emilsoftware-utilities 2.0.0-dev.84 → 2.0.0-dev.85

package/dist/accessi-service/federated-auth/FederatedAuthController.d.ts

@@ -0,0 +1,33 @@
+import { Request, Response } from 'express';
+import { CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, SetPasswordLoginPolicyRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest } from '../dtos/FederatedIdentityDtos';
+import { UserService } from '../services/user-service/UserService';
+import { FederatedAuthService } from './FederatedAuthService';
+/**
+ * Master-only administration API. Authentication itself is intentionally not
+ * exposed over HTTP: the hosting backend validates its SSO and calls
+ * FederatedAuthService.authenticate({ provider, subject }) directly.
+ */
+export declare class FederatedAuthController {
+    private readonly federatedAuthService;
+    private readonly userService;
+    constructor(federatedAuthService: FederatedAuthService, userService: UserService);
+    /**
+     * Verifica che l'attore possa gestire il target (ADMIN > SUPER > utente):
+     * un superutente non puo' toccare le identita SSO di un admin.
+     */
+    private ensureManageableTarget;
+    /** Risolve il proprietario di un'identita SSO e verifica che l'attore possa gestirlo. */
+    private ensureManageableIdentity;
+    getProviders(request: Request, res: Response): Promise<Response<any, Record<string, any>>>;
+    createProvider(request: Request, body: CreateFederatedProviderRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    updateProvider(request: Request, provider: string, body: UpdateFederatedProviderRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    deleteProvider(request: Request, provider: string, res: Response): Promise<Response<any, Record<string, any>>>;
+    getIdentities(request: Request, codiceUtente: number, res: Response): Promise<Response<any, Record<string, any>>>;
+    linkIdentity(request: Request, codiceUtente: number, body: CreateFederatedIdentityRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    createUser(request: Request, body: CreateFederatedUserRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    setPasswordPolicy(request: Request, codiceUtente: number, body: SetPasswordLoginPolicyRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    disableIdentity(request: Request, identityKey: string, res: Response): Promise<Response<any, Record<string, any>>>;
+    deleteIdentity(request: Request, codiceUtente: number, identityKey: string, res: Response): Promise<Response<any, Record<string, any>>>;
+    updateIdentity(request: Request, identityKey: string, body: UpdateFederatedIdentityRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    private sendError;
+}

package/dist/accessi-service/federated-auth/FederatedAuthController.js

@@ -0,0 +1,373 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var FederatedAuthController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FederatedAuthController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const Utilities_1 = require("../../Utilities");
+const BaseResponse_1 = require("../dtos/BaseResponse");
+const FederatedIdentityDtos_1 = require("../dtos/FederatedIdentityDtos");
+const JwtSimpleGuard_1 = require("../jwt/JwtSimpleGuard");
+const accessControl_1 = require("../security/accessControl");
+const UserService_1 = require("../services/user-service/UserService");
+const FederatedAuthService_1 = require("./FederatedAuthService");
+/**
+ * Master-only administration API. Authentication itself is intentionally not
+ * exposed over HTTP: the hosting backend validates its SSO and calls
+ * FederatedAuthService.authenticate({ provider, subject }) directly.
+ */
+let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthController {
+    constructor(federatedAuthService, userService) {
+        this.federatedAuthService = federatedAuthService;
+        this.userService = userService;
+    }
+    /**
+     * Verifica che l'attore possa gestire il target (ADMIN > SUPER > utente):
+     * un superutente non puo' toccare le identita SSO di un admin.
+     */
+    ensureManageableTarget(actor, codiceUtente) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const target = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
+            if (!target) {
+                throw new common_1.NotFoundException(`Nessun utente con codice ${codiceUtente}.`);
+            }
+            (0, accessControl_1.ensureCanManageTargetUser)(actor, target);
+        });
+    }
+    /** Risolve il proprietario di un'identita SSO e verifica che l'attore possa gestirlo. */
+    ensureManageableIdentity(actor, identityKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const owner = yield this.federatedAuthService.getIdentityOwner(identityKey);
+            if (!owner) {
+                throw new common_1.NotFoundException('Collegamento SSO non trovato.');
+            }
+            yield this.ensureManageableTarget(actor, owner);
+        });
+    }
+    getProviders(request, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                // Lettura del catalogo provider: serve anche al superutente per creare utenti SSO.
+                // La modifica del catalogo resta riservata agli admin.
