npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.84 → 2.0.0-dev.85 - Mend

emilsoftware-utilities 2.0.0-dev.84 → 2.0.0-dev.85

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1230) hide show

package/dist/accessi-service/services/auth-service/AuthService.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-service/services/auth-service/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAwG;AACxG,mCAAoC;AACpC,6EAA0F;AAC1F,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,yDAAsF;AACtF,sEAAmE;AACnE,6DAA0D;AAC1D,mEAAgE;AAChE,0EAK2C;AAC3C,0EAG2C;AAC3C,wEAI0C;AAC1C,8EAK6C;AAC7C,gDAAoD;AACpD,oEAMwC;AACxC,kEAAqE;AACrE,4CAAyC;AAGzC,8EAA8E;AACjE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAiB1D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,aAA4B,EACT,cAA+C,EACzD,gBAAkC;QAH3C,gBAAW,GAAX,WAAW,CAAa;QACxB,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QACzD,qBAAgB,GAAhB,gBAAgB,CAAkB;QANpC,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qFAAqF;QACrF,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,CAAC;IAClC,CAAC;IAEO,WAAW,CACjB,MAA6B,EAC7B,OAAiB,EACjB,IAA0B,EAC1B,eAAyC,EAAE;;QAE3C,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACpH,MAAM,IAAI,8BAAqB,CAAC,2CAA2C,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,YAAY,CAAC,SAAS,mCAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QACrF,MAAM,gBAAgB,GAAG,OAAO,SAAS,KAAK,QAAQ;YACpD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS;YAChC,CAAC,CAAC,IAAA,qDAAmC,EAAC,IAAI,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,IAAA,oDAAkC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,iCAEf,CAAC,MAAA,YAAY,CAAC,WAAW,mCAAI,EAAE,CAAC,KACnC,MAAM,EACN,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,qEAAqE;YACrE,8DAA8D;YAC9D,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,KAEnB,OAAO,CAAC,GAAG,kBAET,SAAS,EAAE,SAAyC,EACpD,SAAS,EAAE,OAAO,CAAC,SAAS,IACzB,OAAO,CAAC,WAAW,EAEzB,CAAC;QAEF,wFAAwF;QACxF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,cAAc,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,IAAI,OAAO,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG,CAAA,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,8EAA8E;QAC9E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7G,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC;QAEhF,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED,+EAA+E;IACxE,kBAAkB,CACvB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,eAAyC,EAAE;QAE3C,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnE,CAAC;IAED,kFAAkF;IAC3E,kBAAkB,CACvB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,eAAyC,EAAE;QAE3C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAClE,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,kCAC7C,YAAY,KACf,SAAS,IACT,CAAC;IACL,CAAC;IAED,uEAAuE;IAChE,eAAe,CACpB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,OAA+B;;QAE/B,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,mCAAI,IAAA,mBAAU,GAAE,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7F,uBAAS,MAAM,IAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAG;IACrD,CAAC;IAED;;;OAGG;IACI,kBAAkB,CACvB,MAA6B,EAC7B,KAA+C;QAE/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;YACnD,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE;oBACH,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;oBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IAC5E,qBAAqB,CAAC,YAAoB,EAAE,KAAc;;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAC3C,EAAE,YAAY,EAAE,kBACd,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,IAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACjF,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAA,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,CAAC,IAAA,qDAAgC,EAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YACzG,MAAM,CAAC,MAAM,mCAAQ,MAAM,CAAC,MAAM,GAAK,OAAO,CAAE,CAAC;YAEjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC;QACJ,CAAC;KAAA;IAED,8EAA8E;IAChE,sBAAsB,CAAC,YAAoB;;;YACvD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE/E,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAmD,CAAC;YACnH,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,GAAG,CAAC;QAC9H,CAAC;KAAA;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAqB;;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,wBAAwB,EAAE,CAAC;gBACxH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YAChK,CAAC;YACD,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAEzD,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,+BAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB;oBAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,CAAC,CAAC,SAAS,CAAC;gBAEd,qGAAqG;gBACrG,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACnJ,CAAC;YAED,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;KAAA;IAED;;;;;OAKG;IACU,qBAAqB,CAAC,KAAa;;YAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,yDAAuC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClF,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;YACzD,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBACvG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IACE,CAAC,WAAW;gBACZ,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAC9C,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EACnD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,YAAY;gBACZ,OAAO,EAAE,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC;aAC9D,CAAC;QACJ,CAAC;KAAA;IAED;;;OAGG;IACU,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,aAAa,CAAC,OAAO,CAAC;QAC/B,CAAC;KAAA;IAED;;;;OAIG;IACU,kBAAkB,CAAC,YAAoB;;YAClD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACrD,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnE,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,0DAAwC,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnF,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,YAAY,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;YAChE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC7E,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,8BAAqB,CAAC,0CAA0C,CAAC,CAAC;YAC9E,CAAC;YAED,MAAM,aAAa,GAAG,OAA0D,CAAC;YACjF,MAAM,QAAQ,GAAG,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;gBACvF,CAAC,CAAC,aAAa,CAAC,GAAG;gBACnB,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,GAAG,GAAG,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAE5C,4EAA4E;YAC5E,2EAA2E;YAC3E,IAAI,MAAM,IAAA,kDAA2B,EAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,8BAAqB,CAAC;oBAC9B,IAAI,EAAE,gCAAgC;oBACtC,OAAO,EAAE,yDAAyD;iBACnE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,IAAA,yCAAqB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBACvG,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,aAAa,GAAG,IAAA,mDAA4B,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxE,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,8BAAqB,CAAC,wCAAwC,CAAC,CAAC;gBAC5E,CAAC;gBACD,IAAI,OAAO,CAAC;gBACZ,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAA,0CAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;gBAClF,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,oCAA2B,CAAC;wBACpC,IAAI,EAAE,sCAAsC;wBAC5C,OAAO,EAAE,6DAA6D;qBACvE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACjC,MAAM,IAAI,CAAC,uBAAuB,CAAC;wBACjC,YAAY;wBACZ,GAAG;wBACH,QAAQ;wBACR,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,WAAW,EAAE,SAAS,GAAG,IAAI;qBAC9B,CAAC,CAAC;oBACH,MAAM,IAAI,8BAAqB,CAAC;wBAC9B,IAAI,EAAE,6BAA6B;wBACnC,OAAO,EAAE,+BAA+B;qBACzC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAE,OAA6B,CAAC,GAAG,CAAC;gBAC/D,CAAC,CAAC,CAAE,OAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC;gBACxG,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAED;;;;;;;OAOG;IACW,uBAAuB,CAAC,MAMrC;;;YACC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAA,MAAA,IAAI,CAAC,cAAc,CAAC,oBAAoB,0CAAE,YAAY,mCAAI,KAAM,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC;YACzF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;YACzC,IACE,OAAO,GAAG,CAAC;mBACR,YAAY,KAAK,SAAS;mBAC1B,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;mBAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,IAAI,OAAO,EACvC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAA,oBAAY,EAAC,6BAA6B,EAAE;gBAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY;aACb,CAAC,CAAC;YACH,IAAA,4BAAkB,EAAC,IAAI,CAAC,cAAc,EAAE,qBAAqB,EAAE;gBAC7D,qBAAqB,EAAE,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,oBAAoB,0CAAE,yBAAyB,MAAK,IAAI;aACpG,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACpB,MAAM,IAAA,+CAAwB,EAC5B,IAAI,CAAC,cAAc,EACnB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,WAAW,CACnB,CAAC;oBACF,IAAA,4BAAkB,EAAC,IAAI,CAAC,cAAc,EAAE,8BAA8B,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC/F,CAAC;gBACD