emilsoftware-utilities 2.0.0-dev.83 → 2.0.0-dev.85

package/dist/accessi-module/Controllers/AuthController.js

@@ -1,564 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var AuthController_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthController = void 0;
-const common_1 = require("@nestjs/common");
-const TwoFactorDtos_1 = require("../Dtos/TwoFactorDtos");
-const swagger_1 = require("@nestjs/swagger");
-const crypto_1 = require("crypto");
-const Logger_1 = require("../../Logger");
-const Utilities_1 = require("../../Utilities");
-const Dtos_1 = require("../Dtos");
-const AuthService_1 = require("../Services/AuthService/AuthService");
-const AdminBootstrapService_1 = require("../Services/AdminBootstrapService/AdminBootstrapService");
-const jwt_strategy_1 = require("../jwt/jwt.strategy");
-const accessControl_1 = require("../security/accessControl");
-const authenticatedToken_1 = require("../security/authenticatedToken");
-const authCookies_1 = require("../security/authCookies");
-const metrics_1 = require("../observability/metrics");
-const sessionRevocation_1 = require("../security/sessionRevocation");
-const accessTokenRevocation_1 = require("../security/accessTokenRevocation");
-const audit_1 = require("../security/audit");
-const publicAuthRateLimit_1 = require("../security/publicAuthRateLimit");
-/** Estrae il codice stabile di un errore Nest `{ code, message }`. */
-function authErrorCode(error) {
-    if (!error || typeof error !== 'object')
-        return undefined;
-    const response = typeof error.getResponse === 'function'
-        ? error.getResponse()
-        : error.response;
-    if (response && typeof response === 'object') {
-        const code = response.code;
-        return typeof code === 'string' ? code : undefined;
-    }
-    return undefined;
-}
-let AuthController = AuthController_1 = class AuthController {
-    constructor(authService, adminBootstrapService, options) {
-        this.authService = authService;
-        this.adminBootstrapService = adminBootstrapService;
-        this.options = options;
-        this.logger = new Logger_1.Logger(AuthController_1.name);
-    }
-    resetPassword(request, res, token, body) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const rateLimitDecision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'passwordResetConfirm', request);
-                if (!rateLimitDecision.allowed) {
-                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
-                }
-                yield this.authService.confirmResetPassword(token, body.newPassword);
-                return Utilities_1.RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');
-            }
-            catch (error) {
-                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, common_1.HttpStatus.BAD_REQUEST);
-            }
-        });
-    }
-    getUserByToken(request, body, res) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const rateLimitDecision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'getUserByToken', request);
-                if (!rateLimitDecision.allowed) {
-                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
-                }
-                const requestToken = typeof (body === null || body === void 0 ? void 0 : body.token) === 'string' && body.token.trim() !== ''
-                    ? body.token
-                    : (0, authenticatedToken_1.extractAccessiBearerToken)(request.headers.authorization);
-                if (!requestToken) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Token non fornito', AuthController_1.name, common_1.HttpStatus.BAD_REQUEST);
-                }
-                const authenticatedPayload = yield this.authService.getAuthenticatedTokenPayload(requestToken);
-                const userData = authenticatedPayload === null || authenticatedPayload === void 0 ? void 0 : authenticatedPayload.utente;
-                if (!userData) {
-                    throw new Error('Il token non contiene un utente Accessi valido.');
-                }
-                // Keep the runtime response aligned with GetUserByTokenResponse and Orval:
-                // Result.userData contains the authenticated user directly, not a nested JWT payload.
