccessiResourceServerOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  const runtime = createAccessiResourceServer(options);\n\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      const normalized = toAccessiResourceServerError(error);\n      if (runtime.options.audit !== false) {\n        auditAccessi(\"auth_failure\", {\n          code: normalized.code,\n          status: normalized.status,\n          method: req.method,\n          path: req.path,\n          ip: req.ip,\n        });\n      }\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n\n/** Variante con runtime gia creato, utile per test o bootstrap manuale. */\nexport function createAccessiAuthMiddlewareFromRuntime(\n  runtime: AccessiResourceServerRuntime,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      const normalized = toAccessiResourceServerError(error);\n      if (runtime.options.audit !== false) {\n        auditAccessi(\"auth_failure\", {\n          code: normalized.code,\n          status: normalized.status,\n          method: req.method,\n          path: req.path,\n          ip: req.ip,\n        });\n      }\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n"]}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/express.ts"],"names":[],"mappings":";;;;;;;;;;;AAQA,oEAGC;AAGD,wEAUC;AAQD,kEAuBC;AAGD,wFAqBC;AA9ED,gEAAoE;AACpE,qCAAwE;AACxE,uCAAoF;AAIpF,wEAAwE;AACxE,SAAgB,4BAA4B,CAAC,KAAc;IACzD,IAAI,KAAK,YAAY,mCAA0B;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;AAClG,CAAC;AAED,wFAAwF;AACxF,SAAgB,8BAA8B,CAAC,GAAa,EAAE,KAAc;IAC1E,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACxC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,IAAI;QACtB,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAErD,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;oBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YACD,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sCAAsC,CACpD,OAAqC;IAErC,OAAO,CAAO,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAA,oCAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;oBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YACD,8BAA8B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from \"express\";\nimport { auditAccessi } from \"../../accessi-service/security/audit\";\nimport { AccessiResourceServerError, accessiAuthError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerRuntime } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\n/** Normalizza un errore sconosciuto nel contratto di errore Accessi. */\nexport function toAccessiResourceServerError(error: unknown): AccessiResourceServerError {\n  if (error instanceof AccessiResourceServerError) return error;\n  return accessiAuthError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n}\n\n/** Invia la risposta di errore Accessi senza esporre stack trace o dettagli interni. */\nexport function sendAccessiResourceServerError(res: Response, error: unknown): Response {\n  const normalized = toAccessiResourceServerError(error);\n  return res.status(normalized.status).json({\n    severity: \"error\",\n    status: normalized.status,\n    statusCode: 2,\n    code: normalized.code,\n    error: normalized.code,\n    message: normalized.message,\n  });\n}\n\n/**\n * Middleware Express per backend che non possiedono il database Accessi.\n *\n * Popola `req.user`, `req.data` e `req.accessi`; con una policy di autorizzazione\n * popola anche `req.userGrants`.\n */\nexport function createAccessiAuthMiddleware(\n  options: AccessiResourceServerOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  const runtime = createAccessiResourceServer(options);\n\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      const normalized = toAccessiResourceServerError(error);\n      if (runtime.options.audit !== false) {\n        auditAccessi(\"auth_failure\", {\n          code: normalized.code,\n          status: normalized.status,\n          method: req.method,\n          path: req.path,\n          ip: req.ip,\n        });\n      }\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n\n/** Variante con runtime gia creato, utile per test o bootstrap manuale. */\nexport function createAccessiAuthMiddlewareFromRuntime(\n  runtime: AccessiResourceServerRuntime,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      await authenticateAccessiRequest(req, runtime);\n      next();\n    } catch (error) {\n      const normalized = toAccessiResourceServerError(error);\n      if (runtime.options.audit !== false) {\n        auditAccessi(\"auth_failure\", {\n          code: normalized.code,\n          status: normalized.status,\n          method: req.method,\n          path: req.path,\n          ip: req.ip,\n        });\n      }\n      sendAccessiResourceServerError(res, error);\n    }\n  };\n}\n"]}

package/dist/accessi/resource-server/nest.js

@@ -17,7 +17,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAccessiAuthGuard = createAccessiAuthGuard;
 const common_1 = require("@nestjs/common");
-const audit_1 = require("../../accessi-module/security/audit");
+const audit_1 = require("../../accessi-service/security/audit");
 const errors_1 = require("./errors");
 const runtime_1 = require("./runtime");
 function toNestException(error) {

package/dist/accessi/resource-server/nest.js.map

@@ -1 +1 @@
-{"version":3,"file":"nest.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/nest.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAkCA,wDA+BC;AAjED,2CASwB;AAExB,+DAAmE;AACnE,qCAAsD;AACtD,uCAAoF;AAGpF,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,UAAU,GAAG,KAAK,YAAY,mCAA0B;QAC5D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,mCAA0B,CAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;IAEvE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,8BAAqB,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,oCAA2B,CAAC,OAAO,CAAC,CAAC;IAC/E,OAAO,IAAI,qCAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAGrD,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;QACxB,WAAW,CAAC,OAAyB;;gBACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,IAAA,oCAA0B,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,UAAU,GAAG,KAAK,YAAY,mCAA0B;wBAC5D,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,IAAI,mCAA0B,CAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;oBAC3G,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;wBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;4BAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;4BACrB,MAAM,EAAE,UAAU,CAAC,MAAM;4BACzB,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,EAAE,EAAE,OAAO,CAAC,EAAE;yBACf,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;SAAA;KACF,CAAA;IAtBK,0BAA0B;QAD/B,IAAA,mBAAU,GAAE;OACP,0BAA0B,CAsB/B;IAED,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Injectable,\n  InternalServerErrorException,\n  ServiceUnavailableException,\n  Type,\n  UnauthorizedException,\n} from \"@nestjs/common\";\nimport type { Request } from \"express\";\nimport { auditAccessi } from \"../../accessi-module/security/audit\";\nimport { AccessiResourceServerError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\nfunction toNestException(error: unknown): Error {\n  const normalized = error instanceof AccessiResourceServerError\n    ? error\n    : new AccessiResourceServerError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n  const payload = { code: normalized.code, message: normalized.message };\n\n  if (normalized.status === 401) return new UnauthorizedException(payload);\n  if (normalized.status === 403) return new ForbiddenException(payload);\n  if (normalized.status === 503) return new ServiceUnavailableException(payload);\n  return new InternalServerErrorException(payload);\n}\n\n/**\n * Crea un guard Nest configurato con le opzioni del resource server.\n *\n * Uso:\n * `@UseGuards(createAccessiAuthGuard(options))`\n */\nexport function createAccessiAuthGuard(\n  options: AccessiResourceServerOptions,\n): Type<CanActivate> {\n  const runtime = createAccessiResourceServer(options);\n\n  @Injectable()\n  class ConfiguredAccessiAuthGuard implements CanActivate {\n    async canActivate(context: ExecutionContext): Promise<boolean> {\n      const request = context.switchToHttp().getRequest<Request>();\n      try {\n        await authenticateAccessiRequest(request, runtime);\n        return true;\n      } catch (error) {\n        const normalized = error instanceof AccessiResourceServerError\n          ? error\n          : new AccessiResourceServerError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n        if (runtime.options.audit !== false) {\n          auditAccessi(\"auth_failure\", {\n            code: normalized.code,\n            status: normalized.status,\n            method: request.method,\n            path: request.path,\n            ip: request.ip,\n          });\n        }\n        throw toNestException(error);\n      }\n    }\n  }\n\n  return ConfiguredAccessiAuthGuard;\n}\n"]}
+{"version":3,"file":"nest.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/nest.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAkCA,wDA+BC;AAjED,2CASwB;AAExB,gEAAoE;AACpE,qCAAsD;AACtD,uCAAoF;AAGpF,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,UAAU,GAAG,KAAK,YAAY,mCAA0B;QAC5D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,mCAA0B,CAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;IAEvE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,8BAAqB,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,oCAA2B,CAAC,OAAO,CAAC,CAAC;IAC/E,OAAO,IAAI,qCAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,OAAqC;IAErC,MAAM,OAAO,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;IAGrD,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;QACxB,WAAW,CAAC,OAAyB;;gBACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,IAAA,oCAA0B,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,UAAU,GAAG,KAAK,YAAY,mCAA0B;wBAC5D,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,IAAI,mCAA0B,CAAC,GAAG,EAAE,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;oBAC3G,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;wBACpC,IAAA,oBAAY,EAAC,cAAc,EAAE;4BAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;4BACrB,MAAM,EAAE,UAAU,CAAC,MAAM;4BACzB,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,EAAE,EAAE,OAAO,CAAC,EAAE;yBACf,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;SAAA;KACF,CAAA;IAtBK,0BAA0B;QAD/B,IAAA,mBAAU,GAAE;OACP,0BAA0B,CAsB/B;IAED,OAAO,0BAA0B,CAAC;AACpC,CAAC","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Injectable,\n  InternalServerErrorException,\n  ServiceUnavailableException,\n  Type,\n  UnauthorizedException,\n} from \"@nestjs/common\";\nimport type { Request } from \"express\";\nimport { auditAccessi } from \"../../accessi-service/security/audit\";\nimport { AccessiResourceServerError } from \"./errors\";\nimport { authenticateAccessiRequest, createAccessiResourceServer } from \"./runtime\";\nimport type { AccessiResourceServerOptions } from \"./types\";\n\nfunction toNestException(error: unknown): Error {\n  const normalized = error instanceof AccessiResourceServerError\n    ? error\n    : new AccessiResourceServerError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n  const payload = { code: normalized.code, message: normalized.message };\n\n  if (normalized.status === 401) return new UnauthorizedException(payload);\n  if (normalized.status === 403) return new ForbiddenException(payload);\n  if (normalized.status === 503) return new ServiceUnavailableException(payload);\n  return new InternalServerErrorException(payload);\n}\n\n/**\n * Crea un guard Nest configurato con le opzioni del resource server.\n *\n * Uso:\n * `@UseGuards(createAccessiAuthGuard(options))`\n */\nexport function createAccessiAuthGuard(\n  options: AccessiResourceServerOptions,\n): Type<CanActivate> {\n  const runtime = createAccessiResourceServer(options);\n\n  @Injectable()\n  class ConfiguredAccessiAuthGuard implements CanActivate {\n    async canActivate(context: ExecutionContext): Promise<boolean> {\n      const request = context.switchToHttp().getRequest<Request>();\n      try {\n        await authenticateAccessiRequest(request, runtime);\n        return true;\n      } catch (error) {\n        const normalized = error instanceof AccessiResourceServerError\n          ? error\n          : new AccessiResourceServerError(500, \"AUTH_INTERNAL_ERROR\", \"Errore interno durante l'autenticazione.\");\n        if (runtime.options.audit !== false) {\n          auditAccessi(\"auth_failure\", {\n            code: normalized.code,\n            status: normalized.status,\n            method: request.method,\n            path: request.path,\n            ip: request.ip,\n          });\n        }\n        throw toNestException(error);\n      }\n    }\n  }\n\n  return ConfiguredAccessiAuthGuard;\n}\n"]}

