npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.84 → 2.0.0-dev.85 - Mend

emilsoftware-utilities 2.0.0-dev.84 → 2.0.0-dev.85

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1230) hide show

package/dist/accessi-service/services/permission-service/PermissionService.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"PermissionService.js","sourceRoot":"","sources":["../../../../src/accessi-service/services/permission-service/PermissionService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,sCAAmC;AACnC,kDAAmD;AAEnD,qCAA0D;AAmB1D,2CAAyE;AAYlE,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC1B,YACgD,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAC1E,CAAC;IAEG,kBAAkB,CAAC,MAA8C,EAAE,SAAS,GAAG,OAAO;;QAC1F,MAAM,QAAQ,GAAG,MAAA,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAG,SAAS,CAAC,mCAClC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAG,SAAS,CAAC,WAAW,EAAE,CAAC,mCACtC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,CAAC;QAC1B,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAEO,oBAAoB,CAAC,MAA8C,EAAE,SAAiB;QAC1F,OAAO,IAAI,GAAG,CACV,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAC,OAAA,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,CAAC,mCAAI,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA,EAAA,CAAC,CAC9E,CAAC;IACN,CAAC;IAEa,yBAAyB;6DAAC,aAAuB,EAAE;YAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG;;;;;;;;;;;;;0EAaoD,WAAW,CAAC,GAAG;aAC5E,CAAC;YAEN,OAAO,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC;iBACjF,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAuB,CAAC;QAClG,CAAC;KAAA;IAED;;;OAGG;IACW,iBAAiB,CAAC,KAAqB;;YACjD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CACpB,IAAI,GAAG,CACH,MAAM,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;iBACd,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;iBAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAC3C,CACJ,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,EAAE,CAAC;YACd,CAAC;YACD,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CACzB,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,8CAA8C,YAAY,GAAG,EAC7D,KAAK,CACR,CAAmC,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,eAAC,OAAA,MAAM,CAAC,MAAA,MAAA,GAAG,CAAC,MAAM,mCAAI,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA,EAAA,CAAC,CAAC,CAAC;YACtG,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,KAAK,CAAC;QACjB,CAAC;KAAA;IAED,qEAAqE;IAC7D,WAAW,CAAC,KAAa,EAAE,UAAoB;QACnD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO;YACH,GAAG,EAAE,oEAAoE,KAAK,mCAAmC,YAAY,IAAI;YACjI,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC;SAC1B,CAAC;IACN,CAAC;IAEa,wBAAwB;6DAAC,YAAoB,EAAE,aAAuB,EAAE;YAClF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtD,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;2FAcyD,WAAW,CAAC,GAAG;aAC7F,CAAC;YAEN,OAAO,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,iBAAiB,EAAE,CAAC,YAAY,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;iBAChH,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAuB,CAAC;QAClG,CAAC;KAAA;IAEa,YAAY;6DAAC,YAAoB,EAAE,aAAuB,EAAE;YACtE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;qCAgBU,WAAW,CAAC,GAAG;aACvC,CAAC;YACN,MAAM,WAAW,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,UAAU,EAAE,CAAC,YAAY,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;iBACxH,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAmC,CAAC;YAEjF,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;KAAA;IAED,iGAAiG;IACzF,aAAa,CAAC,WAA2C;QAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgB,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,gFAAgF;YAChF,8EAA8E;YAC9E,MAAM,mBAAmB,GAAG,GAAG,CAAC,gBAAgB,CAAC;YACjD,MAAM,sBAAsB,GAAG,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,IAAI,IAAI,mBAAmB,KAAK,EAAE;gBAC1H,CAAC,CAAC,uBAAgB,CAAC,OAAO;gBAC1B,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAClC,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC;gBAC7D,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,uBAAgB,CAAC,OAAO,CAAqB,CAAC;YAEpD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE;oBACtB,WAAW;oBACX,gBAAgB;oBAChB,IAAI,EAAE,EAAE;iBACX,CAAC,CAAC;YACP,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC;oBACjC,WAAW;oBACX,UAAU;oBACV,gBAAgB;iBACnB,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACK,aAAa,CACjB,YAAgC,EAChC,KAAa,EACb,YAAqB,EACrB,cAAkC;QAElC,IAAI,YAAY;YAAE,OAAO,cAAc,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,KAA6E,EAAE,EAAE;;YAC/F,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAA,KAAK,CAAC,gBAAgB,mCAAI,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;gBAAE,OAAO;YACrE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,IAAI,OAAO,GAAG,MAAM,CAAC,MAAA,QAAQ,CAAC,gBAAgB,mCAAI,CAAC,CAAC,EAAE,CAAC;gBAChE,4EAA4E;gBAC5E,8DAA8D;gBAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACzC,SAAS,CAAC,GAAG,CAAC,UAAU,gDACjB,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,GACf,KAA0B,KAC9B,UAAU,EACV,gBAAgB,EAAE,OAA2B,IAC/C,CAAC;YACP,CAAC;QACL,CAAC,CAAC;QAEF,KAAK,MAAM,YAAY,IAAI,YAAY;YAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAGD;;;OAGG;IACU,eAAe,CAAC,YAAoB,EAAE,gBAAmC;;YAClF,MAAM,oBAAoB,GAAG,gBAAgB;iBACxC,OAAO,CAAC,OAAO,CAAC,EAAE,WAAC,OAAA,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAA,EAAA,CAAC;iBACtC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;iBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAEzE,MAAM,WAAW,GAAG,8EAA8E,CAAC;YAEnG,oFAAoF;YACpF,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE;gBAC3D,EAAE,KAAK,EAAE,2CAA2C,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE;gBAC9E,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;aAC1E,CAAC,CAAC;QACP,CAAC;KAAA;IAGD,qFAAqF;IACxE,iBAAiB,CAAC,YAAoB;;YAC/C,MAAM,KAAK,GAAG,2CAA2C,CAAC;YAC1D,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAClF,CAAC;KAAA;IAED;;;OAGG;IACU,kBAAkB;6DAAC,IAAU,EAAE,cAA6B,IAAI;YACzE,6GAA6G;YAC7G,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;;gBACjF,IAAI,mBAAmB,GAAG,WAAW,CAAC;gBAEtC,IAAI,mBAAmB,IAAI,IAAI,EAAE,CAAC;oBAC9B,MAAM,iBAAiB,GAAG,MAAM,SAAG,CAAC,gBAAgB,CAChD,WAAW,EACX,wDAAwD,EACxD,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAC1B,CAAC;oBACF,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAwC,CAAC;oBACzI,MAAM,cAAc,GAAG,MAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,MAAM,mCAAI,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,MAAM,CAAC;oBAClE,MAAM,iBAAiB,GAAG,OAAO,cAAc,KAAK,QAAQ;wBACxD,CAAC,CAAC,cAAc;wBAChB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,cAAc,aAAd,cAAc,cAAd,cAAc,GAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;oBACrD,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;wBAClC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;oBACpF,CAAC;oBACD,mBAAmB,GAAG,iBAAiB,CAAC;gBAC5C,CAAC;qBAAM,CAAC;oBACJ,MAAM,SAAG,CAAC,gBAAgB,CACtB,WAAW,EACX,8CAA8C,EAC9C,CAAC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAC/C,CAAC;oBAEF,MAAM,SAAG,CAAC,gBAAgB,CACtB,WAAW,EACX,wCAAwC,EACxC,CAAC,mBAAmB,CAAC,CACxB,CAAC;gBACN,CAAC;gBAED,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBACpF,CAAC;gBAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC3B,MAAM,SAAG,CAAC,gBAAgB,CACtB,WAAW,EACX,iEAAiE,EACjE,CAAC,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAChE,CAAC;gBACN,CAAC;YACL,CAAC,CAAA,CAAC,CAAC;QACP,CAAC;KAAA;IAGD,oGAAoG;IACvF,iBAAiB;;YAC1B,MAAM,KAAK,GAAG;;;;;;;;;;;;aAYT,CAAC;YAEN,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;iBAC3E,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAmC,CAAC;YAEjF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgB,CAAC;YAEzC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACvB,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC5C,MAAM,gBAAgB,GAAG,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrG,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnF,MAAM,mBAAmB,GAAG,GAAG,CAAC,gBAAgB,CAAC;gBAEjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE;wBACtB,WAAW;wBACX,gBAAgB;wBAChB,IAAI,EAAE,EAAE;qBACX,CAAC,CAAC;gBACP,CAAC;gBAED,MAAM,gBAAgB,GAAG,OAAO,mBAAmB,KAAK,QAAQ;oBAC5D,CAAC,CAAC,mBAAmB;oBACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,mBAAmB,aAAnB,mBAAmB,cAAnB,mBAAmB,GAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAE1D,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,uBAAgB,CAAC,OAAO,EAAE,CAAC;oBAChG,SAAS;gBACb,CAAC;gBAED,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC;oBACjC,WAAW;oBACX,UAAU;oBACV,gBAAgB,EAAE,gBAAoC;iBACzD,CAAC,CAAC;YACP,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;KAAA;IAGD;;;OAGG;IACU,iBAAiB,CAAC,YAAoB,EAAE,KAAe;;YAEhE,MAAM,eAAe,GAAG,8CAA8C,CAAC;YACvE,IAAI,MAAM,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YAEnG,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,cAAc,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAC9B,IAAI,GAAG,CACH,KAAK;iBACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;iBACnD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAC5D,CACJ,CAAC;YAEF,MAAM,iBAAiB,GAAG;gBACtB,EAAE,KAAK,EAAE,2CAA2C,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE;gBAC9E,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;oBACrC,KAAK,EAAE,yDAAyD;oBAChE,MAAM,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;iBACtC,CAAC,CAAC;aACN,CAAC;YAEF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,4EAA4E;gBAC5E,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/D,MAAM,mBAAmB,GAAG,MAAM,SAAG,CAAC,KAAK,CACvC,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,6CAA6C,YAAY,GAAG,EAC5D,eAAe,CAClB,CAAC;gBACF,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;gBAC/E,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,uBAAuB,WAAW,cAAc,CAAC,CAAC;gBACtE,CAAC;YACL,CAAC;YAED,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAElF,MAAM,mBAAmB,GAAG,MAAM,SAAG,CAAC,KAAK,CACvC,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,oDAAoD,EACpD,CAAC,YAAY,CAAC,CACjB,CAAC;YACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACxE,IAAI,kBAAkB,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CACX,6CAA6C,YAAY,YAAY,eAAe,CAAC,MAAM,aAAa,kBAAkB,GAAG,CAChI,CAAC;YACN,CAAC;QACL,CAAC;KAAA;IAGD;;;OAGG;IACU,uBAAuB,CAAC,YAAoB,EAAE,WAAyB;;YAEhF,MAAM,eAAe,GAAG,8CAA8C,CAAC;YACvE,IAAI,MAAM,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YAEnG,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,cAAc,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,qBAAqB,GAAG,KAAK,CAAC,IAAI,CACpC,IAAI,GAAG,CACH,WAAW;iBACN,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;;gBAAC,OAAA,CAAC;oBAClB,UAAU,EAAE,GAAG,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,UAAU,mCAAI,EAAE,EAAE,CAAC,IAAI,EAAE;oBACpD,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,gBAAgB,mCAAI,EAAE,EAAE,EAAE,EAAE,CAAC;iBACjF,CAAC,CAAA;aAAA,CAAC;iBACF,MAAM,CACH,CAAC,UAAU,EAAE,EAAE,CACX,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CACxF;iBACA,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAU,CAAC,CACzE,CAAC,MAAM,EAAE,CACb,CAAC;YAEF,MAAM,iBAAiB,GAAG;gBACtB,EAAE,KAAK,EAAE,2CAA2C,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE;gBAC9E,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;oBAC1C,KAAK,EAAE,oEAAoE;oBAC3E,MAAM,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,gBAAgB,CAAC;iBAC7E,CAAC,CAAC;aACN,CAAC;YAEF,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,4EAA4E;gBAC5E,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBACnF,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM,mBAAmB,GAAG,MAAM,SAAG,CAAC,KAAK,CACvC,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4CAA4C,YAAY,GAAG,EAC3D,SAAS,CACZ,CAAC;gBACF,MAAM,aAAa,GAAG,IAAI,GAAG,CACzB,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,eAAC,OAAA,MAAM,CAAC,MAAA,MAAC,GAA+B,CAAC,MAAM,mCAAK,GAA+B,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAA,EAAA,CAAC,CACrI,CAAC;gBACF,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;gBACnF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,WAAW,cAAc,CAAC,CAAC;gBACrE,CAAC;YACL,CAAC;YAED,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAElF,MAAM,yBAAyB,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7C,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,oDAAoD,EACpD,CAAC,YAAY,CAAC,CACjB,CAAC;YACF,MAAM,wBAAwB,GAAG,IAAI,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;YACpF,IAAI,wBAAwB,KAAK,qBAAqB,CAAC,MAAM,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACX,oDAAoD,YAAY,YAAY,qBAAqB,CAAC,MAAM,aAAa,wBAAwB,GAAG,CACnJ,CAAC;YACN,CAAC;QACL,CAAC;KAAA;IAGD,mHAAmH;IACtG,UAAU,CAAC,WAAmB;;YAEvC,MAAM,WAAW,GAAG,6CAA6C,CAAC;YAClE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YAEhG,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,uBAAuB,WAAW,cAAc,CAAC,CAAC;YACtE,CAAC;YAED,oEAAoE;YACpE,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE;gBAC3D,EAAE,KAAK,EAAE,wCAAwC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;gBAC1E,EAAE,KAAK,EAAE,2CAA2C,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;gBAC7E,EAAE,KAAK,EAAE,oCAAoC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;aACzE,CAAC,CAAC;QAEP,CAAC;KAAA;IAGD,wGAAwG;IAC3F,QAAQ,CAAC,KAAc;;YAChC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG;;;;;;;;;;;;;;0EAcoD,WAAW,CAAC,GAAG;;aAE5E,CAAC;YAEN,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/F,OAAO,MAAM,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAA4B,CAAC;QACvF,CAAC;KAAA;IAGD;;;OAGG;IACU,kBAAkB;6DAAC,eAAe,GAAG,KAAK,EAAE,KAAc;YACnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtD,IAAI,aAAa,GAAG,eAAe;