-                return Utilities_1.RestUtilities.sendBaseResponse(res, { userData });
-            }
-            catch (error) {
-                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, common_1.HttpStatus.UNAUTHORIZED);
-            }
-        });
-    }
-    revokeSessions(request, res) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const user = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
-                if (!(0, sessionRevocation_1.getSessionRevocationStore)(this.options)) {
-                    throw new common_1.HttpException({
-                        code: 'ACCESSI_SESSION_REVOCATION_DISABLED',
-                        message: 'La revoca sessioni non e configurata su questa istanza.',
-                    }, common_1.HttpStatus.NOT_IMPLEMENTED);
-                }
-                yield (0, sessionRevocation_1.revokeAccessiUserSessions)(this.options, user.codiceUtente);
-                const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
-                if (cookieConfig)
-                    (0, authCookies_1.clearAccessiAuthCookies)(res, cookieConfig);
-                return Utilities_1.RestUtilities.sendOKMessage(res, 'Sessioni revocate con successo.');
-            }
-            catch (error) {
-                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.BAD_REQUEST);
-            }
-        });
-    }
-    revokeToken(request, body, res) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            try {
-                const user = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
-                if (!(0, accessTokenRevocation_1.getAccessTokenRevocationStore)(this.options)) {
-                    throw new common_1.HttpException({
-                        code: 'ACCESSI_ACCESS_TOKEN_REVOCATION_DISABLED',
-                        message: 'La revoca dei singoli token non e configurata su questa istanza.',
-                    }, common_1.HttpStatus.NOT_IMPLEMENTED);
-                }
-                const payload = ((_a = request.user) !== null && _a !== void 0 ? _a : {});
-                const currentJti = typeof payload.jti === 'string' ? payload.jti : undefined;
-                const requestedJti = typeof (body === null || body === void 0 ? void 0 : body.jti) === 'string' ? body.jti.trim() : '';
-                const targetJti = requestedJti !== '' ? requestedJti : currentJti;
-                if (!targetJti) {
-                    throw new common_1.HttpException({ code: 'ACCESSI_TOKEN_JTI_MISSING', message: 'Il token non contiene un jti revocabile.' }, common_1.HttpStatus.BAD_REQUEST);
-                }
-                const isCurrentToken = targetJti === currentJti;
-                if (!isCurrentToken && !user.flagAdmin && !user.flagSuper) {
-                    throw new common_1.HttpException({
-                        code: 'ACCESSI_TOKEN_REVOKE_FORBIDDEN',
-                        message: 'Solo gli amministratori possono revocare il token di un altro utente.',
-                    }, common_1.HttpStatus.FORBIDDEN);
-                }
-                const expiresAt = Number(payload.exp);
-                yield (0, accessTokenRevocation_1.revokeAccessiAccessToken)(this.options, targetJti, isCurrentToken && Number.isFinite(expiresAt) ? expiresAt * 1000 : undefined);
-                (0, audit_1.auditAccessi)('access_token_revoked', {
-                    codiceUtente: user.codiceUtente,
-                    actor: user.codiceUtente,
-                    jti: targetJti,
-                    self: isCurrentToken,
-                });
-                if (isCurrentToken) {
-                    const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
-                    if (cookieConfig)
-                        (0, authCookies_1.clearAccessiAuthCookies)(res, cookieConfig);
-                }
-                return Utilities_1.RestUtilities.sendOKMessage(res, 'Token revocato con successo.');
-            }
-            catch (error) {
-                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.BAD_REQUEST);
-            }
-        });
-    }
-    login(request, loginRequest, res) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const startedAt = Date.now();
-            try {
-                const rateLimitDecision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'login', request, [loginRequest === null || loginRequest === void 0 ? void 0 : loginRequest.email]);
-                if (!rateLimitDecision.allowed) {
-                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result: 'rate_limited' });
-                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, rateLimitDecision.retryAfterSeconds);
-                }
-                const userData = yield this.authService.login(loginRequest);
-                if (!userData) {
-                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result: 'failure' });
-                    (0, audit_1.auditAccessi)('login_failed', { result: 'failure', ip: request.ip, emailProvided: Boolean(loginRequest === null || loginRequest === void 0 ? void 0 : loginRequest.email) });
-                    return Utilities_1.RestUtilities.sendInvalidCredentials(res);
-                }