package/dist/accessi/resource-server/token.js

@@ -49,7 +49,7 @@ const jwt = __importStar(require("jsonwebtoken"));
 const contracts_1 = require("../contracts");
 const errors_1 = require("./errors");
 const keys_1 = require("./keys");
-const metrics_1 = require("../../accessi-module/observability/metrics");
+const metrics_1 = require("../../accessi-service/observability/metrics");
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }

package/dist/accessi/resource-server/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/token.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiJA,gEAuIC;AAGD,4DAKC;AAhSD,mCAAqD;AAErD,kDAAoC;AAEpC,4CAA8F;AAC9F,qCAA4C;AAC5C,iCAAmD;AACnD,wEAAiF;AAuBjF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,OAAgC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,QAAQ,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwC;IACjE,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IAEnF,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY;QAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;AAC5D,CAAC;AAED,SAAe,SAAS,CACtB,OAA6D;;;QAE7D,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,UAAU,CAAC,KAAK,CAAC;QACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,6CAA6C,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAA,OAAO,CAAC,SAAS,mCAAI,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC5C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,uBAAuB,EACvB,8BAA8B,QAAQ,CAAC,MAAM,IAAI,CAClD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC/E,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,uBAAuB,EAAE,yBAAyB,CAAC,CAAC;QAClF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CAAA;AAED,SAAS,SAAS,CAChB,IAAoC,EACpC,GAAuB,EACvB,SAAiB;IAEjB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,MAAM,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAS,oBAAoB,CAAC,SAA0B;IACtD,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,GAA4B;IAC5C,OAAO,IAAA,wBAAe,EAAC,EAAE,GAAG,EAAE,GAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACzE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACvC,QAAQ,EAAE,CAAC;AAChB,CAAC;AAED,iEAAiE;AACjE,SAAS,kBAAkB,CACzB,OAAwC,EACxC,KAA+B;;IAE/B,IAAA,6BAAmB,EAAC,kCAAkC,EAAE,CAAC,kBACvD,OAAO,EAAE,QAAQ,EACjB,MAAM,EAAE,KAAK,CAAC,MAAM,IACjB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1D,CAAC;IACH,IAAI,CAAC;QACH,MAAA,OAAO,CAAC,cAAc,wDAAG,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,WAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,OAAwC;;IACjF,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,qBAAqB,mCAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,MAAM,mCAC5B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAA,gCAAyB,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1F,IAAI,SAAqC,CAAC;IAC1C,MAAM,sBAAsB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,oBAAoB,mCAAI,IAAK,CAAC,CAAC;IAExF,MAAM,WAAW,GAAG,YAAsE,EAAE,iDAAjE,YAAY,GAAG,KAAK;;QAC7C,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC;QACnF,oFAAoF;QACpF,IAAI,YAAY,IAAI,SAAS,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,GAAG,sBAAsB,EAAE,CAAC;YACpF,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,SAAS,GAAG;YACV,IAAI;YACJ,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,IAAI,CAAC,UAAU,mCAAI,MAAO,CAAC;YACpE,SAAS,EAAE,GAAG;SACf,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAA,CAAC;IAEF,MAAM,MAAM,GAAG,CAAO,KAAa,EAAqC,EAAE;;QACxE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAgC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE;YAC7E,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;YACpB,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,GAAe,CAAC;QACpB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,eAAe,CAAC,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC;aAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7B,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;YACxB,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,aAAa,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC/E,WAAW,GAAG,GAAG,KAAK,aAAa,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;YAC/B,IAAI,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;gBACrB,qEAAqE;gBACrE,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC/B,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,GAAG,EAAE,CAAC;oBACR,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;oBAChE,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,oBAAoB,EACpB,oCAAoC,GAAG,IAAI,CAC5C,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;YAC7F,CAAC;YACD,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,8CAC9B,UAAU,EAAE,CAAC,SAA0B,CAAC,IACrC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClD,CAAC,OAAO,CAAC,QAAQ;gBAClB,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAyC,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC,KACP,cAAc,IACd,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;gBACvB,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,6BAA6B,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,yCAAyC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,+CAAmC,EAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO;YACL,KAAK;YACL,OAAO,EAAE,QAAqC;YAC9C,YAAY;YACZ,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC;SAC5B,CAAC;IACJ,CAAC,CAAA,CAAC;IAEF,OAAO;QACL,MAAM;QACA,yBAAyB,CAAC,MAAe;;gBAC7C,MAAM,KAAK,GAAG,IAAA,qCAAyB,EAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,qCAAqC,CAAC,CAAC;gBAC3F,CAAC;gBACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAsB,wBAAwB,CAC5C,MAAe,EACf,OAAwC;;QAExC,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC/E,CAAC;CAAA","sourcesContent":["import { createHash, createPublicKey } from \"crypto\";\nimport type { JsonWebKey } from \"crypto\";\nimport * as jwt from \"jsonwebtoken\";\nimport type { AccessiAccessTokenPayload } from \"../contracts\";\nimport { extractAccessiBearerToken, resolveCodiceUtenteFromTokenPayload } from \"../contracts\";\nimport { accessiAuthError } from \"./errors\";\nimport { deriveAccessiAccessSecret } from \"./keys\";\nimport { recordAccessiMetric } from \"../../accessi-module/observability/metrics\";\nimport type { AccessiJwtAlgorithm, AccessiResourceServerJwtOptions, AccessiUnknownKeyIdEvent } from \"./types\";\n\n/** Esito della verifica locale di un access token. */\nexport interface AccessiTokenVerification {\n  token: string;\n  payload: AccessiAccessTokenPayload;\n  codiceUtente: number;\n  user: Record<string, unknown>;\n}\n\n/** Verificatore riutilizzabile: conserva la cache JWKS tra una richiesta e l'altra. */\nexport interface AccessiTokenVerifier {\n  verify(token: string): Promise<AccessiTokenVerification>;\n  verifyAuthorizationHeader(header: unknown): Promise<AccessiTokenVerification>;\n}\n\ninterface JwksCacheEntry {\n  keys: Array<Record<string, unknown>>;\n  expiresAt: number;\n  fetchedAt: number;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction extractUser(payload: Record<string, unknown>): Record<string, unknown> {\n  const userData = isRecord(payload.userData) ? payload.userData : undefined;\n  const utente = isRecord(payload.utente)\n    ? payload.utente\n    : isRecord(userData?.utente)\n      ? userData.utente\n      : undefined;\n  return utente ?? {};\n}\n\nfunction defaultAlgorithms(options: AccessiResourceServerJwtOptions): AccessiJwtAlgorithm[] {\n  if (options.algorithms && options.algorithms.length > 0) return options.algorithms;\n\n  const algorithms: AccessiJwtAlgorithm[] = [];\n  if (options.secret || options.serverSecret) algorithms.push(\"HS256\");\n  if (options.publicKey || options.jwks) {\n    algorithms.push(\"RS256\", \"RS384\", \"RS512\", \"ES256\", \"ES384\", \"ES512\");\n  }\n  return algorithms;\n}\n\nfunction algorithmFamily(algorithm: string): \"hmac\" | \"asymmetric\" {\n  return algorithm.startsWith(\"HS\") ? \"hmac\" : \"asymmetric\";\n}\n\nasync function fetchJwks(\n  options: NonNullable<AccessiResourceServerJwtOptions[\"jwks\"]>,\n): Promise<Array<Record<string, unknown>>> {\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"fetch non disponibile per caricare la JWKS.