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,uEAAuE,CAAC;YAC9E,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;gBAClB,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,GAAG,EAAE,CAAC;YAC3G,CAAC;YAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;kBAgBJ,aAAa;;aAElB,CAAC;YAEN,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAE/F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;YAEJ,MAAM,CAAC,OAAO,CAAC,CAAC,GAAY,EAAE,EAAE;;gBAC5B,MAAM,SAAS,GAAG,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAGzD,CAAC;gBAEF,MAAM,EAAE,WAAW,EAAE,YAAY,KAAkB,SAAS,EAAtB,QAAQ,UAAK,SAAS,EAAtD,+BAA0C,CAAY,CAAC;gBAC7D,MAAM,kBAAkB,GAAG,MAAA,QAAQ,CAAC,YAAY,mCAAI,eAAe,CAAC;gBACpE,MAAM,gBAAgB,GAClB,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,YAAY,KAAK,IAAI,CAAC;gBACtF,MAAM,eAAe,GACjB,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,KAAK,IAAI,CAAC;gBAEzF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBACpC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE;wBAC7B,YAAY,EAAE,MAAA,QAAQ,CAAC,YAAY,mCAAI,kBAAkB;wBACzD,iBAAiB,EAAE,MAAA,QAAQ,CAAC,iBAAiB,mCAAI,EAAE;wBACnD,YAAY,EAAE,QAAQ,CAAC,YAAY;wBACnC,OAAO,EAAE,gBAAgB;wBACzB,KAAK,EAAE,EAAE;qBACZ,CAAC,CAAC;gBACP,CAAC;gBAED,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;oBACtB,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAE,CAAC,KAAK,CAAC,IAAI,iCACrC,QAAQ,KACX,OAAO,EAAE,eAAe,IAC1B,CAAC;gBACP,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;iBAC5C,GAAG,CAAC,KAAK,CAAC,EAAE;;gBAAC,OAAA,iCACP,KAAK,KACR,KAAK,EAAE,CAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,eACL,OAAA,CAAC,MAAA,CAAC,CAAC,UAAU,mCAAI,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAA,CAAC,CAAC,UAAU,mCAAI,MAAM,CAAC,gBAAgB,CAAC,CAAA,EAAA,CAC5F,IACH,CAAA;aAAA,CAAC;iBACF,IAAI,CACD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,eACL,OAAA,CAAC,MAAA,CAAC,CAAC,YAAY,mCAAI,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAA,CAAC,CAAC,YAAY,mCAAI,MAAM,CAAC,gBAAgB,CAAC,CAAA,EAAA,CAChG,CAAC;YAEN,OAAO,WAAW,CAAC;QACvB,CAAC;KAAA;IAED,0EAA0E;IAC1E,gEAAgE;IAChE,uEAAuE;IACvE,6EAA6E;IAC7E,0EAA0E;IAE5D,UAAU,CAAC,KAAa,EAAE,MAAc,EAAE,KAAc;;YAClE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,wBAAwB,KAAK,UAAU,MAAM,MAAM,EACnD,CAAC,KAAK,CAAC,CACV,CAAC;YACF,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;KAAA;IAEa,qBAAqB,CAAC,YAAoB;;YACpD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,YAAY,cAAc,CAAC,CAAC;YAChF,CAAC;QACL,CAAC;KAAA;IAEa,oBAAoB,CAAC,UAAkB;;YACjD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,UAAU,cAAc,CAAC,CAAC;YAC5E,CAAC;QACL,CAAC;KAAA;IAED,6EAA6E;IAChE,YAAY;;YACrB,MAAM,KAAK,GAAG,yFAAyF,CAAC;YACxG,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAgC,CAAC;QAC3F,CAAC;KAAA;IAEY,cAAc,CAAC,KAA4B;;;YACpD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,KAAK,CAAC,UAAU,cAAc,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,sDAAsD,EACtD,CAAC,KAAK,CAAC,UAAU,EAAE,MAAA,KAAK,CAAC,eAAe,mCAAI,IAAI,CAAC,CACpD,CAAC;QACN,CAAC;KAAA;IAEY,cAAc,CAAC,UAAkB,EAAE,KAA4B;;YACxE,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;gBAAE,OAAO;YAChD,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,kDAAkD,EAClD,CAAC,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CACtC,CAAC;QACN,CAAC;KAAA;IAED,4FAA4F;IAC/E,cAAc,CAAC,UAAkB;;YAC1C,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YACjE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,4BAAmB,CACzB,iCAAiC,UAAU,KAAK,IAAI,sBAAsB,CAC7E,CAAC;YACN,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,wCAAwC,EACxC,CAAC,UAAU,CAAC,CACf,CAAC;QACN,CAAC;KAAA;IAEY,eAAe,CAAC,KAA6B;;;YACtD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,KAAK,CAAC,YAAY,cAAc,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,+EAA+E,EAC/E;gBACI,KAAK,CAAC,YAAY;gBAClB,MAAA,KAAK,CAAC,iBAAiB,mCAAI,IAAI;gBAC/B,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAA,KAAK,CAAC,YAAY,mCAAI,CAAC;aAC1B,CACJ,CAAC;QACN,CAAC;KAAA;IAEY,eAAe,CAAC,YAAoB,EAAE,KAA6B;;YAC5E,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAE/C,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAE9B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1B,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uBAAuB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EACzD,MAAM,CACT,CAAC;QACN,CAAC;KAAA;IAED,iFAAiF;IACpE,eAAe,CAAC,YAAoB;;YAC7C,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YACnE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,4BAAmB,CACzB,mCAAmC,YAAY,cAAc,IAAI,QAAQ,CAC5E,CAAC;YACN,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uCAAuC,EACvC,CAAC,YAAY,CAAC,CACjB,CAAC;QACN,CAAC;KAAA;IAEY,UAAU,CAAC,KAAwB;;;YAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,4BAAmB,CAAC,WAAW,KAAK,CAAC,UAAU,cAAc,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5D,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC;mDACuC,EACvC;gBACI,KAAK,CAAC,UAAU;gBAChB,MAAA,KAAK,CAAC,eAAe,mCAAI,IAAI;gBAC7B,KAAK,CAAC,YAAY;gBAClB,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAA,KAAK,CAAC,KAAK,mCAAI,IAAI;gBACnB,MAAA,KAAK,CAAC,UAAU,mCAAI,IAAI;gBACxB,MAAA,KAAK,CAAC,IAAI,mCAAI,IAAI;gBAClB,MAAA,KAAK,CAAC,MAAM,mCAAI,IAAI;gBACpB,MAAA,KAAK,CAAC,OAAO,mCAAI,IAAI;gBACrB,MAAA,KAAK,CAAC,IAAI,mCAAI,IAAI;aACrB,CACJ,CAAC;QACN,CAAC;KAAA;IAEY,UAAU,CAAC,UAAkB,EAAE,KAAwB;;YAChE,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,4BAAmB,CAAC,WAAW,UAAU,cAAc,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC3F,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5D,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAE9B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,mBAAmB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EACrD,MAAM,CACT,CAAC;QACN,CAAC;KAAA;IAED,+EAA+E;IAClE,UAAU,CAAC,UAAkB;;YACtC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,4BAAmB,CAAC,WAAW,UAAU,cAAc,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE;gBAC3D,EAAE,KAAK,EAAE,2CAA2C,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;gBAC5E,EAAE,KAAK,EAAE,wCAAwC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;gBACzE,EAAE,KAAK,EAAE,mCAAmC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;aACvE,CAAC,CAAC;QACP,CAAC;KAAA;IAGD;;;OAGG;IACU,qBAAqB,CAAC,YAAoB,EAAE,KAAc;;;YAKnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,iBAAiB,GAAG,mEAAmE,CAAC;YAC9F,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,iBAAiB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YACvG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,YAAY,CAAC,CAAC;YAEjH,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CACjC,MAAC,MAAM,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAyC,0CAAE,SAAS,CAC1G,CAAC;YAEF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YACnF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAC7B,YAAY,EACZ,KAAK,EACL,YAAY,EACZ,MAAM,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CACnD,CAAC;YAEF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;KAAA;IAEO,WAAW,CAAC,KAAc;QAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACU,sBAAsB,CAAC,YAAsB,EAAE,KAAc;;;YAKtE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2F,CAAC;YAClH,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7F,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC;YAClB,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEnD,MAAM,SAAS,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC9B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,8FAA8F,YAAY,GAAG,EAC7G,GAAG,CACN,CAAC,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAmC,CAAC;YAC/E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAClC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CACnC,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC;;;;;;;;;;;;;;iCAcqB,YAAY,2DAA2D,WAAW,CAAC,GAAG,EAAE,EAC7G,CAAC,GAAG,GAAG,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAClC,CAAC,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAmC,CAAC;YAE/E,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC;;;;;;;;;;;;;kCAasB,YAAY,IAAI,WAAW,CAAC,GAAG,EAAE,EACvD,CAAC,GAAG,GAAG,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAClC,CAAC,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAmC,CAAC;YAE/E,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;YAExE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA8B,CAAC;YAChE,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBAC/B,MAAM,EAAE,YAAY,KAAe,GAAG,EAAb,KAAK,UAAK,GAAG,EAAhC,gBAA0B,CAAM,CAAC;gBACvC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,MAAM,EAAE,CAAC;oBACT,MAAM,CAAC,IAAI,CAAC,KAAoC,CAAC,CAAC;gBACtD,CAAC;qBAAM,CAAC;oBACJ,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAoC,CAAC,CAAC,CAAC;gBACvE,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0C,CAAC;YACtE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,EAAE,YAAY,KAAiB,GAAG,EAAf,OAAO,UAAK,GAAG,EAAlC,gBAA4B,CAAM,CAAC;gBACzC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,MAAM,EAAE,CAAC;oBACT,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACJ,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpC,CAAC;YACL,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACnB,MAAM,YAAY,GAAG,MAAA,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE,CAAC;gBACrD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,MAAA,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE,CAAC,CAAC;gBAC5D,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;oBACX,YAAY;oBACZ,KAAK;oBACL,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,CAAC;iBAChF,CAAC,CAAC;YACP,CAAC;YAED,OAAO,MAAM,CAAC;QAClB,CAAC;KAAA;IAID,0EAA0E;IAC1E,yDAAyD;IACzD,0EAA0E;IAElE,kBAAkB,CAAC,KAAa;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,4BAAmB,CACzB,wFAAwF,CAC3F,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAEa,iBAAiB,CAAC,WAAmB;;YAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,4BAAmB,CAAC,YAAY,WAAW,cAAc,CAAC,CAAC;YACzE,CAAC;QACL,CAAC;KAAA;IAEa,gBAAgB,CAAC,UAAkB;;YAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,4BAAmB,CAAC,WAAW,UAAU,cAAc,CAAC,CAAC;YACvE,CAAC;QACL,CAAC;KAAA;IAED,uFAAuF;IAC1E,SAAS;;YAClB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CACxB,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,mEAAmE,EACnE,EAAE,CACL,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAA6B,CAAC;QACtF,CAAC;KAAA;IAEY,WAAW,CAAC,KAAyB;;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,4BAAmB,CAAC,YAAY,MAAM,cAAc,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,iDAAiD,EACjD,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CACvB,CAAC;QACN,CAAC;KAAA;IAEY,WAAW,CAAC,WAAmB,EAAE,KAAyB;;YACnE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO;YACrC,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,6CAA6C,EAC7C,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CACvB,CAAC;QACN,CAAC;KAAA;IAED,wFAAwF;IAC3E,WAAW,CAAC,WAAmB;;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,SAAG,CAAC,OAAO,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,qCAAqC,EACrC,CAAC,MAAM,CAAC,CACX,CAAC;QACN,CAAC;KAAA;IAED,iCAAiC;IACpB,aAAa,CAAC,UAAkB;;YACzC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CACxB,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,kFAAkF,EAClF,CAAC,IAAI,CAAC,CACT,CAAC;YACF,OAAO,IAAI;iBACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,eAAC,OAAA,MAAM,CAAC,MAAA,MAAC,GAA+B,CAAC,YAAY,mCAAK,GAA+B,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA,EAAA,CAAC;iBAChI,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;KAAA;IAED,wDAAwD;IAC3C,aAAa,CAAC,UAAkB,EAAE,MAAgB;;YAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CACzB,IAAI,GAAG,CAAC,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CACzE,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,OAAO,GAAG;gBACZ,EAAE,KAAK,EAAE,+CAA+C,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE;gBAC1E,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC1B,KAAK,EAAE,mEAAmE;oBAC1E,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;iBACxB,CAAC,CAAC;aACN,CAAC;YACF,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC5E,CAAC;KAAA;IAED,8EAA8E;IACjE,aAAa,CAAC,WAAmB,EAAE,KAAe;;YAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CACzB,IAAI,GAAG,CAAC,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAChG,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,OAAO,GAAG;gBACZ,EAAE,KAAK,EAAE,gDAAgD,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;gBAC5E,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACzB,KAAK,EAAE,mEAAmE;oBAC1E,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;iBACxB,CAAC,CAAC;aACN,CAAC;YACF,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC5E,CAAC;KAAA;CAEJ,CAAA;AA/kCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAGJ,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAFrB,iBAAiB,CA+kC7B","sourcesContent":["\nimport { Orm } from \"../../../Orm\";\nimport { RestUtilities } from \"../../../Utilities\";\nimport type { AccessiOptions } from \"../../AccessiModule\";\nimport { Permission, TipoAbilitazione } from \"../../dtos\";\nimport { AbilitazioneMenu } from \"../../dtos/AbilitazioneMenu\";\nimport { GroupWithMenusEntity } from \"../../dtos/GetGroupsWithMenusResponse\";\nimport { MenuEntity } from \"../../dtos/GetMenusResponse\";\nimport { Role } from \"../../dtos/Role\";\nimport {\n CreateMenuGroupRequest,\n CreateMenuRequest,\n CreateMenuTypeRequest,\n MenuTypeEntity,\n UpdateMenuGroupRequest,\n UpdateMenuRequest,\n UpdateMenuTypeRequest,\n} from \"../../dtos/CatalogDtos\";\nimport {\n CreateScopeRequest,\n ScopeEntity,\n UpdateScopeRequest,\n} from \"../../dtos/ScopeDtos\";\nimport { BadRequestException, Inject, Injectable } from \"@nestjs/common\";\n\n/** Struttura storica menu/gruppi accettata dall'API legacy `addAbilitazioni`. */\ntype LegacyMenuGroup = {\n menu?: Array<{\n flgChk?: unknown;\n codiceMenu?: unknown;\n tipoAbilitazione?: unknown;\n }>;\n};\n\n@Injectable()\nexport class PermissionService {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions\n ) { }\n\n private getCountFromResult(result: ReadonlyArray<Record<string, unknown>>, fieldName = 'COUNT'): number {\n const rawValue = result?.