-                if (!userData.challenge && !userData.passwordRequired) {
-                    const tokens = this.authService.createTokenPair(userData.utente, ['password']);
-                    userData.token = tokens.access;
-                    if (tokens.refresh)
-                        userData.refreshToken = tokens.refresh;
-                    (0, authCookies_1.applyAccessiAuthCookies)(res, (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options), userData);
-                }
-                const result = userData.challenge
-                    ? 'challenge'
-                    : userData.passwordRequired
-                        ? 'password_required'
-                        : 'success';
-                (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result });
-                if (result === 'success') {
-                    (0, audit_1.auditAccessi)('login_succeeded', {
-                        codiceUtente: (_a = userData.utente) === null || _a === void 0 ? void 0 : _a.codiceUtente,
-                        ip: request.ip,
-                    });
-                }
-                return Utilities_1.RestUtilities.sendBaseResponse(res, userData);
-            }
-            catch (error) {
-                const message = error === null || error === void 0 ? void 0 : error.message;
-                const result = message === 'PASSWORD_EXPIRED'
-                    ? 'password_expired'
-                    : message === AuthService_1.PASSWORD_LOGIN_DISABLED
-                        ? 'sso_only'
-                        : 'error';
-                (0, metrics_1.countAccessiMetric)(this.options, 'auth_login_total', { result });
-                (0, audit_1.auditAccessi)('login_failed', { result, ip: request.ip, emailProvided: Boolean(loginRequest === null || loginRequest === void 0 ? void 0 : loginRequest.email) });
-                if (message === 'PASSWORD_EXPIRED') {
-                    this.logger.warning('Password scaduta, cambiare password ', error);
-                    return Utilities_1.RestUtilities.sendPasswordExpired(res);
-                }
-                if (error instanceof common_1.HttpException) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error.getStatus());
-                }
-                if ((error === null || error === void 0 ? void 0 : error.message) === AuthService_1.PASSWORD_LOGIN_DISABLED) {
-                    return res.status(common_1.HttpStatus.FORBIDDEN).json({
-                        severity: 'error', status: common_1.HttpStatus.FORBIDDEN, statusCode: 2,
-                        code: AuthService_1.PASSWORD_LOGIN_DISABLED,
-                        error: AuthService_1.PASSWORD_LOGIN_DISABLED,
-                        message: 'Questo utente e abilitato solo tramite SSO. Accedi con un provider collegato.',
-                    });
-                }
-                this.logger.error('Errore durante il login', error);
-                if (Utilities_1.RestUtilities.isDatabaseSchemaError(error)) {
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, common_1.HttpStatus.SERVICE_UNAVAILABLE);
-                }
-                return Utilities_1.RestUtilities.sendInvalidCredentials(res);
-            }
-            finally {
-                (0, metrics_1.observeAccessiMetric)(this.options, 'auth_login_duration_ms', Date.now() - startedAt);
-            }
-        });
-    }
-    refresh(request, body, res) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const startedAt = Date.now();
-            try {
-                const cookieConfig = (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options);
-                const cookieRefreshToken = (cookieConfig === null || cookieConfig === void 0 ? void 0 : cookieConfig.refreshFromCookie)
-                    ? (0, authCookies_1.getAccessiRefreshTokenFromCookie)(request.headers.cookie, cookieConfig)
-                    : undefined;
-                const refreshToken = typeof (body === null || body === void 0 ? void 0 : body.refreshToken) === 'string' && body.refreshToken.trim() !== ''
-                    ? body.refreshToken
-                    : cookieRefreshToken;
-                const tokenKey = typeof refreshToken === 'string'
-                    ? (0, crypto_1.createHash)('sha256').update(refreshToken).digest('hex').slice(0, 32)
-                    : undefined;
-                const decision = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'refresh', request, tokenKey ? [tokenKey] : []);
-                if (!decision.allowed) {
-                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_refresh_total', { result: 'rate_limited' });
-                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, decision.retryAfterSeconds);
-                }
-                if (!refreshToken) {
-                    throw new common_1.HttpException('Refresh token mancante.', common_1.HttpStatus.UNAUTHORIZED);
-                }
-                const result = yield this.authService.refreshAccessToken(refreshToken);
-                if (!result.token) {
-                    throw new common_1.HttpException('Refresh token non valido.', common_1.HttpStatus.UNAUTHORIZED);
-                }