\");\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 3000);\n  try {\n    const response = await fetchImpl(options.url, {\n      method: \"GET\",\n      headers: { Accept: \"application/json\" },\n      signal: controller.signal,\n    });\n    if (!response.ok) {\n      throw accessiAuthError(\n        503,\n        \"AUTH_JWKS_UNAVAILABLE\",\n        `JWKS non disponibile (HTTP ${response.status}).`,\n      );\n    }\n    const payload: unknown = await response.json();\n    if (!isRecord(payload) || !Array.isArray(payload.keys)) {\n      throw accessiAuthError(503, \"AUTH_JWKS_UNAVAILABLE\", \"Risposta JWKS non valida.\");\n    }\n    return payload.keys.filter(isRecord);\n  } catch (error) {\n    if (error && typeof error === \"object\" && \"code\" in error && \"status\" in error) {\n      throw error;\n    }\n    throw accessiAuthError(503, \"AUTH_JWKS_UNAVAILABLE\", \"JWKS non raggiungibile.\");\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nfunction selectJwk(\n  keys: Array<Record<string, unknown>>,\n  kid: string | undefined,\n  algorithm: string,\n): Record<string, unknown> | undefined {\n  return keys.find((key) => {\n    const keyAlg = typeof key.alg === \"string\" ? key.alg : undefined;\n    if (keyAlg && keyAlg !== algorithm) return false;\n    if (!kid) return true;\n    return typeof key.kid === \"string\" && key.kid === kid;\n  });\n}\n\n/** Fingerprint della chiave pubblica, identico a quello usato dalla JWKS Accessi. */\nfunction fingerprintPublicKey(publicKey: string | Buffer): string {\n  const der = createPublicKey(publicKey).export({ type: \"spki\", format: \"der\" });\n  return createHash(\"sha256\").update(der).digest(\"base64url\").slice(0, 16);\n}\n\nfunction jwkToPem(jwk: Record<string, unknown>): string {\n  return createPublicKey({ key: jwk as unknown as JsonWebKey, format: \"jwk\" })\n    .export({ type: \"spki\", format: \"pem\" })\n    .toString();\n}\n\n/** L'alert non deve mai cambiare l'esito dell'autenticazione. */\nfunction notifyUnknownKeyId(\n  options: AccessiResourceServerJwtOptions,\n  event: AccessiUnknownKeyIdEvent,\n): void {\n  recordAccessiMetric('accessi_jwt_unknown_key_id_total', 1, {\n    purpose: 'access',\n    source: event.source,\n    ...(event.algorithm ? { algorithm: event.algorithm } : {}),\n  });\n  try {\n    options.onUnknownKeyId?.(event);\n  } catch {\n    // Un logger o webhook guasto non trasforma un 401 in un 500.\n  }\n}\n\n/**\n * Crea un verificatore locale riutilizzabile.\n *\n * Supporta HMAC, chiavi pubbliche PEM (RS ed ES) e JWKS remoto. La cache\n * JWKS e legata all'istanza del verificatore.\n */\nexport function createAccessiTokenVerifier(options: AccessiResourceServerJwtOptions): AccessiTokenVerifier {\n  const algorithms = defaultAlgorithms(options);\n  if (algorithms.length === 0) {\n    throw accessiAuthError(\n      500,\n      \"AUTH_CONFIG_INVALID\",\n      \"Configurare almeno una tra jwt.secret, jwt.serverSecret, jwt.publicKey e jwt.jwks.\",\n    );\n  }\n\n  const clockTolerance = options.clockToleranceSeconds ?? 5;\n  const hmacSecret = options.secret\n    ?? (options.serverSecret ? deriveAccessiAccessSecret(options.serverSecret) : undefined);\n  let jwksCache: JwksCacheEntry | undefined;\n  const jwksMinRefreshInterval = Math.max(0, options.jwks?.minRefreshIntervalMs ?? 5_000);\n\n  const getJwksKeys = async (forceRefresh = false): Promise<Array<Record<string, unknown>>> => {\n    if (!options.jwks) return [];\n    const now = Date.now();\n    if (!forceRefresh && jwksCache && jwksCache.expiresAt > now) return jwksCache.keys;\n    // Refresh forzato ma troppo ravvicinato: riusa la cache per non martellare la JWKS.\n    if (forceRefresh && jwksCache && now - jwksCache.fetchedAt < jwksMinRefreshInterval) {\n      return jwksCache.keys;\n    }\n    const keys = await fetchJwks(options.jwks);\n    jwksCache = {\n      keys,\n      expiresAt: now + Math.max(1_000, options.jwks.cacheTtlMs ?? 300_000),\n      fetchedAt: now,\n    };\n    return keys;\n  };\n\n  const verify = async (token: string): Promise<AccessiTokenVerification> => {\n    const decoded = jwt.decode(token, { complete: true });\n    if (!decoded || typeof decoded === \"string\" || !isRecord(decoded.header)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token JWT non valido.\");\n    }\n\n    const algorithm = typeof decoded.header.alg === \"string\" ? decoded.header.alg : undefined;\n    if (!algorithm || !algorithms.includes(algorithm as AccessiJwtAlgorithm)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Algoritmo JWT non consentito.\");\n    }\n\n    const kid = typeof decoded.header.kid === \"string\" && decoded.header.kid !== \"\"\n      ? decoded.header.kid\n      : undefined;\n    let key: jwt.Secret;\n    let kidMismatch = false;\n    if (algorithmFamily(algorithm) === \"hmac\") {\n      if (!hmacSecret) {\n        throw accessiAuthError(\n          500,\n          \"AUTH_CONFIG_INVALID\",\n          \"jwt.secret o jwt.serverSecret non configurato per token HS*.\",\n        );\n      }\n      key = hmacSecret;\n    } else if (options.publicKey) {\n      key = options.publicKey;\n      if (kid) {\n        const expectedKeyId = options.keyId ?? fingerprintPublicKey(options.publicKey);\n        kidMismatch = kid !== expectedKeyId;\n      }\n    } else if (options.jwks) {\n      let keys = await getJwksKeys();\n      let selected = selectJwk(keys, kid, algorithm);\n      if (!selected && kid) {\n        // La JWKS in cache potrebbe precedere una rotazione appena avvenuta.\n        keys = await getJwksKeys(true);\n        selected = selectJwk(keys, kid, algorithm);\n      }\n      if (!selected) {\n        if (kid) {\n          notifyUnknownKeyId(options, { kid, algorithm, source: \"jwks\" });\n          throw accessiAuthError(\n            401,\n            \"AUTH_TOKEN_INVALID\",\n            `Chiave JWKS non trovata per kid \"${kid}\".`,\n          );\n        }\n        throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Chiave JWKS non trovata per il token.\");\n      }\n      key = jwkToPem(selected);\n    } else {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"jwt.publicKey/jwt.jwks non configurati.\");\n    }\n\n    let verified: unknown;\n    try {\n      verified = jwt.verify(token, key, {\n        algorithms: [algorithm as jwt.Algorithm],\n        ...(options.issuer ? { issuer: options.issuer } : {}),\n        ...(options.audience\n          ? { audience: options.audience as jwt.VerifyOptions[\"audience\"] }\n          : {}),\n        clockTolerance,\n      });\n    } catch {\n      if (kidMismatch && kid) {\n        notifyUnknownKeyId(options, { kid, algorithm, source: \"publicKey\" });\n      }\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido o scaduto.\");\n    }\n\n    if (!isRecord(verified)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Payload JWT non valido.\");\n    }\n    if (verified.typ !== \"access\") {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Il token non e un access token Accessi.\");\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(verified);\n    if (!codiceUtente) {\n      throw accessiAuthError(401, \"AUTH_USER_CODE_MISSING\", \"Token privo di un utente valido.\");\n    }\n\n    return {\n      token,\n      payload: verified as AccessiAccessTokenPayload,\n      codiceUtente,\n      user: extractUser(verified),\n    };\n  };\n\n  return {\n    verify,\n    async verifyAuthorizationHeader(header: unknown): Promise<AccessiTokenVerification> {\n      const token = extractAccessiBearerToken(header);\n      if (!token) {\n        throw accessiAuthError(401, \"AUTH_TOKEN_MISSING\", \"Token Bearer mancante o malformato.