[0]?.[fieldName]\n ?? result?.[0]?.[fieldName.toLowerCase()]\n ?? result?.[0]?.count;\n return typeof rawValue === 'number' ? rawValue : Number.parseInt(`${rawValue ?? '0'}`, 10);\n }\n\n private extractIntegerColumn(result: ReadonlyArray<Record<string, unknown>>, fieldName: string): Set<number> {\n return new Set(\n result.map((row) => Number(row[fieldName] ?? row[fieldName.toLowerCase()])),\n );\n }\n\n private async getAllActiveMenusAsGrants(scopeCodes: string[] = []): Promise<AbilitazioneMenu[]> {\n const scopeFilter = this.scopeFilter('M', scopeCodes);\n const query = `\n SELECT\n M.CODMNU AS codice_menu,\n 30 AS tipo_abilitazione,\n M.DESMNU AS descrizione_menu,\n G.DESGRP AS descrizione_gruppo,\n G.CODGRP AS codice_gruppo,\n M.ICON AS icona,\n M.CODTIP AS tipo,\n M.PAGINA AS pagina,\n M.NOTE AS note\n FROM MENU M\n LEFT JOIN MENU_GRP G ON G.CODGRP = M.CODGRP\n WHERE M.FLGENABLED = 1 AND COALESCE(G.FLGENABLED, 1) = 1${scopeFilter.sql}\n `;\n\n return await Orm.query(this.accessiOptions.databaseOptions, query, scopeFilter.params)\n .then(results => results.map(RestUtilities.convertKeysToCamelCase)) as AbilitazioneMenu[];\n }\n\n /**\n * Normalizza e valida il filtro `scope` (CSV). Restituisce i codici in\n * maiuscolo; lista vuota significa \"nessun filtro\" (comportamento storico).\n */\n private async resolveScopeCodes(scope?: string | null): Promise<string[]> {\n const codes = Array.from(\n new Set(\n String(scope ?? '')\n .split(',')\n .map((value) => value.trim().toUpperCase())\n .filter((value) => value.length > 0),\n ),\n );\n if (codes.length === 0) {\n return [];\n }\n const placeholders = codes.map(() => '?').join(', ');\n const rows = (await Orm.query(\n this.accessiOptions.databaseOptions,\n `SELECT CODICE FROM SCOPES WHERE CODICE IN (${placeholders})`,\n codes,\n )) as Array<Record<string, unknown>>;\n const known = new Set(rows.map((row) => String(row.CODICE ?? row.codice ?? '').trim().toUpperCase()));\n const missing = codes.filter((code) => !known.has(code));\n if (missing.length > 0) {\n throw new BadRequestException(`Scope non validi: ${missing.join(', ')}.`);\n }\n return codes;\n }\n\n /** Clausola SQL EXISTS per filtrare i menu sugli scope richiesti. */\n private scopeFilter(alias: string, scopeCodes: string[]): { sql: string; params: string[] } {\n if (scopeCodes.length === 0) {\n return { sql: '', params: [] };\n }\n const placeholders = scopeCodes.map(() => '?').join(', ');\n return {\n sql: ` AND EXISTS (SELECT 1 FROM MENU_SCOPES MS WHERE MS.CODICE_MENU = ${alias}.CODMNU AND MS.CODICE_SCOPE IN (${placeholders}))`,\n params: [...scopeCodes],\n };\n }\n\n private async getUserDirectPermissions(codiceUtente: number, scopeCodes: string[] = []): Promise<AbilitazioneMenu[]> {\n const scopeFilter = this.scopeFilter('M', scopeCodes);\n const queryAbilitazioni = `\n SELECT\n A.CODMNU AS codice_menu,\n A.TIPABI AS tipo_abilitazione,\n M.DESMNU AS descrizione_menu,\n G.DESGRP AS descrizione_gruppo,\n G.CODGRP AS codice_gruppo,\n M.ICON AS icona,\n M.CODTIP AS tipo,\n M.PAGINA AS pagina,\n M.NOTE AS note\n FROM ABILITAZIONI A\n INNER JOIN MENU M ON A.CODMNU = M.CODMNU\n LEFT JOIN MENU_GRP G ON G.CODGRP = M.CODGRP\n WHERE A.CODUTE = ? AND M.FLGENABLED = 1 AND COALESCE(G.FLGENABLED, 1) = 1${scopeFilter.sql}\n `;\n\n return await Orm.query(this.accessiOptions.databaseOptions, queryAbilitazioni, [codiceUtente, ...scopeFilter.params])\n .then(results => results.map(RestUtilities.convertKeysToCamelCase)) as AbilitazioneMenu[];\n }\n\n private async getUserRoles(codiceUtente: number, scopeCodes: string[] = []): Promise<Role[]> {\n const scopeFilter = this.scopeFilter('M', scopeCodes);\n const queryRuoli = `\n SELECT\n R.CODRUO AS codice_ruolo,\n R.DESRUO AS descrizione_ruolo,\n CASE WHEN COALESCE(G.FLGENABLED, 1) = 1 THEN M.CODMNU END AS codice_menu,\n RM.TIPABI AS tipo_abilitazione,\n M.DESMNU AS descrizione_menu,\n M.NOTE AS note\n FROM UTENTI_RUOLI RU\n INNER JOIN RUOLI R ON RU.CODRUO = R.CODRUO\n LEFT JOIN RUOLI_MNU RM ON R.CODRUO = RM.CODRUO\n LEFT JOIN MENU M\n ON RM.CODMNU = M.CODMNU\n AND M.FLGENABLED = 1\n LEFT JOIN MENU_GRP G\n ON G.CODGRP = M.CODGRP\n WHERE RU.CODUTE = ?${scopeFilter.sql}\n `;\n const ruoliResult = (await Orm.query(this.accessiOptions.databaseOptions, queryRuoli, [codiceUtente, ...scopeFilter.params]))\n .map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>;\n\n return this.assembleRoles(ruoliResult);\n }\n\n /** Costruisce l'albero ruoli/menu a partire dalle righe (riusato da lettura singola e batch). */\n private assembleRoles(ruoliResult: Array<Record<string, unknown>>): Role[] {\n const ruoliMap = new Map<number, Role>();\n for (const row of ruoliResult) {\n const codiceRuolo = Number(row.codiceRuolo);\n const descrizioneRuolo = typeof row.descrizioneRuolo === 'string' ? row.descrizioneRuolo.trim() : '';\n const codiceMenu = typeof row.codiceMenu === 'string' ? row.codiceMenu : undefined;\n // RUOLI_MNU.TIPABI e MENU.DESMNU sono nullable nello schema storico: un livello\n // mancante non deve far sparire il menu dal ruolo. Default prudente: lettura.\n const rawTipoAbilitazione = row.tipoAbilitazione;\n const parsedTipoAbilitazione = rawTipoAbilitazione === undefined || rawTipoAbilitazione === null || rawTipoAbilitazione === ''\n ? TipoAbilitazione.LETTURA\n : Number(rawTipoAbilitazione);\n const tipoAbilitazione = (Number.isFinite(parsedTipoAbilitazione)\n ? parsedTipoAbilitazione\n : TipoAbilitazione.LETTURA) as TipoAbilitazione;\n\n if (!ruoliMap.has(codiceRuolo)) {\n ruoliMap.set(codiceRuolo, {\n codiceRuolo,\n descrizioneRuolo,\n menu: []\n });\n }\n\n if (codiceMenu) {\n ruoliMap.get(codiceRuolo)!.menu.push({\n codiceRuolo,\n codiceMenu,\n tipoAbilitazione,\n });\n }\n }\n\n return Array.from(ruoliMap.values());\n }\n\n /**\n * Compone i grant effettivi: permessi diretti e ruoli si sommano per codice menu\n * prendendo il livello massimo. Un livello 0/non valido non rimuove un grant del ruolo.\n * I superutenti ricevono tutti i menu attivi al livello massimo.