-                const response = Object.assign({ token: result.token }, (result.refreshToken ? { refreshToken: result.refreshToken } : {}));
-                (0, authCookies_1.applyAccessiAuthCookies)(res, cookieConfig, response);
-                (0, metrics_1.countAccessiMetric)(this.options, 'auth_refresh_total', { result: 'success' });
-                (0, audit_1.auditAccessi)('refresh_succeeded', { ip: request.ip });
-                return Utilities_1.RestUtilities.sendBaseResponse(res, response);
-            }
-            catch (error) {
-                const code = authErrorCode(error);
-                const result = code === 'ACCESSI_REFRESH_TOKEN_REUSE'
-                    ? 'reuse'
-                    : code === 'ACCESSI_REFRESH_FAMILY_REVOKED'
-                        ? 'family_revoked'
-                        : code === 'ACCESSI_REFRESH_ROTATION_UNAVAILABLE'
-                            ? 'store_unavailable'
-                            : 'invalid';
-                (0, metrics_1.countAccessiMetric)(this.options, 'auth_refresh_total', { result });
-                if (result !== 'reuse')
-                    (0, audit_1.auditAccessi)('refresh_failed', { result, ip: request.ip });
-                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.UNAUTHORIZED);
-            }
-            finally {
-                (0, metrics_1.observeAccessiMetric)(this.options, 'auth_refresh_duration_ms', Date.now() - startedAt);
-            }
-        });
-    }
-    verifyTwoFactor(request, body, res) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const startedAt = Date.now();
-            try {
-                const limit = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'twoFactorVerify', request, [body.challengeId]);
-                if (!limit.allowed) {
-                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'verify', result: 'rate_limited' });
-                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
-                }
-                const result = yield this.authService.verifyTwoFactor(body.challengeId, body.code, body.scope);
-                (0, authCookies_1.applyAccessiAuthCookies)(res, (0, authCookies_1.resolveAccessiAuthCookieOptions)(this.options), result);
-                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'verify', result: 'success' });
-                (0, audit_1.auditAccessi)('two_factor_succeeded', { codiceUtente: (_a = result.utente) === null || _a === void 0 ? void 0 : _a.codiceUtente, ip: request.ip });
-                return Utilities_1.RestUtilities.sendBaseResponse(res, result);
-            }
-            catch (error) {
-                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'verify', result: 'failure' });
-                (0, audit_1.auditAccessi)('two_factor_failed', { ip: request.ip });
-                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
-            }
-            finally {
-                (0, metrics_1.observeAccessiMetric)(this.options, 'auth_two_factor_duration_ms', Date.now() - startedAt, { action: 'verify' });
-            }
-        });
-    }
-    resendTwoFactor(request, body, res) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const limit = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'twoFactorResend', request, [body.challengeId]);
-                if (!limit.allowed) {
-                    (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'resend', result: 'rate_limited' });
-                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
-                }
-                const result = yield this.authService.resendTwoFactor(body.challengeId);
-                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'resend', result: 'success' });
-                return Utilities_1.RestUtilities.sendBaseResponse(res, result);
-            }
-            catch (error) {
-                (0, metrics_1.countAccessiMetric)(this.options, 'auth_two_factor_total', { action: 'resend', result: 'failure' });
-                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
-            }
-        });
-    }
-    bootstrapAdmin(request, body, res) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const limit = yield (0, publicAuthRateLimit_1.checkPublicAuthRateLimit)(this.options, 'adminBootstrap', request);
-                if (!limit.allowed)
-                    return (0, publicAuthRateLimit_1.sendPublicAuthRateLimitExceeded)(res, limit.retryAfterSeconds);
-                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.adminBootstrapService.bootstrap(body));
-            }
-            catch (error) {
-                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AuthController_1.name, error instanceof common_1.HttpException ? error.getStatus() : 500);
-            }
-        });
-    }
-    adminBootstrapStatus(res) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return Utilities_1.RestUtilities.sendBaseResponse(res, { enabled: this.adminBootstrapService.isEnabled() });
-        });
-    }
-};
-exports.AuthController = AuthController;
-__decorate([
-    (0, swagger_1.ApiOperation)({ summary: 'Conferma il reset della password', operationId: 'resetPassword' }),