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,oBAAoB,0CAAE,yBAAyB,MAAK,IAAI,EAAE,CAAC;oBACjF,MAAM,IAAA,6CAAyB,EAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAC;gBAC/G,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,6BAAmB,EAAC,4BAA4B,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC1F,yEAAyE;gBACzE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0CAA0C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAED,+FAA+F;IAClF,uBAAuB,CAAC,YAAoB,EAAE,WAAmB;;;YAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACvG,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACrI,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAqB;;;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrF,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7I,MAAM,IAAI,8BAAqB,CAAC,8DAA8D,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAAE,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;YAC7I,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;YACzJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,CAAA;oBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;gBAC7F,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAC9D,6KAA6K,EAC7K,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB,EAAE,IAAY,EAAE,KAAc;;YAC5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;YACzD,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,qEAAqE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACpJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,kFAAkF,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAClK,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB;;YAC9C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,CAAC;KAAA;IAED;;;;;;OAMG;IACU,WAAW,CACtB,YAAoB,EACpB,aAAqB,EACrB,OAA+D;;YAE/D,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,MAAK,KAAK,EAAE,CAAC;gBACrC,IAAA,qCAAoB,EAAC,aAAa,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,MAAK,KAAK,EAAE,CAAC;oBACtC,MAAM,IAAI,CAAC,iCAAiC,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBAChF,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAED;;;;OAIG;IACW,iCAAiC,CAAC,YAAoB,EAAE,MAAc;;YAClF,IAAI,CAAC;gBACH,MAAM,IAAA,yDAAqC,EAAC,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wCAAwC,YAAY,KAAK,MAAM,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9H,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACU,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAED,yGAAyG;IACnG,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEvC,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE;wBAClD,aAAa,EAAE,KAAK;wBACpB,cAAc,EAAE,KAAK;qBACtB,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,6BAAiB,CAAC,sBAAsB,CACpE,cAAc,EACd,uBAAuB,CACxB,CAAC;YAEF,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE;oBAClD,aAAa,EAAE,KAAK;oBACpB,cAAc,EAAE,KAAK;iBACtB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAED,8GAA8G;IACxG,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,2EAA2E;IAC3E,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACU,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IAAA,qCAAoB,EAAC,WAAW,CAAC,CAAC;gBAElC,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACjE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAEnE,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;;oBACnF,6EAA6E;oBAC7E,+EAA+E;oBAC/E,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,gBAAgB,CACxC,WAAW,EACX,mHAAmH,EACnH,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uCAAkB,CAAC,IAAI,EAAE,uCAAkB,CAAC,KAAK,CAAC,CAClG,CAAC;oBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;oBACnG,IAAI,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBAC3E,CAAC;oBAED,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,gFAAgF,EAChF,CAAC,YAAY,EAAE,cAAc,CAAC,CAC/B,CAAC;oBAEF,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;wBAChE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,yCAAyC,cAAc,6CAA6C,EACpG,CAAC,YAAY,CAAC,CACf,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAA,CAAC,CAAC;gBAEH,6EAA6E;gBAC7E,MAAM,IAAI,CAAC,iCAAiC,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA1yBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFL,yBAAW;QACT,6BAAa,UAED,mCAAgB;GAP1C,WAAW,CA0yBvB","sourcesContent":["import { Inject, Injectable, ServiceUnavailableException, UnauthorizedException } from \"@nestjs/common\";\nimport { randomUUID } from \"crypto\";\nimport { TwoFactorService, TwoFactorProof } from '../two-factor-service/TwoFactorService';\nimport * as jwt from \"jsonwebtoken\";\nimport { Orm } from \"../../../Orm\";\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\nimport type { AccessiOptions } from \"../../AccessiModule\";\nimport { LoginRequest } from \"../../dtos/LoginRequest\";\nimport { LoginResult } from \"../../dtos/LoginResponse\";\nimport { countAccessiMetric, recordAccessiMetric } from \"../../observability/metrics\";\nimport { StatoRegistrazione } from \"../../dtos/StatoRegistrazione\";\nimport { UserService } from \"../user-service/UserService\";\nimport { FiltriService } from \"../filtri-service/FiltriService\";\nimport {\n buildAuthenticatedTokenPayload,\n isAuthenticatedUserEnabledForJwt,\n isAccessiTokenAllowedForUser,\n resolveCodiceUtenteFromTokenPayload,\n} from \"../../security/authenticatedToken\";\nimport {\n getAccessiJwtSecret,\n verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport {\n isAccessiTokenRevoked,\n revokeAccessiUserSessions,\n revokeAccessiUserSessionsIfConfigured,\n} from \"../../security/sessionRevocation\";\nimport {\n consumeRefreshToken,\n getRefreshTokenRotationStore,\n isRefreshTokenFamilyRevoked,\n revokeRefreshTokenFamily,\n} from \"../../security/refreshTokenRotation\";\nimport { auditAccessi } from \"../../security/audit\";\nimport {\n getAccessiAccessTokenSigningConfig,\n getAccessiAccessTokenVerificationConfig,\n getAccessiRefreshTokenSigningConfig,\n getAccessiRefreshTokenVerificationConfig,\n verifyAccessiJwt,\n} from \"../../security/jwtTokenOptions\";\nimport { assertStrongPassword } from '../../security/passwordPolicy';\nimport { Logger } from \"../../../Logger\";\nimport { TokenResult } from '../../dtos/TokenResult';\n\n/** Error code deliberately returned when a user is configured as SSO-only. */\nexport const PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';\n\n/** Esito di una verifica token usata dall'endpoint di introspection. */\nexport interface AccessiTokenIntrospectionResult {\n active: boolean;\n codiceUtente?: number;\n payload?: Record<string, unknown>;\n}\n\ninterface AccessiTokenIssueOptions {\n /** Sovrascrive jwtOptions.expiresIn per token a durata ridotta (es. Login as). */\n expiresIn?: string | number;\n /** Claim aggiuntive, per esempio l'attore che ha generato un token di impersonazione. */\n extraClaims?: Record<string, unknown>;\n}\n\n@Injectable()\nexport class AuthService {\n private readonly logger = new Logger(AuthService.name);\n\n constructor(\n private userService: UserService,\n private filtriService: FiltriService,\n @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions,\n private readonly twoFactorService: TwoFactorService,\n ) {}\n\n private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\n if (!this.accessiOptions.passwordExpiration) {\n return;\n }\n\n const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\n const expirationDays =\n Number.isFinite(configuredDays) && configuredDays > 0\n ? Math.trunc(configuredDays)\n : 90;\n\n const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\n await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n }\n\n private isMockDemoUserEnabled(): boolean {\n if (!this.accessiOptions.mockDemoUser) {\n return false;\n }\n\n // La backdoor mock non e mai attiva in produzione, nemmeno con variabili d'ambiente,\n // perche emette un superutente senza verifica password.\n const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\n return nodeEnv !== \"production\";\n }\n\n private createToken(\n utente: LoginResult['utente'],\n methods: string[],\n type: 'access' | 'refresh',\n tokenOptions: AccessiTokenIssueOptions = {},\n ): TokenResult {\n if (!utente?.codiceUtente) {\n throw new Error('Impossibile creare un token senza un utente Accessi valido.');\n }\n const loginAs = methods.includes('login_as');\n if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp') && !loginAs) {\n throw new UnauthorizedException('Verifica del codice di accesso richiesta.');\n }\n\n const expiresIn = tokenOptions.expiresIn ?? this.accessiOptions.jwtOptions.expiresIn;\n const expiresInIsValid = typeof expiresIn === 'number'\n ? Number.isFinite(expiresIn) && expiresIn > 0\n : typeof expiresIn === 'string' && expiresIn.trim() !