\n */\n private composeGrants(\n abilitazioni: AbilitazioneMenu[],\n ruoli: Role[],\n isSuperAdmin: boolean,\n allActiveMenus: AbilitazioneMenu[],\n ): AbilitazioneMenu[] {\n if (isSuperAdmin) return allActiveMenus;\n\n const catalog = new Map(allActiveMenus.map((menu) => [menu.codiceMenu, menu]));\n const grantsMap = new Map<string, AbilitazioneMenu>();\n const addGrant = (grant: AbilitazioneMenu | { codiceMenu?: string; tipoAbilitazione?: unknown }) => {\n const codiceMenu = typeof grant.codiceMenu === 'string' ? grant.codiceMenu.trim() : '';\n const livello = Number(grant.tipoAbilitazione ?? 0);\n if (!codiceMenu || !Number.isFinite(livello) || livello <= 0) return;\n const existing = grantsMap.get(codiceMenu);\n if (!existing || livello > Number(existing.tipoAbilitazione ?? 0)) {\n // I ruoli salvano solo codice e livello: completa i metadati di navigazione\n // (pagina, icona, gruppo, tipo) dal catalogo dei menu attivi.\n const metadata = catalog.get(codiceMenu);\n grantsMap.set(codiceMenu, {\n ...(metadata ?? {}),\n ...(grant as AbilitazioneMenu),\n codiceMenu,\n tipoAbilitazione: livello as TipoAbilitazione,\n });\n }\n };\n\n for (const abilitazione of abilitazioni) addGrant(abilitazione);\n for (const ruolo of ruoli) {\n for (const menu of ruolo.menu) addGrant(menu);\n }\n\n return Array.from(grantsMap.values());\n }\n\n\n /**\n * API legacy per salvare grant dalla struttura storica menu/gruppi.\n * Sostituisce tutti i grant diretti dell'utente; per le nuove integrazioni preferire `assignPermissionsToUser`.\n */\n public async addAbilitazioni(codiceUtente: number, menuAbilitazioni: LegacyMenuGroup[]): Promise<void> {\n const abilitazioniToInsert = menuAbilitazioni\n .flatMap(menuGrp => menuGrp.menu ?? [])\n .filter(menu => menu.flgChk)\n .map(menu => [codiceUtente, menu.codiceMenu, menu.tipoAbilitazione]);\n\n const insertQuery = `UPDATE OR INSERT INTO ABILITAZIONI (CODUTE, CODMNU, TIPABI) VALUES (?, ?, ?)`;\n\n // Delete + insert atomici: un errore a metà non lascia l'utente senza abilitazioni.\n await Orm.executeMultiple(this.accessiOptions.databaseOptions, [\n { query: `DELETE FROM ABILITAZIONI WHERE CODUTE = ?`, params: [codiceUtente] },\n ...abilitazioniToInsert.map(params => ({ query: insertQuery, params })),\n ]);\n }\n\n\n /** Rimuove tutti i grant diretti, senza toccare ruoli o menu ereditati dai ruoli. */\n public async resetAbilitazioni(codiceUtente: number): Promise<void> {\n const query = \"DELETE FROM ABILITAZIONI WHERE CODUTE = ?\";\n await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n }\n\n /**\n * Crea o aggiorna un ruolo. In aggiornamento la lista `role.menu` sostituisce integralmente i menu del ruolo.\n * Validare i codici menu nel chiamante quando si usano dati non provenienti dalla console o dalle API Accessi.\n */\n public async updateOrInsertRole(role: Role, codiceRuolo: number | null = null): Promise<void> {\n // Ruolo, sostituzione menu e inserimenti in un'unica transazione: niente ruoli senza menu in caso di errore.\n await Orm.withTransaction(this.accessiOptions.databaseOptions, async (transaction) => {\n let resolvedCodiceRuolo = codiceRuolo;\n\n if (resolvedCodiceRuolo == null) {\n const createdRoleResult = await Orm.transactionQuery<unknown>(\n transaction,\n `INSERT INTO RUOLI (DESRUO) VALUES (?) RETURNING CODRUO`,\n [role.descrizioneRuolo],\n );\n const createdRole = (Array.isArray(createdRoleResult) ? createdRoleResult[0] : createdRoleResult) as Record<string, unknown> | undefined;\n const rawCodiceRuolo = createdRole?.CODRUO ?? createdRole?.codruo;\n const parsedCodiceRuolo = typeof rawCodiceRuolo === 'number'\n ? rawCodiceRuolo\n : Number.parseInt(`${rawCodiceRuolo ?? ''}`, 10);\n if (Number.isNaN(parsedCodiceRuolo)) {\n throw new Error('Creazione ruolo non riuscita: impossibile recuperare CODRUO.');\n }\n resolvedCodiceRuolo = parsedCodiceRuolo;\n } else {\n await Orm.transactionQuery(\n transaction,\n `UPDATE RUOLI SET DESRUO = ? WHERE CODRUO = ?`,\n [role.descrizioneRuolo, resolvedCodiceRuolo],\n );\n\n await Orm.transactionQuery(\n transaction,\n `DELETE FROM RUOLI_MNU WHERE CODRUO = ?`,\n [resolvedCodiceRuolo],\n );\n }\n\n if (resolvedCodiceRuolo === null) {\n throw new Error('Operazione ruolo non riuscita: codice ruolo non valorizzato.');\n }\n\n for (const menu of role.menu) {\n await Orm.transactionQuery(\n transaction,\n `INSERT INTO RUOLI_MNU (CODRUO, CODMNU, TIPABI) VALUES (?, ?, ?)`,\n [resolvedCodiceRuolo, menu.codiceMenu, menu.tipoAbilitazione],\n );\n }\n });\n }\n\n\n /** Restituisce il catalogo ruoli con ogni associazione menu e livello, inclusi ruoli senza menu. */\n public async getRolesWithMenus(): Promise<Role[]> {\n const query = `\n SELECT \n R.CODRUO AS codice_ruolo, \n R.DESRUO AS descrizione_ruolo, \n M.CODMNU AS codice_menu, \n M.DESMNU AS descrizione_menu,\n M.NOTE AS note,\n RM.TIPABI AS tipo_abilitazione\n FROM RUOLI R\n LEFT JOIN RUOLI_MNU RM ON R.CODRUO = RM.CODRUO\n LEFT JOIN MENU M ON RM.CODMNU = M.CODMNU\n ORDER BY R.CODRUO, M.CODMNU\n `;\n\n const result = (await Orm.query(this.accessiOptions.databaseOptions, query, []))\n .map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>;\n\n const ruoliMap = new Map<number, Role>();\n\n for (const row of result) {\n const codiceRuolo = Number(row.codiceRuolo);\n const descrizioneRuolo = typeof row.descrizioneRuolo === 'string' ? row.descrizioneRuolo.trim() : '';\n const codiceMenu = typeof row.codiceMenu === 'string' ? row.codiceMenu : undefined;\n const rawTipoAbilitazione = row.tipoAbilitazione;\n\n if (!ruoliMap.has(codiceRuolo)) {\n ruoliMap.set(codiceRuolo, {\n codiceRuolo,\n descrizioneRuolo,\n menu: []\n });\n }\n\n const abilitationValue = typeof rawTipoAbilitazione === 'number'\n ? rawTipoAbilitazione\n : Number.parseInt(`${rawTipoAbilitazione ?? ''}`, 10);\n\n if (!codiceMenu || Number.isNaN(abilitationValue) || abilitationValue <= TipoAbilitazione.NESSUNA) {\n continue;\n }\n\n ruoliMap.get(codiceRuolo)!.menu.push({\n codiceRuolo,\n codiceMenu,\n tipoAbilitazione: abilitationValue as TipoAbilitazione,\n });\n }\n\n return Array.from(ruoliMap.values());\n }\n\n\n /**\n * Sostituisce l'intera lista di ruoli dell'utente con codici univoci e verificati.\n * Non modifica i grant diretti: il calcolo effettivo li unisce in `getUserRolesAndGrants`.\n */\n public async assignRolesToUser(codiceUtente: number, roles: number[]): Promise<void> {\n\n const userExistsQuery = `SELECT COUNT(*) FROM UTENTI WHERE CODUTE = ?`;\n let result = await Orm.query(this.accessiOptions.databaseOptions, userExistsQuery, [codiceUtente]);\n\n if (this.getCountFromResult(result) === 0) {\n throw new Error(`L'utente con codice ${codiceUtente} non esiste.