-    (0, swagger_1.ApiParam)({ name: 'token', description: 'Token per il reset della password', required: true }),
-    (0, swagger_1.ApiBody)({ type: Dtos_1.ConfirmResetPasswordRequest }),
-    (0, swagger_1.ApiResponse)({
-        status: 200,
-        description: 'Password aggiornata con successo',
-        type: Dtos_1.ActionResponse,
-    }),
-    (0, swagger_1.ApiResponse)({
-        status: 400,
-        description: 'Errore nella richiesta o token non valido',
-        type: Dtos_1.ErrorResponse,
-    }),
-    (0, common_1.Post)('confirm-reset-password/:token'),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Res)()),
-    __param(2, (0, common_1.Param)('token')),
-    __param(3, (0, common_1.Body)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Object, String, Dtos_1.ConfirmResetPasswordRequest]),
-    __metadata("design:returntype", Promise)
-], AuthController.prototype, "resetPassword", null);
-__decorate([
-    (0, swagger_1.ApiOperation)({
-        summary: 'Recupera le informazioni utente dal token JWT',
-        operationId: 'getUserByToken',
-    }),
-    (0, swagger_1.ApiBody)({ type: Dtos_1.GetUserByTokenRequest }),
-    (0, swagger_1.ApiResponse)({
-        status: 200,
-        description: 'Informazioni utente recuperate con successo',
-        type: Dtos_1.GetUserByTokenResponse,
-    }),
-    (0, swagger_1.ApiResponse)({
-        status: 401,
-        description: 'Token non valido o scaduto',
-        type: Dtos_1.ErrorResponse,
-    }),
-    (0, common_1.Post)('get-user-by-token'),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Body)()),
-    __param(2, (0, common_1.Res)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Dtos_1.GetUserByTokenRequest, Object]),
-    __metadata("design:returntype", Promise)
-], AuthController.prototype, "getUserByToken", null);
-__decorate([
-    (0, swagger_1.ApiOperation)({
-        summary: 'Revoca tutte le sessioni dell utente corrente',
-        operationId: 'revokeSessions',
-        description: 'Invalida i token emessi prima di questa chiamata. Richiede sessionRevocation.store configurato. I token emessi dopo la revoca restano validi.',
-    }),
-    (0, swagger_1.ApiOkResponse)({ type: Dtos_1.ActionResponse }),
-    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse, description: 'Token Accessi mancante o non valido.' }),
-    (0, swagger_1.ApiResponse)({ status: 501, type: Dtos_1.ErrorResponse, description: 'Revoca sessioni non configurata.' }),
-    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard),
-    (0, common_1.Post)('revoke-sessions'),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Res)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Object]),
-    __metadata("design:returntype", Promise)
-], AuthController.prototype, "revokeSessions", null);
-__decorate([
-    (0, swagger_1.ApiOperation)({
-        summary: 'Revoca un singolo access token tramite jti',
-        operationId: 'revokeToken',
-        description: 'Annulla un solo token (logout del dispositivo corrente o token compromesso) senza toccare le altre sessioni. ' +
-            'Se il body non contiene jti viene revocato il token della richiesta. Richiede accessTokenRevocation.store configurato.',
-    }),
-    (0, swagger_1.ApiBody)({ type: Dtos_1.RevokeTokenRequest }),
-    (0, swagger_1.ApiOkResponse)({ type: Dtos_1.ActionResponse }),
-    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse, description: 'Token Accessi mancante o non valido.' }),
-    (0, swagger_1.ApiResponse)({ status: 403, type: Dtos_1.ErrorResponse, description: 'Non autorizzato a revocare il token indicato.' }),
-    (0, swagger_1.ApiResponse)({ status: 501, type: Dtos_1.ErrorResponse, description: 'Revoca token non configurata.' }),
-    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard),
-    (0, common_1.Post)('revoke-token'),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Body)()),
-    __param(2, (0, common_1.Res)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Dtos_1.RevokeTokenRequest, Object]),
-    __metadata("design:returntype", Promise)
-], AuthController.prototype, "revokeToken", null);
-__decorate([
-    (0, swagger_1.ApiOperation)({
-        summary: 'Effettua il login utente',
-        description: "Con sola email restituisce passwordRequired oppure avvia il codice per utenti passwordless. Con password valida restituisce il login completo o challenge se la 2FA e attiva. Nessun JWT viene emesso prima della verifica del codice.",
-        operationId: 'login',
-    }),
-    (0, swagger_1.ApiBody)({ type: Dtos_1.LoginRequest }),
-    (0, swagger_1.ApiResponse)({
-        status: 200,
-        description: 'Login effettuato con successo',
-        type: Dtos_1.LoginResponse,
-    }),
-    (0, swagger_1.ApiResponse)({
-        status: 401,
-        description: 'Credenziali non valide',
-        type: Dtos_1.ErrorResponse,
-    }),
-    (0, swagger_1.ApiResponse)({
-        status: 403,
-        description: 'Password scaduta, e necessario aggiornarla.',
-        type: Dtos_1.PasswordExpiredResponse,
-    }),
-    (0, swagger_1.ApiResponse)({ status: 403, description: 'Utente abilitato solo a SSO.', type: Dtos_1.ErrorResponse }),
-    (0, common_1.Post)('login'),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Body)()),