== '';\n if (!expiresInIsValid) {\n throw new Error('Durata token non configurata: impossibile emettere token senza scadenza.');\n }\n\n const signing = type === 'refresh'\n ? getAccessiRefreshTokenSigningConfig(this.accessiOptions)\n : getAccessiAccessTokenSigningConfig(this.accessiOptions);\n const token = jwt.sign(\n {\n ...(tokenOptions.extraClaims ?? {}),\n utente,\n typ: type,\n amr: methods,\n jti: randomUUID(),\n // Millisecondi: rende deterministica la revoca sessioni anche quando\n // il token e emesso nello stesso secondo del cambio password.\n iatMs: Date.now(),\n },\n signing.key,\n {\n expiresIn: expiresIn as jwt.SignOptions['expiresIn'],\n algorithm: signing.algorithm,\n ...signing.signOptions,\n },\n );\n\n // Difesa in profondita: un `expiresIn` malformato farebbe emettere un token permanente.\n const decoded = jwt.decode(token);\n const decodedPayload = decoded && typeof decoded === 'object' ? decoded as jwt.JwtPayload : undefined;\n if (typeof decodedPayload?.exp !== 'number') {\n throw new Error('Token emesso senza scadenza: configurazione JWT non valida.');\n }\n\n // Il contratto TokenResult espone sempre la validita in secondi, anche quando\n // jwtOptions.expiresIn usa un formato leggibile come '24h'.\n const issuedAt = typeof decodedPayload.iat === 'number' ? decodedPayload.iat : Math.floor(Date.now() / 1000);\n const expiresInSeconds = Math.max(0, Math.trunc(decodedPayload.exp - issuedAt));\n\n return {\n expiresIn: String(expiresInSeconds),\n value: token,\n type: 'Bearer',\n };\n }\n\n /** Creates the normal internal JWT consumed by all existing Accessi guards. */\n public createAccessiToken(\n utente: LoginResult['utente'],\n methods: string[] = [],\n tokenOptions: AccessiTokenIssueOptions = {},\n ): TokenResult {\n return this.createToken(utente, methods, 'access', tokenOptions);\n }\n\n /** Emette il refresh token quando `jwtOptions.refreshExpiresIn` e configurato. */\n public createRefreshToken(\n utente: LoginResult['utente'],\n methods: string[] = [],\n tokenOptions: AccessiTokenIssueOptions = {},\n ): TokenResult | undefined {\n const expiresIn = this.accessiOptions.jwtOptions.refreshExpiresIn;\n if (!expiresIn) return undefined;\n return this.createToken(utente, methods, 'refresh', {\n ...tokenOptions,\n expiresIn,\n });\n }\n\n /** Crea la coppia access + refresh token usata da login, 2FA e SSO. */\n public createTokenPair(\n utente: LoginResult['utente'],\n methods: string[] = [],\n options?: { familyId?: string },\n ): { access: TokenResult; refresh?: TokenResult } {\n // La famiglia identifica il login: access e refresh condividono lo stesso\n // `fid`, cosi la revoca per riuso sospetto invalida entrambi.\n const familyId = options?.familyId ?? randomUUID();\n const access = this.createAccessiToken(utente, methods, { extraClaims: { fid: familyId } });\n const refresh = this.createRefreshToken(utente, methods, { extraClaims: { fid: familyId } });\n return { access, ...(refresh ? { refresh } : {}) };\n }\n\n /**\n * Emette l'access token per l'utente target, con l'attore registrato nelle\n * claim `act` e `loginAs`. La durata e' quella standard di jwtOptions.expiresIn.\n */\n public createLoginAsToken(\n utente: LoginResult['utente'],\n actor: { codiceUtente: number; email?: string },\n ): TokenResult {\n return this.createAccessiToken(utente, ['login_as'], {\n extraClaims: {\n loginAs: true,\n act: {\n sub: String(actor.codiceUtente),\n email: actor.email,\n },\n },\n });\n }\n\n /** Builds the standard login response for a user authenticated by a supported method. */\n public async getLoginResultForUser(codiceUtente: number, scope?: string): Promise<LoginResult> {\n const users = await this.userService.getUsers(\n { codiceUtente },\n { includeExtensionFields: true, includeGrants: true, ...(scope ? { scope } : {}) },\n );\n const result = users[0];\n if (!result?.utente) {\n throw new Error('Utente Accessi non trovato.');\n }\n const current = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(current)) throw new UnauthorizedException('Utente non abilitato.');\n result.utente = { ...result.utente, ...current };\n\n return {\n utente: result.utente,\n filtri: await this.filtriService.getFiltriUser(codiceUtente),\n userGrants: result.userGrants,\n extensionFields: result.extensionFields,\n };\n }\n\n /** Users without a row retain the historic password-login enabled default. */\n private async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n if (this.accessiOptions.federatedAuthentication?.enabled !== true) return true;\n\n const rows = await Orm.query(\n this.accessiOptions.databaseOptions,\n 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n [codiceUtente],\n );\n const policy = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { passwordLoginEnabled?: unknown } | undefined;\n return policy?.passwordLoginEnabled !== false && policy?.passwordLoginEnabled !== 0 && policy?.passwordLoginEnabled !== '0';\n }\n\n /**\n * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.\n * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.\n * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.\n */\n async login(request: LoginRequest): Promise<LoginResult> {\n const mockDemoUserEnabled = this.isMockDemoUserEnabled();\n\n if (\n mockDemoUserEnabled &&\n request.email.toLowerCase() === \"demo\"\n ) {\n return this.getDemoUser();\n }\n\n if (\n mockDemoUserEnabled &&\n request.email.toLowerCase() === \"admin\"\n ) {\n return this.getAdminUser();\n }\n\n const utente = await this.userService.getUserByEmail(\n request.email.trim().toLowerCase()\n );\n if (!utente) {\n if (!request.password) return { passwordRequired: true };\n throw new Error(\"Nome utente o password errata!\");\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);\n if (isAuthenticatedUserEnabledForJwt(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {\n return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: (currentUser.email ?? '').trim(), mode: 'passwordless' }) };\n }\n // The email-only step has the same response for unknown and ordinary local accounts.\n if (!request.password) return { passwordRequired: true };\n\n switch (utente.statoRegistrazione) {\n case undefined:\n throw new Error(\n \"Struttura dati compromessa: Stato Registrazione inesistente.\"\n );\n case StatoRegistrazione.BLOCC:\n case StatoRegistrazione.DELETE:\n throw new Error(\"Utente non abilitato\");\n case StatoRegistrazione.INVIO:\n throw new Error(\"Rinnovo password necessario.\");\n }\n\n if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\n throw new Error(\n `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\n );\n }\n\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) throw new Error('Utente non abilitato');\n if (!(await this.isPasswordLoginEnabled(utente.codiceUtente))) {\n throw new Error(PASSWORD_LOGIN_DISABLED);\n }\n\n if (typeof request.password !== 'string' || request.password.length === 0) {\n throw new Error('Nome utente o password errata!');\n }\n\n const isPasswordValid = await this.verifyPassword(\n utente.codiceUtente,\n request.password\n );\n if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\n\n if (\n this.accessiOptions.passwordExpiration &&\n this.accessiOptions.passwordExpiration == true\n ) {\n const today = new Date();\n const targetDate = utente.dataScadenzaPassword\n ? new Date(utente.dataScadenzaPassword)\n : undefined;\n\n // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.\n if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {\n throw new Error(\"PASSWORD_EXPIRED\");\n }\n }\n\n if (currentUser.flagDueFattori) {\n return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email ?? '', mode: 'password' }) };\n }\n\n const updateLastAccessDateQuery =\n \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\n await Orm.query(\n this.accessiOptions.databaseOptions,\n updateLastAccessDateQuery,\n [utente.codiceUtente]\n );\n\n return this.getLoginResultForUser(utente.codiceUtente, request.scope);\n }\n\n /**\n * Verifica un access token Accessi senza sollevare eccezioni per token invalidi.\n *\n * Gli errori di configurazione o database continuano a propagarsi: un problema\n * infrastrutturale non deve essere confuso con un token scaduto.\n */\n public async introspectAccessToken(token: string): Promise<AccessiTokenIntrospectionResult> {\n if (typeof token !