+                (0, accessControl_1.ensureUserManagement)((0, accessControl_1.getAuthenticatedAccessiUser)(request), 'Solo gli amministratori possono leggere i provider SSO.');
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.getProviders());
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    createProvider(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.createProvider(body), common_1.HttpStatus.CREATED);
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    updateProvider(request, provider, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.updateProvider(provider, body));
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    deleteProvider(request, provider, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                yield this.federatedAuthService.deleteProvider(provider);
+                return Utilities_1.RestUtilities.sendOKMessage(res, `Provider SSO ${provider} eliminato.`);
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    getIdentities(request, codiceUtente, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureUserManagement)((0, accessControl_1.getAuthenticatedAccessiUser)(request), 'Solo gli amministratori possono leggere le identita SSO.');
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.getUserIdentities(codiceUtente));
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    linkIdentity(request, codiceUtente, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                (0, accessControl_1.ensureUserManagement)(authenticatedUser, 'Solo gli amministratori possono collegare identita SSO.');
+                yield this.ensureManageableTarget(authenticatedUser, codiceUtente);
+                const identity = yield this.federatedAuthService.linkIdentity(codiceUtente, body, body.note);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, identity, common_1.HttpStatus.CREATED);
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    createUser(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                (0, accessControl_1.ensureUserManagement)(authenticatedUser, 'Solo gli amministratori possono creare utenti SSO.');
+                (0, accessControl_1.ensurePrivilegeFlagChanges)(authenticatedUser, body.user);
+                const identity = yield this.federatedAuthService.createManagedFederatedUser(body.user, body, body.passwordLoginEnabled === true, body.note);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, identity, common_1.HttpStatus.CREATED);
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    setPasswordPolicy(request, codiceUtente, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                (0, accessControl_1.ensureUserManagement)(authenticatedUser, 'Solo gli amministratori possono modificare la policy di accesso.');
+                yield this.ensureManageableTarget(authenticatedUser, codiceUtente);
+                yield this.federatedAuthService.setPasswordLoginEnabled(codiceUtente, body.passwordLoginEnabled);
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Policy di autenticazione aggiornata.');
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    disableIdentity(request, identityKey, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                (0, accessControl_1.ensureUserManagement)(authenticatedUser, 'Solo gli amministratori possono disabilitare identita SSO.');
+                yield this.ensureManageableIdentity(authenticatedUser, identityKey);
+                yield this.federatedAuthService.disableIdentity(identityKey);
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Identita SSO disabilitata.');
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    deleteIdentity(request, codiceUtente, identityKey, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                (0, accessControl_1.ensureUserManagement)(authenticatedUser, 'Solo gli amministratori possono eliminare collegamenti SSO.');
+                yield this.ensureManageableTarget(authenticatedUser, codiceUtente);
+                yield this.federatedAuthService.deleteIdentity(codiceUtente, identityKey);
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Collegamento SSO eliminato definitivamente.');
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    updateIdentity(request, identityKey, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                (0, accessControl_1.ensureUserManagement)(authenticatedUser, 'Solo gli amministratori possono aggiornare collegamenti SSO.');
+                yield this.ensureManageableIdentity(authenticatedUser, identityKey);
+                yield this.federatedAuthService.updateIdentity(identityKey, body);
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Collegamento SSO aggiornato.');
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    sendError(res, error) {
+        const status = error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.INTERNAL_SERVER_ERROR;
+        return Utilities_1.RestUtilities.sendErrorMessage(res, error, FederatedAuthController_1.name, status);
+    }
+};
+exports.FederatedAuthController = FederatedAuthController;
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Elenca i provider SSO censiti', operationId: 'getFederatedProviders', description: 'Riservato a superutente. Restituisce solo catalogo e stato Accessi; issuer, secret e configurazioni SSO restano nel backend.' }),
+    (0, swagger_1.ApiOkResponse)({ type: FederatedIdentityDtos_1.FederatedProviderListResponse }),