\");\n      }\n      return verify(token);\n    },\n  };\n}\n\n/** Converte un header `Authorization` in verifica del token, senza cache JWKS condivisa. */\nexport async function verifyAccessiAccessToken(\n  header: unknown,\n  options: AccessiResourceServerJwtOptions,\n): Promise<AccessiTokenVerification> {\n  return createAccessiTokenVerifier(options).verifyAuthorizationHeader(header);\n}\n"]}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/token.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiJA,gEAuIC;AAGD,4DAKC;AAhSD,mCAAqD;AAErD,kDAAoC;AAEpC,4CAA8F;AAC9F,qCAA4C;AAC5C,iCAAmD;AACnD,yEAAkF;AAuBlF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,OAAgC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,QAAQ,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwC;IACjE,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IAEnF,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY;QAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;AAC5D,CAAC;AAED,SAAe,SAAS,CACtB,OAA6D;;;QAE7D,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,UAAU,CAAC,KAAK,CAAC;QACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,6CAA6C,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAA,OAAO,CAAC,SAAS,mCAAI,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC5C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,uBAAuB,EACvB,8BAA8B,QAAQ,CAAC,MAAM,IAAI,CAClD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC/E,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,uBAAuB,EAAE,yBAAyB,CAAC,CAAC;QAClF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CAAA;AAED,SAAS,SAAS,CAChB,IAAoC,EACpC,GAAuB,EACvB,SAAiB;IAEjB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,MAAM,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAS,oBAAoB,CAAC,SAA0B;IACtD,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,GAA4B;IAC5C,OAAO,IAAA,wBAAe,EAAC,EAAE,GAAG,EAAE,GAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACzE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACvC,QAAQ,EAAE,CAAC;AAChB,CAAC;AAED,iEAAiE;AACjE,SAAS,kBAAkB,CACzB,OAAwC,EACxC,KAA+B;;IAE/B,IAAA,6BAAmB,EAAC,kCAAkC,EAAE,CAAC,kBACvD,OAAO,EAAE,QAAQ,EACjB,MAAM,EAAE,KAAK,CAAC,MAAM,IACjB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1D,CAAC;IACH,IAAI,CAAC;QACH,MAAA,OAAO,CAAC,cAAc,wDAAG,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,WAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,OAAwC;;IACjF,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,qBAAqB,mCAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,MAAM,mCAC5B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAA,gCAAyB,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1F,IAAI,SAAqC,CAAC;IAC1C,MAAM,sBAAsB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,oBAAoB,mCAAI,IAAK,CAAC,CAAC;IAExF,MAAM,WAAW,GAAG,YAAsE,EAAE,iDAAjE,YAAY,GAAG,KAAK;;QAC7C,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC;QACnF,oFAAoF;QACpF,IAAI,YAAY,IAAI,SAAS,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,GAAG,sBAAsB,EAAE,CAAC;YACpF,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,SAAS,GAAG;YACV,IAAI;YACJ,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,MAAA,OAAO,CAAC,IAAI,CAAC,UAAU,mCAAI,MAAO,CAAC;YACpE,SAAS,EAAE,GAAG;SACf,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAA,CAAC;IAEF,MAAM,MAAM,GAAG,CAAO,KAAa,EAAqC,EAAE;;QACxE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAgC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE;YAC7E,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;YACpB,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,GAAe,CAAC;QACpB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,eAAe,CAAC,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,qBAAqB,EACrB,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC;aAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7B,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;YACxB,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,aAAa,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC/E,WAAW,GAAG,GAAG,KAAK,aAAa,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;YAC/B,IAAI,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;gBACrB,qEAAqE;gBACrE,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC/B,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,GAAG,EAAE,CAAC;oBACR,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;oBAChE,MAAM,IAAA,yBAAgB,EACpB,GAAG,EACH,oBAAoB,EACpB,oCAAoC,GAAG,IAAI,CAC5C,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;YAC7F,CAAC;YACD,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,8CAC9B,UAAU,EAAE,CAAC,SAA0B,CAAC,IACrC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClD,CAAC,OAAO,CAAC,QAAQ;gBAClB,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAyC,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC,KACP,cAAc,IACd,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;gBACvB,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,6BAA6B,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,yCAAyC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,+CAAmC,EAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO;YACL,KAAK;YACL,OAAO,EAAE,QAAqC;YAC9C,YAAY;YACZ,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC;SAC5B,CAAC;IACJ,CAAC,CAAA,CAAC;IAEF,OAAO;QACL,MAAM;QACA,yBAAyB,CAAC,MAAe;;gBAC7C,MAAM,KAAK,GAAG,IAAA,qCAAyB,EAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAA,yBAAgB,EAAC,GAAG,EAAE,oBAAoB,EAAE,qCAAqC,CAAC,CAAC;gBAC3F,CAAC;gBACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAsB,wBAAwB,CAC5C,MAAe,EACf,OAAwC;;QAExC,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC/E,CAAC;CAAA","sourcesContent":["import { createHash, createPublicKey } from \"crypto\";\nimport type { JsonWebKey } from \"crypto\";\nimport * as jwt from \"jsonwebtoken\";\nimport type { AccessiAccessTokenPayload } from \"../contracts\";\nimport { extractAccessiBearerToken, resolveCodiceUtenteFromTokenPayload } from \"../contracts\";\nimport { accessiAuthError } from \"./errors\";\nimport { deriveAccessiAccessSecret } from \"./keys\";\nimport { recordAccessiMetric } from \"../../accessi-service/observability/metrics\";\nimport type { AccessiJwtAlgorithm, AccessiResourceServerJwtOptions, AccessiUnknownKeyIdEvent } from \"./types\";\n\n/** Esito della verifica locale di un access token. */\nexport interface AccessiTokenVerification {\n  token: string;\n  payload: AccessiAccessTokenPayload;\n  codiceUtente: number;\n  user: Record<string, unknown>;\n}\n\n/** Verificatore riutilizzabile: conserva la cache JWKS tra una richiesta e l'altra. */\nexport interface AccessiTokenVerifier {\n  verify(token: string): Promise<AccessiTokenVerification>;\n  verifyAuthorizationHeader(header: unknown): Promise<AccessiTokenVerification>;\n}\n\ninterface JwksCacheEntry {\n  keys: Array<Record<string, unknown>>;\n  expiresAt: number;\n  fetchedAt: number;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction extractUser(payload: Record<string, unknown>): Record<string, unknown> {\n  const userData = isRecord(payload.userData) ? payload.userData : undefined;\n  const utente = isRecord(payload.utente)\n    ? payload.utente\n    : isRecord(userData?.utente)\n      ? userData.utente\n      : undefined;\n  return utente ?? {};\n}\n\nfunction defaultAlgorithms(options: AccessiResourceServerJwtOptions): AccessiJwtAlgorithm[] {\n  if (options.algorithms && options.algorithms.length > 0) return options.algorithms;\n\n  const algorithms: AccessiJwtAlgorithm[] = [];\n  if (options.secret || options.serverSecret) algorithms.push(\"HS256\");\n  if (options.publicKey || options.jwks) {\n    algorithms.push(\"RS256\", \"RS384\", \"RS512\", \"ES256\", \"ES384\", \"ES512\");\n  }\n  return algorithms;\n}\n\nfunction algorithmFamily(algorithm: string): \"hmac\" | \"asymmetric\" {\n  return algorithm.startsWith(\"HS\") ? \"hmac\" : \"asymmetric\";\n}\n\nasync function fetchJwks(\n  options: NonNullable<AccessiResourceServerJwtOptions[\"jwks\"]>,\n): Promise<Array<Record<string, unknown>>> {\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"fetch non disponibile per caricare la JWKS.