== \"string\" || token.trim() === \"\") {\n return { active: false };\n }\n\n const verification = getAccessiAccessTokenVerificationConfig(this.accessiOptions);\n let decoded: unknown;\n try {\n decoded = verifyAccessiJwt(token.trim(), verification);\n } catch {\n return { active: false };\n }\n\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n if (!codiceUtente) {\n return { active: false };\n }\n if (await isAccessiTokenRevoked(this.accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n return { active: false };\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (\n !currentUser ||\n !isAuthenticatedUserEnabledForJwt(currentUser) ||\n !isAccessiTokenAllowedForUser(decoded, currentUser)\n ) {\n return { active: false };\n }\n\n return {\n active: true,\n codiceUtente,\n payload: buildAuthenticatedTokenPayload(decoded, currentUser),\n };\n }\n\n /**\n * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.\n * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.\n */\n public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\n if (typeof token !== \"string\" || token.trim() === \"\") {\n throw new Error(\"Token non fornito.\");\n }\n\n const introspection = await this.introspectAccessToken(token);\n if (!introspection.active || !introspection.payload) {\n throw new Error(\"Token non valido o utente non autorizzato.\");\n }\n\n return introspection.payload;\n }\n\n /**\n * Scambia un refresh token valido con una nuova coppia access + refresh.\n *\n * Il refresh token non e accettato dai guard API: ha `typ: \"refresh\"`.\n */\n public async refreshAccessToken(refreshToken: string): Promise<LoginResult> {\n if (!this.accessiOptions.jwtOptions.refreshExpiresIn) {\n throw new UnauthorizedException('Refresh token non abilitato.');\n }\n if (typeof refreshToken !== 'string' || refreshToken.trim() === '') {\n throw new UnauthorizedException('Refresh token mancante.');\n }\n\n const verification = getAccessiRefreshTokenVerificationConfig(this.accessiOptions);\n let decoded: unknown;\n try {\n decoded = verifyAccessiJwt(refreshToken.trim(), verification);\n } catch {\n throw new UnauthorizedException('Refresh token non valido o scaduto.');\n }\n\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded, 'refresh');\n if (!codiceUtente) {\n throw new UnauthorizedException('Refresh token privo di un utente valido.');\n }\n\n const decodedRecord = decoded as { jti?: unknown; fid?: unknown; exp?: unknown };\n const familyId = typeof decodedRecord.fid === 'string' && decodedRecord.fid.trim() !== ''\n ? decodedRecord.fid\n : undefined;\n const jti = typeof decodedRecord.jti === 'string' ? decodedRecord.jti : undefined;\n const expiresAt = Number(decodedRecord.exp);\n\n // La famiglia va controllata per prima: un token appena emesso da uno store\n // compromesso deve produrre un codice stabile, non il generico 401 utente.\n if (await isRefreshTokenFamilyRevoked(this.accessiOptions, familyId)) {\n throw new UnauthorizedException({\n code: 'ACCESSI_REFRESH_FAMILY_REVOKED',\n message: 'Sessione revocata per riuso sospetto del refresh token.',\n });\n }\n\n if (await isAccessiTokenRevoked(this.accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n throw new UnauthorizedException('Sessione revocata.');\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n throw new UnauthorizedException('Utente non piu autorizzato.');\n }\n\n const rotationStore = getRefreshTokenRotationStore(this.accessiOptions);\n if (rotationStore) {\n if (!jti || !Number.isFinite(expiresAt)) {\n throw new UnauthorizedException('Refresh token privo di jti o scadenza.');\n }\n let outcome;\n try {\n outcome = await consumeRefreshToken(this.accessiOptions, jti, expiresAt * 1000);\n } catch {\n throw new ServiceUnavailableException({\n code: 'ACCESSI_REFRESH_ROTATION_UNAVAILABLE',\n message: 'Rotazione refresh token non disponibile. Riprova piu tardi.',\n });\n }\n if (outcome && !outcome.consumed) {\n await this.handleRefreshTokenReuse({\n codiceUtente,\n jti,\n familyId,\n consumedAtMs: outcome.consumedAtMs,\n expiresAtMs: expiresAt * 1000,\n });\n throw new UnauthorizedException({\n code: 'ACCESSI_REFRESH_TOKEN_REUSE',\n message: 'Refresh token gia utilizzato.',\n });\n }\n }\n\n const login = await this.getLoginResultForUser(codiceUtente);\n const methods = Array.isArray((decoded as { amr?: unknown }).amr)\n ? ((decoded as { amr: unknown[] }).amr.filter((method): method is string => typeof method === 'string'))\n : [];\n const pair = this.createTokenPair(login.utente, methods, { familyId });\n login.token = pair.access;\n if (pair.refresh) login.refreshToken = pair.refresh;\n return login;\n }\n\n /**\n * Gestisce il riuso di un refresh token gia consumato.\n *\n * Il riuso entro `reuseGraceMs` e trattato come retry concorrente del client e\n * non revoca nulla. Oltre la finestra e considerato un possibile furto: viene\n * revocata l'intera famiglia (stesso login) e, solo se esplicitamente\n * configurato, anche le altre sessioni dell'utente.\n */\n private async handleRefreshTokenReuse(params: {\n codiceUtente: number;\n jti: string;\n familyId?: string;\n consumedAtMs?: number;\n expiresAtMs: number;\n }): Promise<void> {\n const configuredGrace = Number(this.accessiOptions.refreshTokenRotation?.reuseGraceMs ?? 10_000);\n const graceMs = Number.isFinite(configuredGrace) ? Math.max(0, configuredGrace) : 10_000;\n const consumedAtMs = params.consumedAtMs;\n if (\n graceMs > 0\n && consumedAtMs !== undefined\n && Number.isFinite(consumedAtMs)\n && Date.now() - consumedAtMs <= graceMs\n ) {\n return;\n }\n\n auditAccessi('accessi_refresh_token_reuse', {\n codiceUtente: params.codiceUtente,\n jti: params.jti,\n familyId: params.familyId,\n consumedAtMs,\n });\n countAccessiMetric(this.accessiOptions, 'refresh_reuse_total', {\n user_sessions_revoked: this.accessiOptions.refreshTokenRotation?.revokeUserSessionsOnReuse === true,\n });\n\n try {\n if (params.familyId) {\n await revokeRefreshTokenFamily(\n this.accessiOptions,\n params.familyId,\n params.expiresAtMs,\n );\n countAccessiMetric(this.accessiOptions, 'refresh_family_revoked_total', { reason: 'reuse' });\n }\n if (this.accessiOptions.refreshTokenRotation?.revokeUserSessionsOnReuse === true) {\n await revokeAccessiUserSessions(this.accessiOptions, params.codiceUtente, Date.now(), 'refresh_token_reuse');\n }\n } catch (error) {\n recordAccessiMetric('accessi_store_errors_total', 1, { store: 'refresh_token_rotation' });\n // La revoca e best effort: il token presentato resta comunque rifiutato.\n this.logger.error(\n `Revoca famiglia refresh token fallita: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n }\n\n /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */\n public async beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult> {\n const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori) throw new UnauthorizedException();\n return { challenge: await this.twoFactorService.issue({ codiceUtente, email: user.email ?? '', mode: 'federated', identityKey }) };\n }\n\n private async validateTwoFactorProof(proof: TwoFactorProof): Promise<void> {\n const user = await this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori || user.email?.trim().toLowerCase() !== proof.email.trim().toLowerCase()) {\n throw new UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');\n }\n if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled) throw new UnauthorizedException('Accesso senza password disabilitato.');\n if (proof.mode === 'password' && !(await this.isPasswordLoginEnabled(proof.codiceUtente))) throw new UnauthorizedException('Login locale disabilitato.');\n if (proof.mode === 'federated') {\n if (!this.accessiOptions.federatedAuthentication?.enabled) throw new UnauthorizedException();\n const rows = await Orm.query(this.accessiOptions.databaseOptions,\n 'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1',\n [proof.identityKey, proof.codiceUtente], false);\n if (!rows.length) throw new UnauthorizedException('Identita SSO non piu abilitata.');\n }\n }\n\n public async verifyTwoFactor(challengeId: string, code: string, scope?: string): Promise<LoginResult> {\n const proof = await this.twoFactorService.consume(challengeId, code);\n await this.validateTwoFactorProof(proof);\n const result = await this.getLoginResultForUser(proof.codiceUtente, scope);\n const tokens = this.createTokenPair(result.utente, [proof.mode, 'otp']);\n result.token = tokens.access;\n if (tokens.refresh) result.refreshToken = tokens.refresh;\n await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);\n if (proof.mode === 'federated') {\n await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);\n }\n return result;\n }\n\n public async resendTwoFactor(challengeId: string): Promise<LoginResult> {\n await this.validateTwoFactorProof(await this.twoFactorService.describe(challengeId));\n return { challenge: await this.twoFactorService.resend(challengeId) };\n }\n\n /**\n * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.\n * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di\n * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.\n * Con `revokeSessions` (default true) invalida le sessioni precedenti: un cambio password deve\n * interrompere i token gia emessi.\n */\n public async setPassword(\n codiceUtente: number,\n nuovaPassword: string,\n options?: { enforcePolicy?: boolean; revokeSessions?: boolean },\n ) {\n if (options?.enforcePolicy !== false) {\n assertStrongPassword(nuovaPassword);\n }\n try {\n const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\n const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\n\n const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\n codiceUtente,\n hashedPassword,\n ]);\n await this.refreshPasswordExpiration(codiceUtente);\n if (options?.revokeSessions !== false) {\n await this.revokeSessionsAfterSecurityChange(codiceUtente, 'password_change');\n }\n return result;\n } catch (error) {\n throw error;\n }\n }\n\n /**\n * Revoca le sessioni dopo un evento che deve invalidare i token esistenti.\n * Best effort: un errore dello store non deve annullare l'operazione gia\n * persistita (cambio password, blocco, cancellazione).\n */\n private async revokeSessionsAfterSecurityChange(codiceUtente: number, reason: string): Promise<void> {\n try {\n await revokeAccessiUserSessionsIfConfigured(this.accessiOptions, codiceUtente, reason);\n } catch (error) {\n this.logger.error(\n `Revoca sessioni fallita per l'utente ${codiceUtente} (${reason}): ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n }\n\n /**\n * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.\n * E idempotente: hash moderni e gia migrati vengono ignorati.\n */\n public async migrateLegacyEncryptedPasswords(): Promise<void> {\n const startedAt = performance.now();\n this.logger.info(\"Avvio migrazione password legacy accessi.\");\n const results = await Orm.query(\n this.accessiOptions.databaseOptions,\n \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n []\n );\n\n const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\n codiceUtente?: number;\n password?: string;\n }[];\n let migratedCount = 0;\n let skippedCount = 0;\n\n for (const row of rows) {\n const codiceUtente = Number(row.codiceUtente);\n const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\n if (\n !codiceUtente ||\n !storedPassword ||\n PasswordUtilities.isPasswordHash(storedPassword) ||\n PasswordUtilities.isLegacyPasswordHash(storedPassword)\n ) {\n skippedCount += 1;\n continue;\n }\n\n const protectedLegacyPassword =\n PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\n\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n [protectedLegacyPassword, codiceUtente, storedPassword]\n );\n migratedCount += 1;\n }\n\n this.logger.info(\n `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n );\n }\n\n /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */\n async verifyPassword(\n codiceUtente: number,\n plainPassword: string\n ): Promise<boolean> {\n const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\n const result = (await Orm.query(\n this.accessiOptions.databaseOptions,\n query,\n [codiceUtente]\n ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\n password: string;\n }[];\n\n const stored = result[0];\n if (!stored || typeof stored.password !== \"string\") {\n return false;\n }\n\n const storedPassword = stored.password;\n\n if (PasswordUtilities.isPasswordHash(storedPassword)) {\n return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\n }\n\n const legacyEncryptedPassword = CryptUtilities.encrypt(\n plainPassword,\n this.accessiOptions.encryptionKey\n );\n\n if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\n const isMigratedLegacyPasswordValid =\n PasswordUtilities.verifyLegacyEncryptedPassword(\n legacyEncryptedPassword,\n storedPassword\n );\n\n if (isMigratedLegacyPasswordValid) {\n await this.setPassword(codiceUtente, plainPassword, {\n enforcePolicy: false,\n revokeSessions: false,\n });\n }\n\n return isMigratedLegacyPasswordValid;\n }\n\n const isLegacyPasswordValid = PasswordUtilities.timingSafeStringEquals(\n storedPassword,\n legacyEncryptedPassword,\n );\n\n if (isLegacyPasswordValid) {\n await this.setPassword(codiceUtente, plainPassword, {\n enforcePolicy: false,\n revokeSessions: false,\n });\n }\n\n return isLegacyPasswordValid;\n }\n\n /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */\n async getAdminUser(): Promise<LoginResult> {\n return {\n utente: {\n codiceUtente: 6789,\n email: \"admin\",\n statoRegistrazione: StatoRegistrazione.CONF,\n cognome: \"Admin\",\n nome: \"Admin\",\n flagGdpr: true,\n avatar: \"/path/to/avatar.jpg\",\n flagDueFattori: false,\n codiceLingua: \"IT\",\n cellulare: \"+391234567890\",\n flagSuper: true,\n roles: [],\n permissions: [],\n },\n filtri: null,\n userGrants: {\n abilitazioni: [],\n grants: [],\n ruoli: [],\n },\n };\n }\n\n /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */\n getDemoUser(): LoginResult {\n return {\n utente: {\n codiceUtente: 12345,\n email: \"jdoe\",\n statoRegistrazione: StatoRegistrazione.CONF,\n cognome: \"Doe\",\n nome: \"John\",\n flagGdpr: true,\n avatar: \"/path/to/avatar.jpg\",\n flagDueFattori: false,\n codiceLingua: \"IT\",\n cellulare: \"+391234567890\",\n flagSuper: false,\n roles: [],\n permissions: [],\n },\n filtri: null,\n userGrants: {\n abilitazioni: [],\n grants: [],\n ruoli: [],\n },\n };\n }\n\n /**\n * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.\n * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.\n */\n public async confirmResetPassword(\n token: string,\n newPassword: string\n ): Promise<void> {\n try {\n if (typeof token !== \"string\" || token.trim() === \"\") {\n throw new Error(\"Token non valido.\");\n }\n\n assertStrongPassword(newPassword);\n\n const secret = getAccessiJwtSecret(this.accessiOptions, 'reset');\n const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\n\n const hashedPassword = PasswordUtilities.hashPassword(newPassword);\n\n await Orm.withTransaction(this.accessiOptions.databaseOptions, async (transaction) => {\n // A conditional write claims the nonce under the database row lock. A second\n // concurrent reset cannot also consume it; failures roll the whole reset back.\n const claimed = await Orm.transactionQuery<unknown>(\n transaction,\n 'UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE',\n [StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione.CONF, StatoRegistrazione.INVIO],\n );\n const row = (Array.isArray(claimed) ? claimed[0] : claimed) as Record<string, unknown> | undefined;\n if (Number(row?.CODUTE ?? row?.codute) !== codiceUtente) {\n throw new Error('Token non valido, gia usato o utente non autorizzato.');\n }\n\n await Orm.transactionQuery(\n transaction,\n 'UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)',\n [codiceUtente, hashedPassword],\n );\n\n if (this.accessiOptions.passwordExpiration) {\n const days = Number(this.accessiOptions.passwordExpirationDays);\n const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;\n await Orm.transactionQuery(\n transaction,\n `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`,\n [codiceUtente],\n );\n }\n });\n\n // Il reset e un cambio password: i token emessi prima non devono piu valere.\n await this.revokeSessionsAfterSecurityChange(codiceUtente, 'password_reset');\n } catch (error) {\n throw error;\n }\n }\n}\n"]}

package/dist/accessi-service/services/configurator-service/ConfiguratorService.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"ConfiguratorService.js","sourceRoot":"","sources":["../../../../src/accessi-service/services/configurator-service/ConfiguratorService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,gDAA6C;AAE7C,sCAAmC;AAK5B,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAC8C,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAEzE,CAAC;IAEJ,qHAAqH;IACxG,cAAc,CAAC,UAAkB,EAAE,OAAgB;;YAC9D,MAAM,KAAK,GAAG,iDAAiD,CAAC;YAChE,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,EAAC,UAAU,CAAC,CAAC,CAAA;QAC1F,CAAC;KAAA;IAED,iHAAiH;IACpG,eAAe,CAAC,YAAoB,EAAE,OAAgB;;YACjE,MAAM,KAAK,GAAG,qDAAqD,CAAA;YACnE,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7F,CAAC;KAAA;CAKF,CAAA;AAvBY,kDAAmB;8BAAnB,mBAAmB;IAH/B,mBAAQ;IACR,IAAA,mBAAU,GAAE;IACb,8GAA8G;;IAGzG,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAFjB,mBAAmB,CAuB/B","sourcesContent":["import { Inject, Injectable } from '@nestjs/common';\nimport { autobind } from '../../../autobind';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { Orm } from '../../../Orm';\n\n@autobind\n@Injectable()\n/** Administrative catalog service. Disabling a menu or group does not delete grants already stored for it. */\nexport class ConfiguratorService {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n\n ) {}\n\n /** Enables or disables one menu in the runtime catalog. Disabled menus are excluded from normal grant resolution. */\n public async setMenuEnabled(codiceMenu: string, enabled: boolean): Promise<void> {\n const query = `UPDATE MENU SET FLGENABLED = ? WHERE CODMNU = ?`;\n const enabledValue = enabled ? 1 : 0\n await Orm.execute(this.accessiOptions.databaseOptions, query, [enabledValue,codiceMenu])\n }\n\n /** Enables or disables a whole group. Existing menus and role mappings are preserved for future reactivation. */\n public async setGroupEnabled(codiceGruppo: string, enabled: boolean): Promise<void> {\n const query = `UPDATE MENU_GRP SET FLGENABLED = ? WHERE CODGRP = ?`\n const enabledValue = enabled ? 1 : 0\n await Orm.execute(this.accessiOptions.databaseOptions, query, [enabledValue, codiceGruppo])\n }\n\n\n\n\n}\n"]}