`);\n }\n\n const normalizedRoles = Array.from(\n new Set(\n roles\n .map((role) => Number.parseInt(`${role ?? ''}`, 10))\n .filter((role) => Number.isInteger(role) && role > 0),\n ),\n );\n\n const queriesWithParams = [\n { query: `DELETE FROM UTENTI_RUOLI WHERE CODUTE = ?`, params: [codiceUtente] },\n ...normalizedRoles.map((codiceRuolo) => ({\n query: `INSERT INTO UTENTI_RUOLI (CODUTE, CODRUO) VALUES (?, ?)`,\n params: [codiceUtente, codiceRuolo],\n })),\n ];\n\n if (normalizedRoles.length > 0) {\n // Un'unica query IN invece di N count: stessa validazione, meno round-trip.\n const placeholders = normalizedRoles.map(() => '?').join(', ');\n const existingRolesResult = await Orm.query(\n this.accessiOptions.databaseOptions,\n `SELECT CODRUO FROM RUOLI WHERE CODRUO IN (${placeholders})`,\n normalizedRoles,\n );\n const existingRoles = this.extractIntegerColumn(existingRolesResult, 'CODRUO');\n const missingRole = normalizedRoles.find((codiceRuolo) => !existingRoles.has(codiceRuolo));\n if (missingRole !== undefined) {\n throw new Error(`Il ruolo con codice ${missingRole} non esiste.`);\n }\n }\n\n await Orm.executeMultiple(this.accessiOptions.databaseOptions, queriesWithParams);\n\n const assignedRolesResult = await Orm.query(\n this.accessiOptions.databaseOptions,\n `SELECT COUNT(*) FROM UTENTI_RUOLI WHERE CODUTE = ?`,\n [codiceUtente],\n );\n const assignedRolesCount = this.getCountFromResult(assignedRolesResult);\n if (assignedRolesCount !== normalizedRoles.length) {\n throw new Error(\n `Persistenza ruoli non coerente per utente ${codiceUtente}: attesi ${normalizedRoles.length}, trovati ${assignedRolesCount}.`,\n );\n }\n }\n\n\n /**\n * Sostituisce tutti i grant diretti dell'utente. I ruoli rimangono invariati e i loro grant sono aggiunti\n * solo nel risultato effettivo; per lo stesso menu vale il livello massimo tra diretto e ruoli.\n */\n public async assignPermissionsToUser(codiceUtente: number, permissions: Permission[]): Promise<void> {\n\n const userExistsQuery = `SELECT COUNT(*) FROM UTENTI WHERE CODUTE = ?`;\n let result = await Orm.query(this.accessiOptions.databaseOptions, userExistsQuery, [codiceUtente]);\n\n if (this.getCountFromResult(result) === 0) {\n throw new Error(`L'utente con codice ${codiceUtente} non esiste.`);\n }\n\n const normalizedPermissions = Array.from(\n new Map(\n permissions\n .map((permission) => ({\n codiceMenu: `${permission?.codiceMenu ?? ''}`.trim(),\n tipoAbilitazione: Number.parseInt(`${permission?.tipoAbilitazione ?? ''}`, 10),\n }))\n .filter(\n (permission) =>\n permission.codiceMenu.length > 0 && Number.isInteger(permission.tipoAbilitazione),\n )\n .map((permission) => [permission.codiceMenu, permission] as const),\n ).values(),\n );\n\n const queriesWithParams = [\n { query: `DELETE FROM ABILITAZIONI WHERE CODUTE = ?`, params: [codiceUtente] },\n ...normalizedPermissions.map((permission) => ({\n query: `INSERT INTO ABILITAZIONI (CODUTE, CODMNU, TIPABI) VALUES (?, ?, ?)`,\n params: [codiceUtente, permission.codiceMenu, permission.tipoAbilitazione],\n })),\n ];\n\n if (normalizedPermissions.length > 0) {\n // Un'unica query IN invece di N count: stessa validazione, meno round-trip.\n const menuCodes = normalizedPermissions.map((permission) => permission.codiceMenu);\n const placeholders = menuCodes.map(() => '?').join(', ');\n const existingMenusResult = await Orm.query(\n this.accessiOptions.databaseOptions,\n `SELECT CODMNU FROM MENU WHERE CODMNU IN (${placeholders})`,\n menuCodes,\n );\n const existingMenus = new Set(\n existingMenusResult.map((row) => String((row as Record<string, unknown>).CODMNU ?? (row as Record<string, unknown>).codmnu ?? '')),\n );\n const missingMenu = menuCodes.find((codiceMenu) => !existingMenus.has(codiceMenu));\n if (missingMenu !== undefined) {\n throw new Error(`Il menu con codice ${missingMenu} non esiste.`);\n }\n }\n\n await Orm.executeMultiple(this.accessiOptions.databaseOptions, queriesWithParams);\n\n const assignedPermissionsResult = await Orm.query(\n this.accessiOptions.databaseOptions,\n `SELECT COUNT(*) FROM ABILITAZIONI WHERE CODUTE = ?`,\n [codiceUtente],\n );\n const assignedPermissionsCount = this.getCountFromResult(assignedPermissionsResult);\n if (assignedPermissionsCount !== normalizedPermissions.length) {\n throw new Error(\n `Persistenza abilitazioni non coerente per utente ${codiceUtente}: attese ${normalizedPermissions.length}, trovate ${assignedPermissionsCount}.`,\n );\n }\n }\n\n\n /** Elimina fisicamente ruolo, associazioni menu e assegnazioni utente. Operazione amministrativa irreversibile. */\n public async deleteRole(codiceRuolo: number): Promise<void> {\n\n const existsQuery = `SELECT COUNT(*) FROM RUOLI WHERE CODRUO = ?`;\n const result = await Orm.query(this.accessiOptions.databaseOptions, existsQuery, [codiceRuolo]);\n\n if (this.getCountFromResult(result) === 0) {\n throw new Error(`Il ruolo con codice ${codiceRuolo} non esiste.`);\n }\n\n // Le tre delete sono atomiche: nessun ruolo orfano se una fallisce.\n await Orm.executeMultiple(this.accessiOptions.databaseOptions, [\n { query: `DELETE FROM RUOLI_MNU WHERE CODRUO = ?`, params: [codiceRuolo] },\n { query: `DELETE FROM UTENTI_RUOLI WHERE CODRUO = ?`, params: [codiceRuolo] },\n { query: `DELETE FROM RUOLI WHERE CODRUO = ?`, params: [codiceRuolo] },\n ]);\n\n }\n\n\n /** Restituisce solo menu abilitati; per il catalogo amministrativo usare `getGroupsWithMenus(true)`. */\n public async getMenus(scope?: string): Promise<MenuEntity[]> {\n const scopeCodes = await this.resolveScopeCodes(scope);\n const scopeFilter = this.scopeFilter('M', scopeCodes);\n const query = `\n SELECT\n M.CODMNU AS codice_menu,\n M.DESMNU AS descrizione_menu,\n M.CODGRP AS codice_gruppo,\n G.DESGRP AS descrizione_gruppo,\n M.ICON AS icona,\n M.CODTIP AS tipo,\n M.PAGINA AS pagina,\n M.NOTE AS note,\n G.ORDINE AS ordine_gruppo,\n M.ORDINE AS ordine_menu\n FROM MENU M\n LEFT JOIN MENU_GRP G ON M.CODGRP = G.CODGRP\n WHERE M.FLGENABLED = 1 AND COALESCE(G.FLGENABLED, 1) = 1${scopeFilter.sql}\n ORDER BY G.CODGRP, M.CODMNU\n `;\n\n const result = await Orm.query(this.accessiOptions.databaseOptions, query, scopeFilter.params);\n return result.map(RestUtilities.convertKeysToCamelCase) as unknown as MenuEntity[];\n }\n\n\n /**\n * Restituisce il catalogo ordinato per gruppo e menu. `includeDisabled` e riservato a console e amministrazione:\n * i flussi applicativi di autorizzazione devono usare il comportamento predefinito, che nasconde voci disabilitate.