+    (0, common_1.Get)('providers'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "getProviders", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Censisce un provider SSO', operationId: 'createFederatedProvider', description: 'Riservato a superutente. La chiave provider deve corrispondere alla configurazione stabile del backend; non salvare segreti, issuer o token.' }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.CreateFederatedProviderRequest }),
+    (0, swagger_1.ApiCreatedResponse)({ type: FederatedIdentityDtos_1.FederatedProviderResponse }),
+    (0, common_1.Post)('providers'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, FederatedIdentityDtos_1.CreateFederatedProviderRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "createProvider", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider è immutabile: disabilitarla blocca nuovi login SSO ma conserva i collegamenti storici.' }),
+    (0, swagger_1.ApiParam)({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.UpdateFederatedProviderRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: FederatedIdentityDtos_1.FederatedProviderResponse }),
+    (0, common_1.Patch)('providers/:provider'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('provider')),
+    __param(2, (0, common_1.Body)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, FederatedIdentityDtos_1.UpdateFederatedProviderRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "updateProvider", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Elimina un provider SSO', operationId: 'deleteFederatedProvider', description: 'Riservato a superutente. Consentito solo se nessuna identita e collegata al provider; in alternativa disabilitalo.' }),
+    (0, swagger_1.ApiParam)({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' }),
+    (0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 404, type: BaseResponse_1.ErrorResponse, description: 'Provider non registrato.' }),
+    (0, swagger_1.ApiResponse)({ status: 409, type: BaseResponse_1.ErrorResponse, description: 'Provider ancora utilizzato da identita collegate.' }),
+    (0, common_1.Delete)('providers/:provider'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('provider')),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "deleteProvider", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Elenca le identita SSO di un utente', operationId: 'getFederatedIdentities', description: 'Riservato a superutente. Non restituisce token esterni o claim del provider.' }),
+    (0, swagger_1.ApiParam)({ name: 'codiceUtente', example: 123 }),
+    (0, swagger_1.ApiOkResponse)({ type: FederatedIdentityDtos_1.FederatedIdentityListResponse }),
+    (0, swagger_1.ApiResponse)({ status: 403, type: BaseResponse_1.ErrorResponse }),
+    (0, common_1.Get)('users/:codiceUtente/identities'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('codiceUtente', common_1.ParseIntPipe)),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Number, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "getIdentities", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Associa un SSO gia verificato a un utente esistente', operationId: 'linkFederatedIdentity', description: 'Il master deve fornire un provider e subject ottenuti da una verifica SSO lato backend; questo endpoint non verifica token esterni.' }),
+    (0, swagger_1.ApiParam)({ name: 'codiceUtente', example: 123 }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.CreateFederatedIdentityRequest }),
+    (0, swagger_1.ApiCreatedResponse)({ type: FederatedIdentityDtos_1.FederatedIdentityResponse }),
+    (0, common_1.Post)('users/:codiceUtente/identities'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('codiceUtente', common_1.ParseIntPipe)),
+    __param(2, (0, common_1.Body)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Number, FederatedIdentityDtos_1.CreateFederatedIdentityRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "linkIdentity", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Crea un utente gestito e SSO-only', operationId: 'createFederatedUser', description: 'Riservato a superutente. L utente nasce confermato, con identita collegata e senza password salvo opt-in esplicito.' }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.CreateFederatedUserRequest }),
+    (0, swagger_1.ApiCreatedResponse)({ type: FederatedIdentityDtos_1.FederatedIdentityResponse }),
+    (0, swagger_1.ApiResponse)({ status: 400, type: BaseResponse_1.ErrorResponse, description: 'Provider o subject non validi.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, type: BaseResponse_1.ErrorResponse, description: 'Provider SSO non censito.' }),
+    (0, swagger_1.ApiResponse)({ status: 409, type: BaseResponse_1.ErrorResponse, description: 'Email o identità SSO già associate a un utente.' }),
+    (0, swagger_1.ApiResponse)({ status: 503, type: BaseResponse_1.ErrorResponse, description: 'Schema Accessi non aggiornato.' }),
+    (0, swagger_1.ApiResponse)({ status: 500, type: BaseResponse_1.ErrorResponse, description: 'Errore inatteso durante il provisioning; la risposta contiene FEDERATED_USER_PROVISIONING_FAILED.' }),
+    (0, common_1.Post)('users'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, FederatedIdentityDtos_1.CreateFederatedUserRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "createUser", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Abilita o disabilita il login con password', operationId: 'setPasswordLoginPolicy', description: 'Con false il login locale restituisce PASSWORD_LOGIN_DISABLED; le identita SSO attive restano utilizzabili.' }),
+    (0, swagger_1.ApiParam)({ name: 'codiceUtente', example: 123 }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.SetPasswordLoginPolicyRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