package/dist/accessi-service/services/email-service/EmailService.js ADDED Viewed

@@ -0,0 +1,439 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var EmailService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmailService = void 0;
+const nodemailer_1 = __importDefault(require("nodemailer"));
+const uuid_1 = require("uuid");
+const Orm_1 = require("../../../Orm");
+const common_1 = require("@nestjs/common");
+const Logger_1 = require("../../../Logger");
+const StatoRegistrazione_1 = require("../../dtos/StatoRegistrazione");
+const passwordResetToken_1 = require("../../security/passwordResetToken");
+const emailConfiguration_1 = require("../../security/emailConfiguration");
+let EmailService = EmailService_1 = class EmailService {
+    constructor(accessiOptions) {
+        this.accessiOptions = accessiOptions;
+        this.logger = new Logger_1.Logger(EmailService_1.name);
+        this.transporter = nodemailer_1.default.createTransport(this.accessiOptions.emailOptions);
+    }
+    sendAccountUpdateEmail(_email, _message) {
+        throw new Error('Method not implemented.');
+    }
+    /** Sends the one-time login code without including it in application logs. */
+    sendTwoFactorCode(email, code, validityMinutes) {
+        return __awaiter(this, void 0, void 0, function* () {
+            (0, emailConfiguration_1.assertEmailConfigured)(this.accessiOptions);
+            yield this.transporter.sendMail({
+                from: this.accessiOptions.emailOptions.from,
+                to: email,
+                subject: 'Codice di accesso',
+                text: `Il tuo codice di accesso e: ${code}\n\nScade entro ${validityMinutes} minuti e puo essere usato una sola volta. Se non hai richiesto l accesso, ignora questa email.`,
+            });
+        });
+    }
+    /**
+     * Creates a short-lived, one-use reset token and sends it by email. Invalid, missing, blocked or deleted users
+     * return without error to prevent account enumeration. On delivery failure the stored reset nonce is cleared.
+     */
+    sendPasswordResetEmail(email, htmlMail) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            // Fuori dal try: deve propagare ACCESSI_EMAIL_NOT_CONFIGURED, non essere mascherato dall'errore generico.
+            (0, emailConfiguration_1.assertEmailConfigured)(this.accessiOptions);
+            let codiceUtente = null;
+            let resetToken = null;
+            let nonce = null;
+            try {
+                if (typeof email !== 'string' || email.trim() === '') {
+                    return;
+                }
+                const normalizedEmail = email.trim().toLowerCase();
+                const userResult = yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, 'SELECT FIRST 1 CODUTE as codice_utente, STAREG as stato_registrazione FROM UTENTI WHERE LOWER(USRNAME) = ?', [normalizedEmail]);
+                const user = userResult.map((row) => {
+                    var _a, _b, _c, _d, _e, _f;
+                    return ({
+                        codiceUtente: Number((_c = (_b = (_a = row.CODICE_UTENTE) !== null && _a !== void 0 ? _a : row.codice_utente) !== null && _b !== void 0 ? _b : row.CODUTE) !== null && _c !== void 0 ? _c : row.codute),
+                        statoRegistrazione: Number((_f = (_e = (_d = row.STATO_REGISTRAZIONE) !== null && _d !== void 0 ? _d : row.stato_registrazione) !== null && _e !== void 0 ? _e : row.STAREG) !== null && _f !== void 0 ? _f : row.stareg),
+                    });
+                })[0];
+                if (!(user === null || user === void 0 ? void 0 : user.codiceUtente) ||
+                    user.statoRegistrazione === StatoRegistrazione_1.StatoRegistrazione.BLOCC ||
+                    user.statoRegistrazione === StatoRegistrazione_1.StatoRegistrazione.DELETE) {
+                    return;
+                }
+                codiceUtente = user.codiceUtente;
+                nonce = (0, uuid_1.v4)();
+                const secret = (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions, 'reset');
+                resetToken = (0, passwordResetToken_1.createPasswordResetToken)(user.codiceUtente, nonce, secret);
+                yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET KEYREG = ? WHERE CODUTE = ? ', [nonce, codiceUtente], false);
+                //costruizione dei queryparams
+                const returnUrlQueryParams = '?returnUrl=' +
+                    encodeURIComponent(this.accessiOptions.confirmationEmailReturnUrl) +
+                    '&prefix=' +
+                    encodeURIComponent((_a = this.accessiOptions.confirmationEmailPrefix) !== null && _a !== void 0 ? _a : '');
+                const { confirmationEmailUrl, customResetPage } = this.accessiOptions;
+                // costruisco l'url di base
+                let resetUrl = `${confirmationEmailUrl}/api/accessi/email/reset-password-page/${encodeURIComponent(resetToken)}${returnUrlQueryParams}`;
+                //solo se gli do la customResetPage
+                if (customResetPage) {
+                    resetUrl = `${customResetPage}?token=${encodeURIComponent(resetToken)}`;
+                }
+                let sPhrase;
+                if (htmlMail) {
+                    sPhrase = htmlMail.replace('#link_conferma_password_url', resetUrl);
+                }
+                else {
+                    sPhrase = ` Gentile utente,<br>
+                        abbiamo ricevuto la tua richiesta.<br><br>
+                        Per completare l'operazione, clicca sul link qui sotto:<br>
+                        <a href="${resetUrl}">completa la procedura</a><br><br>
+                        Se hai richiesto la registrazione al servizio o la reimpostazione della password, questo passaggio è necessario.<br>
+                        Se non sei stato tu a effettuare questa richiesta, puoi ignorare questo messaggio in tutta sicurezza.<br><br>
+                        Questa è una comunicazione automatica, ti preghiamo di non rispondere a questa email.<br><br>
+                        Grazie.<br>`;
+                }
+                const html = this.GetHtmlMail(sPhrase);
+                const mailOptions = {
+                    from: this.accessiOptions.emailOptions.from,
+                    to: email,
+                    subject: 'Scelta nuova password',
+                    text: sPhrase,
+                    html: html,
+                };
+                yield this.transporter.sendMail(mailOptions);
+            }
+            catch (error) {
+                if (codiceUtente && nonce) {
+                    yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET KEYREG = NULL WHERE CODUTE = ? AND KEYREG = ?', [codiceUtente, nonce], false).catch(() => undefined);
+                }
+                this.logger.error("Errore nell'invio dell'email di reset password:", error);
+                throw new Error("Errore durante l'invio dell'email di reset password.");
+            }
+        });
+    }
+    GetHtmlMail(sPhrase) {
+        let sTxt = '';
+        sTxt += '<html xmlns="http://www.w3.org/1999/xhtml">';
+        sTxt += '<head>';
+        sTxt += '    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">';
+        sTxt += '    <meta name="viewport" content="width=device-width, initial-scale=1">';
+        sTxt += '    <title></title>';
+        sTxt += '    <style type="text/css">';
+        sTxt += '        @media only screen and (max-width:480px) {';
+        sTxt += '            body,';
+        sTxt += '            table,';
+        sTxt += '            td,';
+        sTxt += '            p,';