\");\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 3000);\n  try {\n    const response = await fetchImpl(options.url, {\n      method: \"GET\",\n      headers: { Accept: \"application/json\" },\n      signal: controller.signal,\n    });\n    if (!response.ok) {\n      throw accessiAuthError(\n        503,\n        \"AUTH_JWKS_UNAVAILABLE\",\n        `JWKS non disponibile (HTTP ${response.status}).`,\n      );\n    }\n    const payload: unknown = await response.json();\n    if (!isRecord(payload) || !Array.isArray(payload.keys)) {\n      throw accessiAuthError(503, \"AUTH_JWKS_UNAVAILABLE\", \"Risposta JWKS non valida.\");\n    }\n    return payload.keys.filter(isRecord);\n  } catch (error) {\n    if (error && typeof error === \"object\" && \"code\" in error && \"status\" in error) {\n      throw error;\n    }\n    throw accessiAuthError(503, \"AUTH_JWKS_UNAVAILABLE\", \"JWKS non raggiungibile.\");\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nfunction selectJwk(\n  keys: Array<Record<string, unknown>>,\n  kid: string | undefined,\n  algorithm: string,\n): Record<string, unknown> | undefined {\n  return keys.find((key) => {\n    const keyAlg = typeof key.alg === \"string\" ? key.alg : undefined;\n    if (keyAlg && keyAlg !== algorithm) return false;\n    if (!kid) return true;\n    return typeof key.kid === \"string\" && key.kid === kid;\n  });\n}\n\n/** Fingerprint della chiave pubblica, identico a quello usato dalla JWKS Accessi. */\nfunction fingerprintPublicKey(publicKey: string | Buffer): string {\n  const der = createPublicKey(publicKey).export({ type: \"spki\", format: \"der\" });\n  return createHash(\"sha256\").update(der).digest(\"base64url\").slice(0, 16);\n}\n\nfunction jwkToPem(jwk: Record<string, unknown>): string {\n  return createPublicKey({ key: jwk as unknown as JsonWebKey, format: \"jwk\" })\n    .export({ type: \"spki\", format: \"pem\" })\n    .toString();\n}\n\n/** L'alert non deve mai cambiare l'esito dell'autenticazione. */\nfunction notifyUnknownKeyId(\n  options: AccessiResourceServerJwtOptions,\n  event: AccessiUnknownKeyIdEvent,\n): void {\n  recordAccessiMetric('accessi_jwt_unknown_key_id_total', 1, {\n    purpose: 'access',\n    source: event.source,\n    ...(event.algorithm ? { algorithm: event.algorithm } : {}),\n  });\n  try {\n    options.onUnknownKeyId?.(event);\n  } catch {\n    // Un logger o webhook guasto non trasforma un 401 in un 500.\n  }\n}\n\n/**\n * Crea un verificatore locale riutilizzabile.\n *\n * Supporta HMAC, chiavi pubbliche PEM (RS ed ES) e JWKS remoto. La cache\n * JWKS e legata all'istanza del verificatore.\n */\nexport function createAccessiTokenVerifier(options: AccessiResourceServerJwtOptions): AccessiTokenVerifier {\n  const algorithms = defaultAlgorithms(options);\n  if (algorithms.length === 0) {\n    throw accessiAuthError(\n      500,\n      \"AUTH_CONFIG_INVALID\",\n      \"Configurare almeno una tra jwt.secret, jwt.serverSecret, jwt.publicKey e jwt.jwks.\",\n    );\n  }\n\n  const clockTolerance = options.clockToleranceSeconds ?? 5;\n  const hmacSecret = options.secret\n    ?? (options.serverSecret ? deriveAccessiAccessSecret(options.serverSecret) : undefined);\n  let jwksCache: JwksCacheEntry | undefined;\n  const jwksMinRefreshInterval = Math.max(0, options.jwks?.minRefreshIntervalMs ?? 5_000);\n\n  const getJwksKeys = async (forceRefresh = false): Promise<Array<Record<string, unknown>>> => {\n    if (!options.jwks) return [];\n    const now = Date.now();\n    if (!forceRefresh && jwksCache && jwksCache.expiresAt > now) return jwksCache.keys;\n    // Refresh forzato ma troppo ravvicinato: riusa la cache per non martellare la JWKS.\n    if (forceRefresh && jwksCache && now - jwksCache.fetchedAt < jwksMinRefreshInterval) {\n      return jwksCache.keys;\n    }\n    const keys = await fetchJwks(options.jwks);\n    jwksCache = {\n      keys,\n      expiresAt: now + Math.max(1_000, options.jwks.cacheTtlMs ?? 300_000),\n      fetchedAt: now,\n    };\n    return keys;\n  };\n\n  const verify = async (token: string): Promise<AccessiTokenVerification> => {\n    const decoded = jwt.decode(token, { complete: true });\n    if (!decoded || typeof decoded === \"string\" || !isRecord(decoded.header)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token JWT non valido.\");\n    }\n\n    const algorithm = typeof decoded.header.alg === \"string\" ? decoded.header.alg : undefined;\n    if (!algorithm || !algorithms.includes(algorithm as AccessiJwtAlgorithm)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Algoritmo JWT non consentito.\");\n    }\n\n    const kid = typeof decoded.header.kid === \"string\" && decoded.header.kid !== \"\"\n      ? decoded.header.kid\n      : undefined;\n    let key: jwt.Secret;\n    let kidMismatch = false;\n    if (algorithmFamily(algorithm) === \"hmac\") {\n      if (!hmacSecret) {\n        throw accessiAuthError(\n          500,\n          \"AUTH_CONFIG_INVALID\",\n          \"jwt.secret o jwt.serverSecret non configurato per token HS*.\",\n        );\n      }\n      key = hmacSecret;\n    } else if (options.publicKey) {\n      key = options.publicKey;\n      if (kid) {\n        const expectedKeyId = options.keyId ?? fingerprintPublicKey(options.publicKey);\n        kidMismatch = kid !== expectedKeyId;\n      }\n    } else if (options.jwks) {\n      let keys = await getJwksKeys();\n      let selected = selectJwk(keys, kid, algorithm);\n      if (!selected && kid) {\n        // La JWKS in cache potrebbe precedere una rotazione appena avvenuta.\n        keys = await getJwksKeys(true);\n        selected = selectJwk(keys, kid, algorithm);\n      }\n      if (!selected) {\n        if (kid) {\n          notifyUnknownKeyId(options, { kid, algorithm, source: \"jwks\" });\n          throw accessiAuthError(\n            401,\n            \"AUTH_TOKEN_INVALID\",\n            `Chiave JWKS non trovata per kid \"${kid}\".`,\n          );\n        }\n        throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Chiave JWKS non trovata per il token.\");\n      }\n      key = jwkToPem(selected);\n    } else {\n      throw accessiAuthError(500, \"AUTH_CONFIG_INVALID\", \"jwt.publicKey/jwt.jwks non configurati.\");\n    }\n\n    let verified: unknown;\n    try {\n      verified = jwt.verify(token, key, {\n        algorithms: [algorithm as jwt.Algorithm],\n        ...(options.issuer ? { issuer: options.issuer } : {}),\n        ...(options.audience\n          ? { audience: options.audience as jwt.VerifyOptions[\"audience\"] }\n          : {}),\n        clockTolerance,\n      });\n    } catch {\n      if (kidMismatch && kid) {\n        notifyUnknownKeyId(options, { kid, algorithm, source: \"publicKey\" });\n      }\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Token non valido o scaduto.\");\n    }\n\n    if (!isRecord(verified)) {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Payload JWT non valido.\");\n    }\n    if (verified.typ !== \"access\") {\n      throw accessiAuthError(401, \"AUTH_TOKEN_INVALID\", \"Il token non e un access token Accessi.\");\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(verified);\n    if (!codiceUtente) {\n      throw accessiAuthError(401, \"AUTH_USER_CODE_MISSING\", \"Token privo di un utente valido.\");\n    }\n\n    return {\n      token,\n      payload: verified as AccessiAccessTokenPayload,\n      codiceUtente,\n      user: extractUser(verified),\n    };\n  };\n\n  return {\n    verify,\n    async verifyAuthorizationHeader(header: unknown): Promise<AccessiTokenVerification> {\n      const token = extractAccessiBearerToken(header);\n      if (!token) {\n        throw accessiAuthError(401, \"AUTH_TOKEN_MISSING\", \"Token Bearer mancante o malformato.\");\n      }\n      return verify(token);\n    },\n  };\n}\n\n/** Converte un header `Authorization` in verifica del token, senza cache JWKS condivisa. */\nexport async function verifyAccessiAccessToken(\n  header: unknown,\n  options: AccessiResourceServerJwtOptions,\n): Promise<AccessiTokenVerification> {\n  return createAccessiTokenVerifier(options).verifyAuthorizationHeader(header);\n}\n"]}