-    __param(2, (0, common_1.Res)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Dtos_1.LoginRequest, Object]),
-    __metadata("design:returntype", Promise)
-], AuthController.prototype, "login", null);
-__decorate([
-    (0, swagger_1.ApiOperation)({
-        summary: 'Scambia un refresh token con un nuovo access token',
-        operationId: 'refreshAccessToken',
-        description: 'Richiede jwtOptions.refreshExpiresIn. Il refresh token ha typ=refresh e non e accettato dai guard API.',
-    }),
-    (0, swagger_1.ApiBody)({ type: Dtos_1.RefreshTokenRequest }),
-    (0, swagger_1.ApiOkResponse)({ type: Dtos_1.RefreshTokenResponse }),
-    (0, swagger_1.ApiResponse)({ status: 401, description: 'Refresh token non valido, scaduto o revocato.', type: Dtos_1.ErrorResponse }),
-    (0, swagger_1.ApiResponse)({ status: 429, description: 'Troppi tentativi.', type: Dtos_1.ErrorResponse }),
-    (0, common_1.Post)('refresh'),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Body)()),
-    __param(2, (0, common_1.Res)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Dtos_1.RefreshTokenRequest, Object]),
-    __metadata("design:returntype", Promise)
-], AuthController.prototype, "refresh", null);
-__decorate([
-    (0, common_1.Post)('two-factor/verify'),
-    (0, swagger_1.ApiOperation)({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' }),
-    (0, swagger_1.ApiBody)({ type: TwoFactorDtos_1.VerifyTwoFactorRequest }),
-    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.LoginResponse }),
-    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse }),
-    (0, swagger_1.ApiResponse)({ status: 429, type: Dtos_1.ErrorResponse }),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Body)()),
-    __param(2, (0, common_1.Res)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, TwoFactorDtos_1.VerifyTwoFactorRequest, Object]),
-    __metadata("design:returntype", Promise)
-], AuthController.prototype, "verifyTwoFactor", null);
-__decorate([
-    (0, common_1.Post)('two-factor/resend'),
-    (0, swagger_1.ApiOperation)({ summary: 'Reinvia il codice, invalidando il precedente', operationId: 'resendTwoFactor' }),
-    (0, swagger_1.ApiBody)({ type: TwoFactorDtos_1.ResendTwoFactorRequest }),
-    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.LoginResponse }),
-    (0, swagger_1.ApiResponse)({ status: 401, type: Dtos_1.ErrorResponse }),
-    (0, swagger_1.ApiResponse)({ status: 429, type: Dtos_1.ErrorResponse }),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Body)()),
-    __param(2, (0, common_1.Res)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, TwoFactorDtos_1.ResendTwoFactorRequest, Object]),
-    __metadata("design:returntype", Promise)
-], AuthController.prototype, "resendTwoFactor", null);
-__decorate([
-    (0, common_1.Post)('bootstrap-admin'),
-    (0, swagger_1.ApiOperation)({
-        summary: 'Crea il primo utente admin (bootstrap)',
-        operationId: 'bootstrapAdmin',
-        description: 'Endpoint pubblico ma protetto dal token di avvio: attivo solo con adminBootstrap.enabled. ' +
-            'Crea un utente in stato confermato senza email, con flag admin (e super opzionale) e password fornita o generata.',
-    }),
-    (0, swagger_1.ApiBody)({ type: Dtos_1.BootstrapAdminRequest }),
-    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.BootstrapAdminResponse }),
-    (0, swagger_1.ApiResponse)({ status: 401, description: 'Token di bootstrap non valido', type: Dtos_1.ErrorResponse }),
-    (0, swagger_1.ApiResponse)({ status: 403, description: 'Bootstrap admin non abilitato', type: Dtos_1.ErrorResponse }),
-    (0, swagger_1.ApiResponse)({ status: 429, description: 'Troppi tentativi', type: Dtos_1.ErrorResponse }),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Body)()),
-    __param(2, (0, common_1.Res)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Dtos_1.BootstrapAdminRequest, Object]),
-    __metadata("design:returntype", Promise)
-], AuthController.prototype, "bootstrapAdmin", null);
-__decorate([
-    (0, common_1.Get)('bootstrap-admin/status'),
-    (0, swagger_1.ApiOperation)({
-        summary: 'Indica se il bootstrap admin e abilitato',
-        operationId: 'getAdminBootstrapStatus',
-        description: 'Endpoint pubblico: la console mostra la sezione "Crea utente admin" solo quando enabled e true.',
-    }),
-    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.AdminBootstrapStatusResponse }),
-    __param(0, (0, common_1.Res)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
-    __metadata("design:returntype", Promise)
-], AuthController.prototype, "adminBootstrapStatus", null);
-exports.AuthController = AuthController = AuthController_1 = __decorate([
-    (0, swagger_1.ApiTags)('Auth'),
-    (0, common_1.Controller)('accessi/auth') /**
-     * Endpoint pubblici di autenticazione locale e verifica sessione.
-     * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.
-     */,
-    __param(2, (0, common_1.Inject)('ACCESSI_OPTIONS')),
-    __metadata("design:paramtypes", [AuthService_1.AuthService,
-        AdminBootstrapService_1.AdminBootstrapService, Object])
-], AuthController);
-//# sourceMappingURL=AuthController.js.map