+    (0, common_1.Patch)('users/:codiceUtente/password-login'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('codiceUtente', common_1.ParseIntPipe)),
+    __param(2, (0, common_1.Body)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Number, FederatedIdentityDtos_1.SetPasswordLoginPolicyRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "setPasswordPolicy", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Disabilita un identita SSO', operationId: 'disableFederatedIdentity', description: 'Soft delete: l associazione resta tracciata ma non puo piu autenticare.' }),
+    (0, swagger_1.ApiParam)({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' }),
+    (0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
+    (0, common_1.Delete)('identities/:identityKey'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('identityKey')),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "disableIdentity", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall’utente, senza eliminare l’utente Accessi.' }),
+    (0, swagger_1.ApiParam)({ name: 'codiceUtente', example: 123 }),
+    (0, swagger_1.ApiParam)({ name: 'identityKey', description: 'SHA-256 del collegamento da eliminare.' }),
+    (0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 404, type: BaseResponse_1.ErrorResponse, description: 'Collegamento assente o non appartenente all’utente.' }),
+    (0, common_1.Delete)('users/:codiceUtente/identities/:identityKey'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('codiceUtente', common_1.ParseIntPipe)),
+    __param(2, (0, common_1.Param)('identityKey')),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Number, String, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "deleteIdentity", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Aggiorna un collegamento SSO', operationId: 'updateFederatedIdentity', description: 'Consente di modificare nota e stato attivo del collegamento. identityKey e una chiave tecnica, non un token SSO.' }),
+    (0, swagger_1.ApiParam)({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.UpdateFederatedIdentityRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
+    (0, common_1.Patch)('identities/:identityKey'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('identityKey')),
+    __param(2, (0, common_1.Body)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, FederatedIdentityDtos_1.UpdateFederatedIdentityRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "updateIdentity", null);
+exports.FederatedAuthController = FederatedAuthController = FederatedAuthController_1 = __decorate([
+    (0, swagger_1.ApiTags)('Federated authentication'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.UseGuards)(JwtSimpleGuard_1.JwtSimpleGuard),
+    (0, common_1.Controller)('accessi/federated-auth'),
+    __metadata("design:paramtypes", [FederatedAuthService_1.FederatedAuthService,
+        UserService_1.UserService])
+], FederatedAuthController);
+//# sourceMappingURL=FederatedAuthController.js.map

package/dist/accessi-service/federated-auth/FederatedAuthController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedAuthController.js","sourceRoot":"","sources":["../../../src/accessi-service/federated-auth/FederatedAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoK;AACpK,6CAA0I;AAE1I,+CAAgD;AAChD,uDAAqE;AACrE,yEAA8V;AAC9V,0DAAuD;AACvD,6DAAkK;AAElK,sEAAmE;AACnE,iEAA8D;AAE9D;;;;GAIG;AAKI,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,YACmB,oBAA0C,EAC1C,WAAwB;QADxB,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ;;;OAGG;IACW,sBAAsB,CAClC,KAA+B,EAC/B,YAAoB;;YAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAAiB,CAAC,4BAA4B,YAAY,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,IAAA,yCAAyB,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;KAAA;IAED,yFAAyF;IAC3E,wBAAwB,CACpC,KAA+B,EAC/B,WAAmB;;YAEnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,0BAAiB,CAAC,+BAA+B,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;KAAA;IAKK,YAAY,CAAQ,OAAgB,EAAS,GAAa;;YAC9D,IAAI,CAAC;gBACH,mFAAmF;gBACnF,uDAAuD;gBACvD,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,yDAAyD,CAC1D,CAAC;gBACF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,cAAc,CAAQ,OAAgB,EAAU,IAAoC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YACvH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAU,IAAoC,EAAS,GAAa;;YACnJ,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACzD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,QAAQ,aAAa,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,aAAa,CAAQ,OAAgB,EAAuC,YAAoB,EAAS,GAAa;;YAC1H,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,0DAA0D,CAC3D,CAAC;gBACF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,YAAY,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAoC,EAAS,GAAa;;YACvK,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;gBACnG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAWK,UAAU,CAAQ,OAAgB,EAAU,IAAgC,EAAS,GAAa;;YACtG,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAAC;gBAC9F,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,iBAAiB,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAmC,EAAS,GAAa;;YAC3K,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,kEAAkE,CAAC,CAAC;gBAC5G,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACjG,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,eAAe,CAAQ,OAAgB,EAAwB,WAAmB,EAAS,GAAa;;YAC5G,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,4DAA4D,CAAC,CAAC;gBACtG,MAAM,IAAI,CAAC,wBAAwB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBACpE,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC7D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAuC,YAAoB,EAAwB,WAAmB,EAAS,GAAa;;YACtK,