package/dist/accessi/resource-server/types.d.ts

@@ -1,7 +1,7 @@
 import type { AccessiAuthorizationOptions, AccessiGrant, GrantsResult } from "../contracts";
-import type { SessionRevocationStore } from "../../accessi-module/security/sessionRevocation";
-import type { AccessTokenRevocationStore } from "../../accessi-module/security/accessTokenRevocation";
-import type { RefreshTokenRotationStore } from "../../accessi-module/security/refreshTokenRotation";
+import type { SessionRevocationStore } from "../../accessi-service/security/sessionRevocation";
+import type { AccessTokenRevocationStore } from "../../accessi-service/security/accessTokenRevocation";
+import type { RefreshTokenRotationStore } from "../../accessi-service/security/refreshTokenRotation";
 /** Algoritmi JWT supportati dal resource server. */
 export type AccessiJwtAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512";
 /** Evento emesso quando un token usa un `kid` assente dalla configurazione. */

package/dist/accessi/resource-server/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AccessiAuthorizationOptions,\n  AccessiGrant,\n  GrantsResult,\n} from \"../contracts\";\nimport type { SessionRevocationStore } from \"../../accessi-module/security/sessionRevocation\";\nimport type { AccessTokenRevocationStore } from \"../../accessi-module/security/accessTokenRevocation\";\nimport type { RefreshTokenRotationStore } from \"../../accessi-module/security/refreshTokenRotation\";\n\n/** Algoritmi JWT supportati dal resource server. */\nexport type AccessiJwtAlgorithm =\n  | \"HS256\"\n  | \"HS384\"\n  | \"HS512\"\n  | \"RS256\"\n  | \"RS384\"\n  | \"RS512\"\n  | \"ES256\"\n  | \"ES384\"\n  | \"ES512\";\n\n/** Evento emesso quando un token usa un `kid` assente dalla configurazione. */\nexport interface AccessiUnknownKeyIdEvent {\n  kid: string;\n  algorithm?: string;\n  /** Fonte della chiave: JWKS remota o chiave pubblica statica. */\n  source: \"jwks\" | \"publicKey\";\n}\n\n/** Opzioni di verifica locale del JWT. Almeno una tra `secret`, `publicKey` e `jwks` e obbligatoria. */\nexport interface AccessiResourceServerJwtOptions {\n  /** Chiave HMAC gia derivata (access key). Alternativa a `serverSecret`. */\n  secret?: string;\n  /**\n   * Segreto Accessi grezzo (`ACCESSI_JWT_SECRET`).\n   *\n   * Il resource server deriva automaticamente la chiave access con la stessa\n   * KDF del server: e il modo consigliato quando si condivide il segreto HS256.\n   */\n  serverSecret?: string;\n  /** Chiave pubblica PEM per algoritmi RS ed ES. */\n  publicKey?: string | Buffer;\n  /** JWKS remoto per verificare token firmati con chiavi asimmetriche. */\n  jwks?: {\n    url: string;\n    cacheTtlMs?: number;\n    timeoutMs?: number;\n    /**\n     * Distanza minima tra due refresh forzati quando arriva un `kid` sconosciuto.\n     * Default: 5000 ms. Evita che token con `kid` inventati martellino la JWKS.\n     */\n    minRefreshIntervalMs?: number;\n    fetch?: typeof fetch;\n  };\n  /**\n   * `kid` della chiave statica in `publicKey`. Se assente si usa il fingerprint\n   * della chiave, lo stesso calcolato dalla JWKS Accessi.\n   */\n  keyId?: string;\n  /**\n   * Alert quando un token non e verificabile per un `kid` non presente nella\n   * chiave configurata o nella JWKS. Utile per intercettare rotazioni incomplete.\n   */\n  onUnknownKeyId?: (event: AccessiUnknownKeyIdEvent) => void;\n  /** Default: HS256 con `secret`, altrimenti RS/ES con `publicKey`/`jwks`. */\n  algorithms?: AccessiJwtAlgorithm[];\n  /** Issuer atteso (`iss`). */\n  issuer?: string;\n  /** Audience attesa (`aud`). */\n  audience?: string | string[];\n  /** Tolleranza orologio in secondi. Default: 5. */\n  clockToleranceSeconds?: number;\n}\n\n/** Configurazione del client di introspection verso Accessi Service. */\nexport interface AccessiIntrospectionOptions {\n  /** URL completo, es. `https://accessi.example.com/api/accessi/auth/introspect`. */\n  url: string;\n  /** Service token Accessi con scope `accessi:introspect`. */\n  serviceToken: string;\n  /** TTL della cache locale dei risultati attivi. Default: 30000 ms. */\n  cacheTtlMs?: number;\n  /** Timeout HTTP. Default: 3000 ms. */\n  timeoutMs?: number;\n  /** Fetch iniettabile per test o runtime non-Node. */\n  fetch?: typeof fetch;\n}\n\n/** Risultato dell'introspection. */\nexport interface AccessiIntrospectionResult {\n  active: boolean;\n  user?: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n}\n\n/** Modalita di autenticazione del resource server. */\nexport type AccessiResourceServerMode = \"local\" | \"introspection\";\n\n/**\n * Configurazione di un backend fratello che non possiede il database Accessi.\n *\n * - `mode: \"local\"` verifica il JWT con chiave locale e, se servono grant, usa\n *   l'introspection per leggerli.\n * - `mode: \"introspection\"` delega la verifica del token ad Accessi Service.\n */\nexport interface AccessiResourceServerOptions {\n  mode?: AccessiResourceServerMode;\n  jwt?: AccessiResourceServerJwtOptions;\n  introspection?: AccessiIntrospectionOptions;\n  /** Policy di autorizzazione opzionale applicata dopo l'autenticazione. */\n  authorization?: AccessiAuthorizationOptions;\n  /** Store condiviso di revoca. Opzionale. */\n  revocation?: {\n    /** Revoca per utente: invalida tutti i token emessi prima del cutoff. */\n    store?: SessionRevocationStore;\n    /** Revoca dei singoli access token tramite `jti`. */\n    accessTokenStore?: AccessTokenRevocationStore;\n    /** Store di rotazione refresh: applica la revoca delle famiglie sospette. */\n    familyStore?: RefreshTokenRotationStore;\n  };\n  /** Audit strutturato degli errori di autenticazione. Default: true. */\n  audit?: boolean;\n}\n\n/** Dati allegati alla request dopo l'autenticazione. */\nexport interface AccessiRequestContext {\n  token: string;\n  user: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n  payload?: Record<string, unknown>;\n}\n\n/** Grant esposto per compatibilita con il middleware storico. */\nexport type AccessiRequestGrants = AccessiGrant[];\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/accessi/resource-server/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AccessiAuthorizationOptions,\n  