+        sTxt += '            a,';
+        sTxt += '            li,';
+        sTxt += '            blockquote {';
+        sTxt += '                -webkit-text-size-adjust: none !important';
+        sTxt += '            }';
+        sTxt += '            body {';
+        sTxt += '                width: 100% !important;';
+        sTxt += '                min-width: 100% !important';
+        sTxt += '            }';
+        sTxt += '            #bodyCell {';
+        sTxt += '                padding: 10px !important';
+        sTxt += '            }';
+        sTxt += '            table.kmMobileHide {';
+        sTxt += '                display: none !important';
+        sTxt += '            }';
+        sTxt += '            table.kmDesktopOnly,';
+        sTxt += '            td.kmDesktopOnly,';
+        sTxt += '            th.kmDesktopOnly,';
+        sTxt += '            tr.kmDesktopOnly,';
+        sTxt += '            td.kmDesktopWrapHeaderMobileNone {';
+        sTxt += '                display: none !important';
+        sTxt += '            }';
+        sTxt += '            table.kmMobileOnly {';
+        sTxt += '                display: table !important';
+        sTxt += '            }';
+        sTxt += '            tr.kmMobileOnly {';
+        sTxt += '                display: table-row !important';
+        sTxt += '            }';
+        sTxt += '            td.kmMobileOnly,';
+        sTxt += '            td.kmDesktopWrapHeader,';
+        sTxt += '            th.kmMobileOnly {';
+        sTxt += '                display: table-cell !important';
+        sTxt += '            }';
+        sTxt += '            tr.kmMobileNoAlign,';
+        sTxt += '            table.kmMobileNoAlign {';
+        sTxt += '                float: none !important;';
+        sTxt += '                text-align: initial !important;';
+        sTxt += '                vertical-align: middle !important;';
+        sTxt += '                table-layout: fixed !important';
+        sTxt += '            }';
+        sTxt += '            tr.kmMobileCenterAlign {';
+        sTxt += '                float: none !important;';
+        sTxt += '                text-align: center !important;';
+        sTxt += '                vertical-align: middle !important;';
+        sTxt += '                table-layout: fixed !important';
+        sTxt += '            }';
+        sTxt += '            td.kmButtonCollection {';
+        sTxt += '                padding-left: 9px !important;';
+        sTxt += '                padding-right: 9px !important;';
+        sTxt += '                padding-top: 9px !important;';
+        sTxt += '                padding-bottom: 9px !importan';
+        sTxt += '            }';
+        sTxt += '            td.kmMobileHeaderStackDesktopNone,';
+        sTxt += '            img.kmMobileHeaderStackDesktopNone,';
+        sTxt += '            td.kmMobileHeaderStack {';
+        sTxt += '                display: block !important;';
+        sTxt += '                margin-left: auto !important;';
+        sTxt += '                margin-right: auto !important;';
+        sTxt += '                padding-bottom: 9px !important;';
+        sTxt += '                padding-right: 0 !important;';
+        sTxt += '                padding-left: 0 !important';
+        sTxt += '            }';
+        sTxt += '            td.kmMobileWrapHeader,';
+        sTxt += '            td.kmMobileWrapHeaderDesktopNone {';
+        sTxt += '                display: inline-block !important';
+        sTxt += '            }';
+        sTxt += '            td.kmMobileHeaderSpacing {';
+        sTxt += '                padding-right: 10px !important';
+        sTxt += '            }';
+        sTxt += '            td.kmMobileHeaderNoSpacing {';
+        sTxt += '                padding-right: 0 !important';
+        sTxt += '            }';
+        sTxt += '            table.kmDesktopAutoWidth {';
+        sTxt += '                width: inherit !important';
+        sTxt += '            }';
+        sTxt += '            table.kmMobileAutoWidth {';
+        sTxt += '                width: 100% !important';
+        sTxt += '            }';
+        sTxt += '            table.kmTextContentContainer {';
+        sTxt += '                width: 100% !important';
+        sTxt += '            }';
+        sTxt += '            table.kmBoxedTextContentContainer {';
+        sTxt += '                width: 100% !important';
+        sTxt += '            }';
+        sTxt += '            td.kmImageContent {';
+        sTxt += '                padding-left: 0 !important;';
+        sTxt += '                padding-right: 0 !important';
+        sTxt += '            }';
+        sTxt += '            img.kmImage {';
+        sTxt += '                width: 100% !important';
+        sTxt += '            }';
+        sTxt += '            td.kmMobileStretch {';
+        sTxt += '                padding-left: 0 !important;';
+        sTxt += '                padding-right: 0 !important';
+        sTxt += '            }';
+        sTxt += '            table.kmSplitContentLeftContentContainer,';
+        sTxt += '            table.kmSplitContentRightContentContainer,';
+        sTxt += '            table.kmColumnContainer,';
+        sTxt += '            td.kmVerticalButtonBarContentOuter table.kmButtonBarContent,';
+        sTxt +=
+            '            td.kmVerticalButtonCollectionContentOuter table.kmButtonCollectionContent,';
+        sTxt += '            table.kmVerticalButton,';
+        sTxt += '            table.kmVerticalButtonContent {';
+        sTxt += '                width: 100% !important';
+        sTxt += '            }';
+        sTxt += '            td.kmButtonCollectionInner {';
+        sTxt += '                padding-left: 9px !important;';
+        sTxt += '                padding-right: 9px !important;';
+        sTxt += '                padding-top: 9px !important;';
+        sTxt += '                padding-bottom: 9px !important';
+        sTxt += '            }';
+        sTxt += '            td.kmVerticalButtonIconContent,';
+        sTxt += '            td.kmVerticalButtonTextContent,';
+        sTxt += '            td.kmVerticalButtonContentOuter {';
+        sTxt += '                padding-left: 0 !important;';
+        sTxt += '                padding-right: 0 !important;';
+        sTxt += '                padding-bottom: 9px !important';
+        sTxt += '            }';
+        sTxt += '            table.kmSplitContentLeftContentContainer td.kmTextContent,';
+        sTxt += '            table.kmSplitContentRightContentContainer td.kmTextContent,';
+        sTxt += '            table.kmColumnContainer td.kmTextContent,';
+        sTxt += '            table.kmSplitContentLeftContentContainer td.kmImageContent,';
+        sTxt += '            table.kmSplitContentRightContentContainer td.kmImageContent {';
+        sTxt += '                padding-top: 9px !important';
+        sTxt += '            }';
+        sTxt += '            td.rowContainer.kmFloatLeft,';
+        sTxt += '            td.rowContainer.kmFloatLeft,';
+        sTxt += '            td.rowContainer.kmFloatLeft.firstColumn,';
+        sTxt += '            td.rowContainer.kmFloatLeft.firstColumn,';
+        sTxt += '            td.rowContainer.kmFloatLeft.lastColumn,';
+        sTxt += '            td.rowContainer.kmFloatLeft.lastColumn {';
+        sTxt += '                float: left;';
+        sTxt += '                clear: both;';
+        sTxt += '                width: 100% !important';
+        sTxt += '            }';
+        sTxt += '            table.templateContainer,';
+        sTxt += '            table.templateContainer.brandingContainer,';
+        sTxt += '            div.templateContainer,';
+        sTxt += '            div.templateContainer.brandingContainer,';
+        sTxt += '            table.templateRow {';
+        sTxt += '                max-width: 600px !important;';
+        sTxt += '                width: 100% !important';
+        sTxt += '            }';
+        sTxt += '            h1 {';
+        sTxt += '                font-size: 30px !important;';
+        sTxt += '                line-height: 130% !important';
+        sTxt += '            }';
+        sTxt += '            h2 {';
+        sTxt += '                font-size: 22px !important;';
+        sTxt += '                line-height: 130% !important';
+        sTxt += '            }';
+        sTxt += '            h3 {';
+        sTxt += '                font-size: 22px !important;';