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,6DAA6D,CAAC,CAAC;gBACvG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAC1E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAwB,WAAmB,EAAU,IAAoC,EAAS,GAAa;;YACzJ,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,8DAA8D,CAAC,CAAC;gBACxG,MAAM,IAAI,CAAC,wBAAwB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBACpE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAEO,SAAS,CAAC,GAAa,EAAE,KAAc;QAC7C,MAAM,MAAM,GAAG,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACrG,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;CACF,CAAA;AA5NY,0DAAuB;AAoC5B;IAHL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,8HAA8H,EAAE,CAAC;IAC7O,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,YAAG,EAAC,WAAW,CAAC;IACG,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAYjD;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,8IAA8I,EAAE,CAAC;IAC1P,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,WAAW,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAtC,sDAA8B;;6DAOzF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oIAAoI,EAAE,CAAC;IAC7P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IAClD,IAAA,cAAK,EAAC,qBAAqB,CAAC;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAO9H;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC/N,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC1F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;IACnH,IAAA,eAAM,EAAC,qBAAqB,CAAC;IACR,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQxF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;IACpM,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACjD,IAAA,YAAG,EAAC,gCAAgC,CAAC;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4DAU7G;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;IAC1Q,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,gCAAgC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;2DAUlJ;AAWK;IATL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,qHAAqH,EAAE,CAAC;IACtO,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kDAA0B,EAAE,CAAC;IAC7C,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IACjH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mGAAmG,EAAE,CAAC;IACnK,IAAA,aAAI,EAAC,OAAO,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAlC,kDAA0B;;yDAUjF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,6GAA6G,EAAE,CAAC;IAC1O,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,oCAAoC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAuC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAArC,qDAA6B;;gEAUtJ;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,0BAA0B,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IACxL,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,eAAM,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAU/F;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,oCAAoC,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC9P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACxF,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IACrH,IAAA,eAAM,EAAC,6CAA6C,CAAC;IAChC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAUzJ;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,kHAAkH,EAAE,CAAC;IAClO,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAUpI;kCAtNU,uBAAuB;IAJnC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,+BAAc,CAAC;IACzB,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAGM,2CAAoB;QAC7B,yBAAW;GAHhC,uBAAuB,CA4NnC","sourcesContent":["import { Body, Controller, Delete, Get, HttpException, HttpStatus, NotFoundException, Param, ParseIntPipe, Patch, Post, Req, Res, UseGuards } from '@nestjs/common';\nimport { ApiBearerAuth, ApiBody, ApiCreatedResponse, ApiOkResponse, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport { ActionResponse, ErrorResponse } from '../dtos/BaseResponse';\nimport { CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, FederatedIdentityListResponse, FederatedIdentityResponse, FederatedProviderListResponse, FederatedProviderResponse, SetPasswordLoginPolicyRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest } from '../dtos/FederatedIdentityDtos';\nimport { JwtSimpleGuard } from '../jwt/JwtSimpleGuard';\nimport { ensureAdmin, ensureCanManageTargetUser, ensurePrivilegeFlagChanges, ensureUserManagement, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport type { AuthenticatedAccessiUser } from '../security/accessControl';\nimport { UserService } from '../services/user-service/UserService';\nimport { FederatedAuthService } from './FederatedAuthService';\n\n/**\n * Master-only administration API. Authentication itself is intentionally not\n * exposed over HTTP: the hosting backend validates its SSO and calls\n * FederatedAuthService.authenticate({ provider, subject }) directly.\n */\n@ApiTags('Federated authentication')\n@ApiBearerAuth()\n@UseGuards(JwtSimpleGuard)\n@Controller('accessi/federated-auth')\nexport class FederatedAuthController {\n  constructor(\n    private readonly federatedAuthService: FederatedAuthService,\n    private readonly userService: UserService,\n  ) {}\n\n  /**\n   * Verifica che l'attore possa gestire il target (ADMIN > SUPER > utente):\n   * un superutente non puo' toccare le identita SSO di un admin.\n   */\n  private async ensureManageableTarget(\n    actor: AuthenticatedAccessiUser,\n    codiceUtente: number,\n  ): Promise<void> {\n    const target = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!target) {\n      throw new NotFoundException(`Nessun utente con codice ${codiceUtente}.