AccessiGrant,\n  GrantsResult,\n} from \"../contracts\";\nimport type { SessionRevocationStore } from \"../../accessi-service/security/sessionRevocation\";\nimport type { AccessTokenRevocationStore } from \"../../accessi-service/security/accessTokenRevocation\";\nimport type { RefreshTokenRotationStore } from \"../../accessi-service/security/refreshTokenRotation\";\n\n/** Algoritmi JWT supportati dal resource server. */\nexport type AccessiJwtAlgorithm =\n  | \"HS256\"\n  | \"HS384\"\n  | \"HS512\"\n  | \"RS256\"\n  | \"RS384\"\n  | \"RS512\"\n  | \"ES256\"\n  | \"ES384\"\n  | \"ES512\";\n\n/** Evento emesso quando un token usa un `kid` assente dalla configurazione. */\nexport interface AccessiUnknownKeyIdEvent {\n  kid: string;\n  algorithm?: string;\n  /** Fonte della chiave: JWKS remota o chiave pubblica statica. */\n  source: \"jwks\" | \"publicKey\";\n}\n\n/** Opzioni di verifica locale del JWT. Almeno una tra `secret`, `publicKey` e `jwks` e obbligatoria. */\nexport interface AccessiResourceServerJwtOptions {\n  /** Chiave HMAC gia derivata (access key). Alternativa a `serverSecret`. */\n  secret?: string;\n  /**\n   * Segreto Accessi grezzo (`ACCESSI_JWT_SECRET`).\n   *\n   * Il resource server deriva automaticamente la chiave access con la stessa\n   * KDF del server: e il modo consigliato quando si condivide il segreto HS256.\n   */\n  serverSecret?: string;\n  /** Chiave pubblica PEM per algoritmi RS ed ES. */\n  publicKey?: string | Buffer;\n  /** JWKS remoto per verificare token firmati con chiavi asimmetriche. */\n  jwks?: {\n    url: string;\n    cacheTtlMs?: number;\n    timeoutMs?: number;\n    /**\n     * Distanza minima tra due refresh forzati quando arriva un `kid` sconosciuto.\n     * Default: 5000 ms. Evita che token con `kid` inventati martellino la JWKS.\n     */\n    minRefreshIntervalMs?: number;\n    fetch?: typeof fetch;\n  };\n  /**\n   * `kid` della chiave statica in `publicKey`. Se assente si usa il fingerprint\n   * della chiave, lo stesso calcolato dalla JWKS Accessi.\n   */\n  keyId?: string;\n  /**\n   * Alert quando un token non e verificabile per un `kid` non presente nella\n   * chiave configurata o nella JWKS. Utile per intercettare rotazioni incomplete.\n   */\n  onUnknownKeyId?: (event: AccessiUnknownKeyIdEvent) => void;\n  /** Default: HS256 con `secret`, altrimenti RS/ES con `publicKey`/`jwks`. */\n  algorithms?: AccessiJwtAlgorithm[];\n  /** Issuer atteso (`iss`). */\n  issuer?: string;\n  /** Audience attesa (`aud`). */\n  audience?: string | string[];\n  /** Tolleranza orologio in secondi. Default: 5. */\n  clockToleranceSeconds?: number;\n}\n\n/** Configurazione del client di introspection verso Accessi Service. */\nexport interface AccessiIntrospectionOptions {\n  /** URL completo, es. `https://accessi.example.com/api/accessi/auth/introspect`. */\n  url: string;\n  /** Service token Accessi con scope `accessi:introspect`. */\n  serviceToken: string;\n  /** TTL della cache locale dei risultati attivi. Default: 30000 ms. */\n  cacheTtlMs?: number;\n  /** Timeout HTTP. Default: 3000 ms. */\n  timeoutMs?: number;\n  /** Fetch iniettabile per test o runtime non-Node. */\n  fetch?: typeof fetch;\n}\n\n/** Risultato dell'introspection. */\nexport interface AccessiIntrospectionResult {\n  active: boolean;\n  user?: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n}\n\n/** Modalita di autenticazione del resource server. */\nexport type AccessiResourceServerMode = \"local\" | \"introspection\";\n\n/**\n * Configurazione di un backend fratello che non possiede il database Accessi.\n *\n * - `mode: \"local\"` verifica il JWT con chiave locale e, se servono grant, usa\n *   l'introspection per leggerli.\n * - `mode: \"introspection\"` delega la verifica del token ad Accessi Service.\n */\nexport interface AccessiResourceServerOptions {\n  mode?: AccessiResourceServerMode;\n  jwt?: AccessiResourceServerJwtOptions;\n  introspection?: AccessiIntrospectionOptions;\n  /** Policy di autorizzazione opzionale applicata dopo l'autenticazione. */\n  authorization?: AccessiAuthorizationOptions;\n  /** Store condiviso di revoca. Opzionale. */\n  revocation?: {\n    /** Revoca per utente: invalida tutti i token emessi prima del cutoff. */\n    store?: SessionRevocationStore;\n    /** Revoca dei singoli access token tramite `jti`. */\n    accessTokenStore?: AccessTokenRevocationStore;\n    /** Store di rotazione refresh: applica la revoca delle famiglie sospette. */\n    familyStore?: RefreshTokenRotationStore;\n  };\n  /** Audit strutturato degli errori di autenticazione. Default: true. */\n  audit?: boolean;\n}\n\n/** Dati allegati alla request dopo l'autenticazione. */\nexport interface AccessiRequestContext {\n  token: string;\n  user: Record<string, unknown>;\n  codiceUtente?: number;\n  grants?: GrantsResult;\n  payload?: Record<string, unknown>;\n}\n\n/** Grant esposto per compatibilita con il middleware storico. */\nexport type AccessiRequestGrants = AccessiGrant[];\n"]}

package/dist/accessi/server/index.d.ts

@@ -5,10 +5,13 @@
  * console e servizi Nest completi. I backend fratelli devono usare
  * `accessi/resource-server` e `accessi/client`.
  */
-export * from "../../accessi-module";
+export * from "../../accessi-service";
 export * from "./standalone";
 export * from "./tenants";
 export * from "./tenantStores";
 export * from "./tenantSupervisor";
-export type { AccessiOptions as AccessiServerOptions } from "../../accessi-module";
-export { createAccessiOptionsFromEnv, createCatalogScriptsOptionsFromEnv, parseAccessiPreviousPublicKeys, } from "../../accessi-module/database-updates/accessiOptionsFromEnv";
+export * from "./tenantRouter";
+export { runWithAccessiTenant, getAccessiTenantContext, getAccessiTenantId, } from "../../accessi-service/tenancy/tenantContext";
+export type { AccessiTenantContext } from "../../accessi-service/tenancy/tenantContext";
+export type { AccessiOptions as AccessiServerOptions } from "../../accessi-service";
+export { createAccessiOptionsFromEnv, createCatalogScriptsOptionsFromEnv, parseAccessiPreviousPublicKeys, } from "../../accessi-service/database-updates/accessiOptionsFromEnv";