+        sTxt += '                line-height: 130% !important';
+        sTxt += '            }';
+        sTxt += '            h4 {';
+        sTxt += '                font-size: 16px !important;';
+        sTxt += '                line-height: 130% !important';
+        sTxt += '            }';
+        sTxt += '            td.kmTextContent {';
+        sTxt += '                font-size: 14px !important;';
+        sTxt += '                line-height: 130% !important';
+        sTxt += '            }';
+        sTxt += '            td.kmTextBlockInner td.kmTextContent {';
+        sTxt += '                padding-right: 18px !important;';
+        sTxt += '                padding-left: 18px !important';
+        sTxt += '            }';
+        sTxt += '            table.kmTableBlock.kmTableMobile td.kmTableBlockInner {';
+        sTxt += '                padding-left: 9px !important;';
+        sTxt += '                padding-right: 9px !important';
+        sTxt += '            }';
+        sTxt += '            table.kmTableBlock.kmTableMobile td.kmTableBlockInner .kmTextContent {';
+        sTxt += '                font-size: 14px !important;';
+        sTxt += '                line-height: 130% !important;';
+        sTxt += '                padding-left: 4px !important;';
+        sTxt += '                padding-right: 4px !important';
+        sTxt += '            }';
+        sTxt += '        }';
+        sTxt += '    </style>';
+        sTxt += '</head>';
+        sTxt +=
+            '<body style="margin:0;padding:0;font-family:"Raleway", Helvetica, sans-serif;font-weight:400;letter-spacing:0.75px;line-height:180%;background-color:#F2F2F2">';
+        sTxt += '    <center>';
+        sTxt +=
+            '        <table align="center" border="0" cellpadding="0" cellspacing="0" id="bodyTable" width="100%" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0;padding:0;background-color:#F2F2F2;height:100%;margin:0;width:100%">';
+        sTxt += '            <tbody>';
+        sTxt += '                <tr>';
+        sTxt +=
+            '                    <td align="center" id="bodyCell" valign="top" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0;padding-top:10px;padding-left:10px;padding-bottom:20px;padding-right:10px;border-top:0;height:100%;margin:0;width:100%">';
+        sTxt += '                        <!--[if !mso]>';
+        sTxt += '					<!-->';
+        sTxt +=
+            '                        <div class="templateContainer" style="border:0 none #aaa;background-color:#F2F2F2;border-radius:0;display: table; width:90%">';
+        sTxt += '                            <div class="templateContainerInner" style="padding:0">';
+        sTxt += '                                <!--';
+        sTxt += '							<![endif]-->';
+        sTxt += '                                <!--[if mso]>';
+        sTxt +=
+            '							<table border="0" cellpadding="0" cellspacing="0" class="templateContainer" width="90%" ';
+        sTxt +=
+            '                style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0;">';
+        sTxt += '								<tbody>';
+        sTxt += '									<tr>';
+        sTxt +=
+            '										<td class="templateContainerInner" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0;">';
+        sTxt += '											<![endif]-->';
+        sTxt +=
+            '                                <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0">';
+        sTxt += '                                    <tr>';
+        sTxt +=
+            '                                        <td align="center" valign="top" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0">';
+        sTxt +=
+            '                                            <table border="0" cellpadding="0" cellspacing="0" class="templateRow" width="100%" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0">';
+        sTxt += '                                                <tbody>';
+        sTxt += '                                                    <tr>';
+        sTxt +=
+            '                                                        <td class="rowContainer kmFloatLeft" valign="top" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0">';
+        sTxt +=
+            '                                                            <table border="0" cellpadding="0" cellspacing="0" class="kmTextBlock" width="100%" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0">';
+        sTxt +=
+            '                                                                <tbody class="kmTextBlockOuter">';
+        sTxt += '                                                                    <tr>';
+        sTxt +=
+            '                                                                        <td class="kmTextBlockInner" valign="top" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0;background-color:#FFFFFF;">';
+        sTxt +=
+            '                                                                            <table align="left" border="0" cellpadding="0" cellspacing="0" class="kmTextContentContainer" width="100%" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0">';
+        sTxt +=
+            '                                                                                <tbody>';
+        sTxt +=
+            '                                                                                    <tr>';
+        sTxt +=
+            '                                                                                        <td class="kmTextContent" valign="top" style="border-collapse:collapse;mso-table-lspace:0;mso-table-rspace:0;color:#272727;font-family:Helvetica, Arial;font-size:13px;line-height:200%;letter-spacing:normal;text-align:left;padding-top:40px;padding-bottom:40px;padding-left:40px;padding-right:40px;">';
+        sTxt +=
+            '                                                                                           <p>' +
+                sPhrase +
+                '<p>';
+        sTxt +=
+            '                                                                                        </td>';
+        sTxt +=
+            '                                                                                    </tr>';
+        sTxt +=
+            '                                                                                </tbody>';
+        sTxt += '                                                                            </table>';
+        sTxt += '                                                                        </td>';
+        sTxt += '                                                                    </tr>';
+        sTxt += '                                                                </tbody>';
+        sTxt += '                                                            </table>';
+        sTxt += '                                                        </td>';
+        sTxt += '                                                    </tr>';
+        sTxt += '                                                </tbody>';
+        sTxt += '                                            </table>';
+        sTxt += '                                        </td>';
+        sTxt += '                                    </tr>';
+        sTxt += '                                </table>';
+        sTxt += '                                <!--[if !mso]>';
+        sTxt += '															<!-->';
+        sTxt += '                            </div>';
+        sTxt += '                        </div>';
+        sTxt += '                        <!--';
+        sTxt += '													<![endif]-->';
+        sTxt += '                        <!--[if mso]>';
+        sTxt += '												</td>';
+        sTxt += '											</tr>';
+        sTxt += '										</tbody>';
+        sTxt += '									</table>';
+        sTxt += '									<![endif]-->';
+        sTxt += '                    </td>';
+        sTxt += '                </tr>';
+        sTxt += '            </tbody>';
+        sTxt += '        </table>';
+        sTxt += '    </center>';
+        sTxt += '</body>';
+        sTxt += '</html> ';
+        return sTxt;
+    }
+};
+exports.EmailService = EmailService;
+exports.EmailService = EmailService = EmailService_1 = __decorate([
+    (0, common_1.Injectable)()
+    /** Sends password lifecycle email. It deliberately does not expose whether an email exists to public callers. */
+    ,
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object])
+], EmailService);
+//# sourceMappingURL=EmailService.js.map