`);\n    }\n    ensureCanManageTargetUser(actor, target);\n  }\n\n  /** Risolve il proprietario di un'identita SSO e verifica che l'attore possa gestirlo. */\n  private async ensureManageableIdentity(\n    actor: AuthenticatedAccessiUser,\n    identityKey: string,\n  ): Promise<void> {\n    const owner = await this.federatedAuthService.getIdentityOwner(identityKey);\n    if (!owner) {\n      throw new NotFoundException('Collegamento SSO non trovato.');\n    }\n    await this.ensureManageableTarget(actor, owner);\n  }\n\n  @ApiOperation({ summary: 'Elenca i provider SSO censiti', operationId: 'getFederatedProviders', description: 'Riservato a superutente. Restituisce solo catalogo e stato Accessi; issuer, secret e configurazioni SSO restano nel backend.' })\n  @ApiOkResponse({ type: FederatedProviderListResponse })\n  @Get('providers')\n  async getProviders(@Req() request: Request, @Res() res: Response) {\n    try {\n      // Lettura del catalogo provider: serve anche al superutente per creare utenti SSO.\n      // La modifica del catalogo resta riservata agli admin.\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono leggere i provider SSO.',\n      );\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getProviders());\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Censisce un provider SSO', operationId: 'createFederatedProvider', description: 'Riservato a superutente. La chiave provider deve corrispondere alla configurazione stabile del backend; non salvare segreti, issuer o token.' })\n  @ApiBody({ type: CreateFederatedProviderRequest })\n  @ApiCreatedResponse({ type: FederatedProviderResponse })\n  @Post('providers')\n  async createProvider(@Req() request: Request, @Body() body: CreateFederatedProviderRequest, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.createProvider(body), HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider è immutabile: disabilitarla blocca nuovi login SSO ma conserva i collegamenti storici.' })\n  @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n  @ApiBody({ type: UpdateFederatedProviderRequest })\n  @ApiOkResponse({ type: FederatedProviderResponse })\n  @Patch('providers/:provider')\n  async updateProvider(@Req() request: Request, @Param('provider') provider: string, @Body() body: UpdateFederatedProviderRequest, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.updateProvider(provider, body));\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Elimina un provider SSO', operationId: 'deleteFederatedProvider', description: 'Riservato a superutente. Consentito solo se nessuna identita e collegata al provider; in alternativa disabilitalo.' })\n  @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n  @ApiOkResponse({ type: ActionResponse })\n  @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider non registrato.' })\n  @ApiResponse({ status: 409, type: ErrorResponse, description: 'Provider ancora utilizzato da identita collegate.' })\n  @Delete('providers/:provider')\n  async deleteProvider(@Req() request: Request, @Param('provider') provider: string, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      await this.federatedAuthService.deleteProvider(provider);\n      return RestUtilities.sendOKMessage(res, `Provider SSO ${provider} eliminato.`);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Elenca le identita SSO di un utente', operationId: 'getFederatedIdentities', description: 'Riservato a superutente. Non restituisce token esterni o claim del provider.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiOkResponse({ type: FederatedIdentityListResponse })\n  @ApiResponse({ status: 403, type: ErrorResponse })\n  @Get('users/:codiceUtente/identities')\n  async getIdentities(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Res() res: Response) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono leggere le identita SSO.',\n      );\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getUserIdentities(codiceUtente));\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Associa un SSO gia verificato a un utente esistente', operationId: 'linkFederatedIdentity', description: 'Il master deve fornire un provider e subject ottenuti da una verifica SSO lato backend; questo endpoint non verifica token esterni.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiBody({ type: CreateFederatedIdentityRequest })\n  @ApiCreatedResponse({ type: FederatedIdentityResponse })\n  @Post('users/:codiceUtente/identities')\n  async linkIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: CreateFederatedIdentityRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono collegare identita SSO.');\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      const identity = await this.federatedAuthService.linkIdentity(codiceUtente, body, body.note);\n      return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Crea un utente gestito e SSO-only', operationId: 'createFederatedUser', description: 'Riservato a superutente. L utente nasce confermato, con identita collegata e senza password salvo opt-in esplicito.' })\n  @ApiBody({ type: CreateFederatedUserRequest })\n  @ApiCreatedResponse({ type: FederatedIdentityResponse })\n  @ApiResponse({ status: 400, type: ErrorResponse, description: 'Provider o subject non validi.' })\n  @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider SSO non censito.' })\n  @ApiResponse({ status: 409, type: ErrorResponse, description: 'Email o identità SSO già associate a un utente.' })\n  @ApiResponse({ status: 503, type: ErrorResponse, description: 'Schema Accessi non aggiornato.' })\n  @ApiResponse({ status: 500, type: ErrorResponse, description: 'Errore inatteso durante il provisioning; la risposta contiene FEDERATED_USER_PROVISIONING_FAILED.' })\n  @Post('users')\n  async createUser(@Req() request: Request, @Body() body: CreateFederatedUserRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono creare utenti SSO.');\n      ensurePrivilegeFlagChanges(authenticatedUser, body.user);\n      const identity = await this.federatedAuthService.createManagedFederatedUser(body.user, body, body.passwordLoginEnabled === true, body.note);\n      return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Abilita o disabilita il login con password', operationId: 'setPasswordLoginPolicy', description: 'Con false il login locale restituisce PASSWORD_LOGIN_DISABLED; le identita SSO attive restano utilizzabili.