package/dist/accessi/server/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseAccessiPreviousPublicKeys = exports.createCatalogScriptsOptionsFromEnv = exports.createAccessiOptionsFromEnv = void 0;
+exports.parseAccessiPreviousPublicKeys = exports.createCatalogScriptsOptionsFromEnv = exports.createAccessiOptionsFromEnv = exports.getAccessiTenantId = exports.getAccessiTenantContext = exports.runWithAccessiTenant = void 0;
 /**
  * Entry point server Accessi.
  *
@@ -22,12 +22,17 @@ exports.parseAccessiPreviousPublicKeys = exports.createCatalogScriptsOptionsFrom
  * console e servizi Nest completi. I backend fratelli devono usare
  * `accessi/resource-server` e `accessi/client`.
  */
-__exportStar(require("../../accessi-module"), exports);
+__exportStar(require("../../accessi-service"), exports);
 __exportStar(require("./standalone"), exports);
 __exportStar(require("./tenants"), exports);
 __exportStar(require("./tenantStores"), exports);
 __exportStar(require("./tenantSupervisor"), exports);
-var accessiOptionsFromEnv_1 = require("../../accessi-module/database-updates/accessiOptionsFromEnv");
+__exportStar(require("./tenantRouter"), exports);
+var tenantContext_1 = require("../../accessi-service/tenancy/tenantContext");
+Object.defineProperty(exports, "runWithAccessiTenant", { enumerable: true, get: function () { return tenantContext_1.runWithAccessiTenant; } });
+Object.defineProperty(exports, "getAccessiTenantContext", { enumerable: true, get: function () { return tenantContext_1.getAccessiTenantContext; } });
+Object.defineProperty(exports, "getAccessiTenantId", { enumerable: true, get: function () { return tenantContext_1.getAccessiTenantId; } });
+var accessiOptionsFromEnv_1 = require("../../accessi-service/database-updates/accessiOptionsFromEnv");
 Object.defineProperty(exports, "createAccessiOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createAccessiOptionsFromEnv; } });
 Object.defineProperty(exports, "createCatalogScriptsOptionsFromEnv", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.createCatalogScriptsOptionsFromEnv; } });
 Object.defineProperty(exports, "parseAccessiPreviousPublicKeys", { enumerable: true, get: function () { return accessiOptionsFromEnv_1.parseAccessiPreviousPublicKeys; } });

package/dist/accessi/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,uDAAqC;AACrC,+CAA6B;AAC7B,4CAA0B;AAC1B,iDAA+B;AAC/B,qDAAmC;AAEnC,qGAIqE;AAHnE,oIAAA,2BAA2B,OAAA;AAC3B,2IAAA,kCAAkC,OAAA;AAClC,uIAAA,8BAA8B,OAAA","sourcesContent":["/**\n * Entry point server Accessi.\n *\n * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,\n * console e servizi Nest completi. I backend fratelli devono usare\n * `accessi/resource-server` e `accessi/client`.\n */\nexport * from \"../../accessi-module\";\nexport * from \"./standalone\";\nexport * from \"./tenants\";\nexport * from \"./tenantStores\";\nexport * from \"./tenantSupervisor\";\nexport type { AccessiOptions as AccessiServerOptions } from \"../../accessi-module\";\nexport {\n  createAccessiOptionsFromEnv,\n  createCatalogScriptsOptionsFromEnv,\n  parseAccessiPreviousPublicKeys,\n} from \"../../accessi-module/database-updates/accessiOptionsFromEnv\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,wDAAsC;AACtC,+CAA6B;AAC7B,4CAA0B;AAC1B,iDAA+B;AAC/B,qDAAmC;AACnC,iDAA+B;AAC/B,6EAIqD;AAHnD,qHAAA,oBAAoB,OAAA;AACpB,wHAAA,uBAAuB,OAAA;AACvB,mHAAA,kBAAkB,OAAA;AAIpB,sGAIsE;AAHpE,oIAAA,2BAA2B,OAAA;AAC3B,2IAAA,kCAAkC,OAAA;AAClC,uIAAA,8BAA8B,OAAA","sourcesContent":["/**\n * Entry point server Accessi.\n *\n * Questo e l'unico entry point che puo importare database, SMTP, migrazioni,\n * console e servizi Nest completi. I backend fratelli devono usare\n * `accessi/resource-server` e `accessi/client`.\n */\nexport * from \"../../accessi-service\";\nexport * from \"./standalone\";\nexport * from \"./tenants\";\nexport * from \"./tenantStores\";\nexport * from \"./tenantSupervisor\";\nexport * from \"./tenantRouter\";\nexport {\n  runWithAccessiTenant,\n  getAccessiTenantContext,\n  getAccessiTenantId,\n} from \"../../accessi-service/tenancy/tenantContext\";\nexport type { AccessiTenantContext } from \"../../accessi-service/tenancy/tenantContext\";\nexport type { AccessiOptions as AccessiServerOptions } from \"../../accessi-service\";\nexport {\n  createAccessiOptionsFromEnv,\n  createCatalogScriptsOptionsFromEnv,\n  parseAccessiPreviousPublicKeys,\n} from \"../../accessi-service/database-updates/accessiOptionsFromEnv\";\n"]}

package/dist/accessi/server/standalone.d.ts

@@ -1,9 +1,9 @@
 import type { Application } from 'express';
 import type { Server } from 'http';
-import type { AccessiModuleInitializationResult } from '../../accessi-module';
-import type { AccessiOptions } from '../../accessi-module/AccessiModule';
-import type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';
-export type { AccessiReadinessCheck } from '../../accessi-module/health/readiness';
+import type { AccessiModuleInitializationResult } from '../../accessi-service';
+import type { AccessiOptions } from '../../accessi-service/AccessiModule';
+import type { AccessiReadinessCheck } from '../../accessi-service/health/readiness';
+export type { AccessiReadinessCheck } from '../../accessi-service/health/readiness';
 export interface AccessiServiceOptions {
     /** Applicazione Express gia esistente. Default: nuova app. */
     app?: Application;

package/dist/accessi/server/standalone.js

@@ -17,11 +17,11 @@ exports.startAccessiService = startAccessiService;
 const express_1 = __importDefault(require("express"));
 const Logger_1 = require("../../Logger");
 const Orm_1 = require("../../Orm");
-const accessi_module_1 = require("../../accessi-module");
-const accessiOptionsFromEnv_1 = require("../../accessi-module/database-updates/accessiOptionsFromEnv");
-const readiness_1 = require("../../accessi-module/health/readiness");
-const validateOptions_1 = require("../../accessi-module/security/validateOptions");
-const metrics_1 = require("../../accessi-module/observability/metrics");
+const accessi_service_1 = require("../../accessi-service");
+const accessiOptionsFromEnv_1 = require("../../accessi-service/database-updates/accessiOptionsFromEnv");
+const readiness_1 = require("../../accessi-service/health/readiness");
+const validateOptions_1 = require("../../accessi-service/security/validateOptions");
+const metrics_1 = require("../../accessi-service/observability/metrics");
 function normalizePath(value) {
     return `/${value.replace(/^\/+|\/+$/g, '')}`;
 }
@@ -110,7 +110,7 @@ function createAccessiService() {
                 res.status(200).send(`${metrics.render()}${(0, metrics_1.renderAccessiMetrics)()}`);
             });
         }
-        const result = yield (0, accessi_module_1.initializeAccessiModule)(app, accessiOptions);
+        const result = yield (0, accessi_service_1.initializeAccessiModule)(app, accessiOptions);
         nestApp = result.nestApp;
         document = result.document;
         initialized = true;