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiBody({ type: SetPasswordLoginPolicyRequest })\n  @ApiOkResponse({ type: ActionResponse })\n  @Patch('users/:codiceUtente/password-login')\n  async setPasswordPolicy(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: SetPasswordLoginPolicyRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono modificare la policy di accesso.');\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      await this.federatedAuthService.setPasswordLoginEnabled(codiceUtente, body.passwordLoginEnabled);\n      return RestUtilities.sendOKMessage(res, 'Policy di autenticazione aggiornata.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Disabilita un identita SSO', operationId: 'disableFederatedIdentity', description: 'Soft delete: l associazione resta tracciata ma non puo piu autenticare.' })\n  @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n  @ApiOkResponse({ type: ActionResponse })\n  @Delete('identities/:identityKey')\n  async disableIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono disabilitare identita SSO.');\n      await this.ensureManageableIdentity(authenticatedUser, identityKey);\n      await this.federatedAuthService.disableIdentity(identityKey);\n      return RestUtilities.sendOKMessage(res, 'Identita SSO disabilitata.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall’utente, senza eliminare l’utente Accessi.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiParam({ name: 'identityKey', description: 'SHA-256 del collegamento da eliminare.' })\n  @ApiOkResponse({ type: ActionResponse })\n  @ApiResponse({ status: 404, type: ErrorResponse, description: 'Collegamento assente o non appartenente all’utente.' })\n  @Delete('users/:codiceUtente/identities/:identityKey')\n  async deleteIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Param('identityKey') identityKey: string, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono eliminare collegamenti SSO.');\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      await this.federatedAuthService.deleteIdentity(codiceUtente, identityKey);\n      return RestUtilities.sendOKMessage(res, 'Collegamento SSO eliminato definitivamente.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Aggiorna un collegamento SSO', operationId: 'updateFederatedIdentity', description: 'Consente di modificare nota e stato attivo del collegamento. identityKey e una chiave tecnica, non un token SSO.' })\n  @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n  @ApiBody({ type: UpdateFederatedIdentityRequest })\n  @ApiOkResponse({ type: ActionResponse })\n  @Patch('identities/:identityKey')\n  async updateIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Body() body: UpdateFederatedIdentityRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono aggiornare collegamenti SSO.');\n      await this.ensureManageableIdentity(authenticatedUser, identityKey);\n      await this.federatedAuthService.updateIdentity(identityKey, body);\n      return RestUtilities.sendOKMessage(res, 'Collegamento SSO aggiornato.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  private sendError(res: Response, error: unknown) {\n    const status = error instanceof HttpException ? error.getStatus() : HttpStatus.INTERNAL_SERVER_ERROR;\n    return RestUtilities.sendErrorMessage(res, error, FederatedAuthController.name, status);\n  }\n}\n"]}

package/dist/accessi-service/federated-auth/FederatedAuthExchangeController.d.ts

@@ -0,0 +1,15 @@
+import { Response } from 'express';
+import { ExchangeFederatedIdentityRequest } from '../dtos';
+import { FederatedAuthService } from './FederatedAuthService';
+/**
+ * Scambio service-to-service di un'identita SSO gia verificata.
+ *
+ * Il backend fratello valida il token del provider e chiama questo endpoint con
+ * `{ provider, subject }`; Accessi restituisce la sessione interna e il JWT.
+ * Non e un endpoint browser: richiede un service token con scope dedicato.
+ */
+export declare class FederatedAuthExchangeController {
+    private readonly federatedAuthService;
+    constructor(federatedAuthService: FederatedAuthService);
+    exchange(body: ExchangeFederatedIdentityRequest, res: Response): Promise<Response>;
+}

package/dist/accessi-service/federated-auth/FederatedAuthExchangeController.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var FederatedAuthExchangeController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FederatedAuthExchangeController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const Utilities_1 = require("../../Utilities");
+const dtos_1 = require("../dtos");
+const serviceTokenGuard_1 = require("../security/serviceTokenGuard");
+const FederatedAuthService_1 = require("./FederatedAuthService");
+/**
+ * Scambio service-to-service di un'identita SSO gia verificata.
+ *
+ * Il backend fratello valida il token del provider e chiama questo endpoint con
+ * `{ provider, subject }`; Accessi restituisce la sessione interna e il JWT.
+ * Non e un endpoint browser: richiede un service token con scope dedicato.
+ */
+let FederatedAuthExchangeController = FederatedAuthExchangeController_1 = class FederatedAuthExchangeController {
+    constructor(federatedAuthService) {
+        this.federatedAuthService = federatedAuthService;
+    }
+    exchange(body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const result = yield this.federatedAuthService.authenticate({
+                    provider: body.provider,
+                    subject: body.subject,
+                });
+                return Utilities_1.RestUtilities.sendBaseResponse(res, result);
+            }
+            catch (error) {
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, FederatedAuthExchangeController_1.name);
+            }
+        });
+    }
+};
+exports.FederatedAuthExchangeController = FederatedAuthExchangeController;
+__decorate([
+    (0, common_1.Post)('exchange'),
+    (0, serviceTokenGuard_1.RequireServiceTokenScopes)('accessi:federated:exchange'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Scambia un identita esterna verificata con una sessione Accessi',
+        operationId: 'exchangeFederatedIdentity',
+        description: 'Richiede un service token con scope accessi:federated:exchange. Il backend chiamante deve avere gia verificato il token del provider.',
+    }),
+    (0, swagger_1.ApiBody)({ type: dtos_1.ExchangeFederatedIdentityRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: dtos_1.FederatedExchangeResponse }),
+    (0, swagger_1.ApiResponse)({ status: 401, type: dtos_1.ErrorResponse, description: 'Service token mancante o non valido.' }),
+    (0, swagger_1.ApiResponse)({ status: 403, type: dtos_1.ErrorResponse, description: 'Scope mancante o identita non abilitata.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, type: dtos_1.ErrorResponse, description: 'Identita non collegata a un utente Accessi.' }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [dtos_1.ExchangeFederatedIdentityRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthExchangeController.prototype, "exchange", null);
+exports.FederatedAuthExchangeController = FederatedAuthExchangeController = FederatedAuthExchangeController_1 = __decorate([
+    (0, swagger_1.ApiTags)('Federated authentication'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('accessi/federated-auth'),
+    (0, common_1.UseGuards)(serviceTokenGuard_1.ServiceTokenGuard),
+    __metadata("design:paramtypes", [FederatedAuthService_1.FederatedAuthService])
+], FederatedAuthExchangeController);
+//# sourceMappingURL=FederatedAuthExchangeController.js.map

package/dist/accessi-service/federated-auth/FederatedAuthExchangeController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedAuthExchangeController.js","sourceRoot":"","sources":["../../../src/accessi-service/federated-auth/FederatedAuthExchangeController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAwE;AACxE,6CAOyB;AAEzB,+CAAgD;AAChD,kCAIiB;AACjB,qEAA6F;AAC7F,iEAA8D;AAE9D;;;;;;GAMG;AAKI,IAAM,+BAA+B,uCAArC,MAAM,+BAA+B;IAC1C,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAerE,QAAQ,CACJ,IAAsC,EACvC,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC;oBAC1D,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;gBACH,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,iCAA+B,CAAC,IAAI,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA9BY,0EAA+B;AAgBpC;IAbL,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,6CAAyB,EAAC,4BAA4B,CAAC;IACvD,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iEAAiE;QAC1E,WAAW,EAAE,2BAA2B;QACxC,WAAW,EACT,uIAAuI;KAC1I,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,uCAAgC,EAAE,CAAC;IACnD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,gCAAyB,EAAE,CAAC;IAClD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;IAC1G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;IAE3G,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADQ,uCAAgC;;+DAY/C;0CA7BU,+BAA+B;IAJ3C,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,wBAAwB,CAAC;IACpC,IAAA,kBAAS,EAAC,qCAAiB,CAAC;qCAEwB,2CAAoB;GAD5D,+BAA+B,CA8B3C","sourcesContent":["import { Body, Controller, Post, Res, UseGuards } from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport {\n  ErrorResponse,\n  ExchangeFederatedIdentityRequest,\n  FederatedExchangeResponse,\n} from '../dtos';\nimport { RequireServiceTokenScopes, ServiceTokenGuard } from '../security/serviceTokenGuard';\nimport { FederatedAuthService } from './FederatedAuthService';\n\n/**\n * Scambio service-to-service di un'identita SSO gia verificata.\n *\n * Il backend fratello valida il token del provider e chiama questo endpoint con\n * `{ provider, subject }`; Accessi restituisce la sessione interna e il JWT.\n * Non e un endpoint browser: richiede un service token con scope dedicato.\n */\n@ApiTags('Federated authentication')\n@ApiBearerAuth()\n@Controller('accessi/federated-auth')\n@UseGuards(ServiceTokenGuard)\nexport class FederatedAuthExchangeController {\n  constructor(private readonly federatedAuthService: FederatedAuthService) {}\n\n  @Post('exchange')\n  @RequireServiceTokenScopes('accessi:federated:exchange')\n  @ApiOperation({\n    summary: 'Scambia un identita esterna verificata con una sessione Accessi',\n    operationId: 'exchangeFederatedIdentity',\n    description:\n      'Richiede un service token con scope accessi:federated:exchange. Il backend chiamante deve avere gia verificato il token del provider.',\n  })\n  @ApiBody({ type: ExchangeFederatedIdentityRequest })\n  @ApiOkResponse({ type: FederatedExchangeResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse, description: 'Service token mancante o non valido.' })\n  @ApiResponse({ status: 403, type: ErrorResponse, description: 'Scope mancante o identita non abilitata.' })\n  @ApiResponse({ status: 404, type: ErrorResponse, description: 'Identita non collegata a un utente Accessi.' })\n  async exchange(\n    @Body() body: ExchangeFederatedIdentityRequest,\n    @Res() res: Response,\n  ): Promise<Response> {\n    try {\n      const result = await this.federatedAuthService.authenticate({\n        provider: body.provider,\n        subject: body.subject,\n      });\n      return RestUtilities.sendBaseResponse(res, result);\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, FederatedAuthExchangeController.name);\n    }\n  }\n}\n"]}