\n */\n public async getGroupsWithMenus(includeDisabled = false, scope?: string): Promise<GroupWithMenusEntity[]> {\n const scopeCodes = await this.resolveScopeCodes(scope);\n const scopeFilter = this.scopeFilter('M', scopeCodes);\n let filtersClause = includeDisabled\n ? ''\n : 'WHERE M.FLGENABLED = 1 AND (G.FLGENABLED IS NULL OR G.FLGENABLED = 1)';\n if (scopeFilter.sql) {\n filtersClause = filtersClause ? `${filtersClause}${scopeFilter.sql}` : `WHERE 1 = 1${scopeFilter.sql}`;\n }\n\n const query = `\n SELECT\n M.CODMNU AS codice_menu,\n M.DESMNU AS descrizione_menu,\n M.CODGRP AS codice_gruppo,\n G.DESGRP AS descrizione_gruppo,\n M.ICON AS icona,\n M.CODTIP AS tipo,\n M.PAGINA AS pagina,\n M.NOTE AS note,\n G.ORDINE AS ordine_gruppo,\n M.ORDINE as ordine_menu,\n M.FLGENABLED AS menu_enabled,\n G.FLGENABLED AS group_enabled\n FROM MENU M\n LEFT JOIN MENU_GRP G ON M.CODGRP = G.CODGRP\n ${filtersClause}\n ORDER BY G.CODGRP, M.CODMNU\n `;\n\n const result = await Orm.query(this.accessiOptions.databaseOptions, query, scopeFilter.params);\n\n const groupMap = new Map<\n string,\n GroupWithMenusEntity & { menus: (MenuEntity & { enabled?: boolean })[] }\n >();\n\n result.forEach((row: unknown) => {\n const converted = RestUtilities.convertKeysToCamelCase(row) as MenuEntity & {\n menuEnabled?: number | boolean;\n groupEnabled?: number | boolean;\n };\n\n const { menuEnabled, groupEnabled, ...menuBase } = converted;\n const normalizedGroupKey = menuBase.codiceGruppo ?? '__UNGROUPED__';\n const groupEnabledFlag =\n groupEnabled == null ? true : Number(groupEnabled) === 1 || groupEnabled === true;\n const menuEnabledFlag =\n menuEnabled === undefined ? true : Number(menuEnabled) === 1 || menuEnabled === true;\n\n if (!groupMap.has(normalizedGroupKey)) {\n groupMap.set(normalizedGroupKey, {\n codiceGruppo: menuBase.codiceGruppo ?? normalizedGroupKey,\n descrizioneGruppo: menuBase.descrizioneGruppo ?? '',\n ordineGruppo: menuBase.ordineGruppo,\n enabled: groupEnabledFlag,\n menus: [],\n });\n }\n\n if (menuBase.codiceMenu) {\n groupMap.get(normalizedGroupKey)!.menus.push({\n ...menuBase,\n enabled: menuEnabledFlag,\n });\n }\n });\n\n const groupsArray = Array.from(groupMap.values())\n .map(group => ({\n ...group,\n menus: (group.menus ?? []).sort(\n (a, b) =>\n (a.ordineMenu ?? Number.MAX_SAFE_INTEGER) - (b.ordineMenu ?? Number.MAX_SAFE_INTEGER),\n ),\n }))\n .sort(\n (a, b) =>\n (a.ordineGruppo ?? Number.MAX_SAFE_INTEGER) - (b.ordineGruppo ?? Number.MAX_SAFE_INTEGER),\n );\n\n return groupsArray;\n }\n\n // -----------------------------------------------------------------------\n // Cataloghi di configurazione: CRUD di menu, gruppi, tipi menu.\n // `table` e `column` sono sempre costanti interne, mai input utente: i\n // valori sono parametrizzati, quindi non esiste superficie di SQL injection.\n // -----------------------------------------------------------------------\n\n private async countWhere(table: string, column: string, value: unknown): Promise<number> {\n const result = await Orm.query(\n this.accessiOptions.databaseOptions,\n `SELECT COUNT(*) FROM ${table} WHERE ${column} = ?`,\n [value],\n );\n return this.getCountFromResult(result);\n }\n\n private async assertMenuGroupExists(codiceGruppo: string): Promise<void> {\n if ((await this.countWhere('MENU_GRP', 'CODGRP', codiceGruppo)) === 0) {\n throw new BadRequestException(`Il gruppo menu ${codiceGruppo} non esiste.`);\n }\n }\n\n private async assertMenuTypeExists(codiceTipo: string): Promise<void> {\n if ((await this.countWhere('MENU_TIPI', 'CODTIP', codiceTipo)) === 0) {\n throw new BadRequestException(`Il tipo menu ${codiceTipo} non esiste.`);\n }\n }\n\n /** Catalogo completo dei tipi menu, usato dagli editor di configurazione. */\n public async getMenuTypes(): Promise<MenuTypeEntity[]> {\n const query = `SELECT CODTIP AS codice_tipo, DESTIP AS descrizione_tipo FROM MENU_TIPI ORDER BY CODTIP`;\n const result = await Orm.query(this.accessiOptions.databaseOptions, query, []);\n return result.map(RestUtilities.convertKeysToCamelCase) as unknown as MenuTypeEntity[];\n }\n\n public async createMenuType(input: CreateMenuTypeRequest): Promise<void> {\n if ((await this.countWhere('MENU_TIPI', 'CODTIP', input.codiceTipo)) > 0) {\n throw new BadRequestException(`Il tipo menu ${input.codiceTipo} esiste gia.`);\n }\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n `INSERT INTO MENU_TIPI (CODTIP, DESTIP) VALUES (?, ?)`,\n [input.codiceTipo, input.descrizioneTipo ?? null],\n );\n }\n\n public async updateMenuType(codiceTipo: string, input: UpdateMenuTypeRequest): Promise<void> {\n await this.assertMenuTypeExists(codiceTipo);\n if (input.descrizioneTipo === undefined) return;\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n `UPDATE MENU_TIPI SET DESTIP = ? WHERE CODTIP = ?`,\n [input.descrizioneTipo, codiceTipo],\n );\n }\n\n /** Elimina un tipo menu solo se nessun menu lo utilizza (la FK lo impedirebbe comunque). */\n public async deleteMenuType(codiceTipo: string): Promise<void> {\n await this.assertMenuTypeExists(codiceTipo);\n const used = await this.countWhere('MENU', 'CODTIP', codiceTipo);\n if (used > 0) {\n throw new BadRequestException(\n `Impossibile eliminare il tipo ${codiceTipo}: ${used} menu lo utilizzano.`,\n );\n }\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n `DELETE FROM MENU_TIPI WHERE CODTIP = ?`,\n [codiceTipo],\n );\n }\n\n public async createMenuGroup(input: CreateMenuGroupRequest): Promise<void> {\n if ((await this.countWhere('MENU_GRP', 'CODGRP', input.codiceGruppo)) > 0) {\n throw new BadRequestException(`Il gruppo menu ${input.codiceGruppo} esiste gia.`);\n }\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n `INSERT INTO MENU_GRP (CODGRP, DESGRP, FLGENABLED, ORDINE) VALUES (?, ?, ?, ?)`,\n [\n input.codiceGruppo,\n input.descrizioneGruppo ?? null,\n input.enabled === false ? 0 : 1,\n input.ordineGruppo ?? 0,\n ],\n );\n }\n\n public async updateMenuGroup(codiceGruppo: string, input: UpdateMenuGroupRequest): Promise<void> {\n await this.assertMenuGroupExists(codiceGruppo);\n\n const sets: string[] = [];\n const params: unknown[] = [];\n if (input.descrizioneGruppo !== undefined) {\n sets.push('DESGRP = ?');\n params.push(input.descrizioneGruppo);\n }\n if (input.ordineGruppo !== undefined) {\n sets.push('ORDINE = ?');\n params.push(input.ordineGruppo);\n }\n if (input.enabled !== undefined) {\n sets.push('FLGENABLED = ?');\n params.push(input.enabled ? 1 : 0);\n }\n if (sets.length === 0) return;\n\n params.push(codiceGruppo);\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n `UPDATE MENU_GRP SET ${sets.join(', ')} WHERE CODGRP = ?`,\n params,\n );\n }\n\n /** Elimina un gruppo solo se non contiene menu, per non lasciare menu orfani. */\n public async deleteMenuGroup(codiceGruppo: string): Promise<void> {\n await this.assertMenuGroupExists(codiceGruppo);\n const used = await this.countWhere('MENU', 'CODGRP', codiceGruppo);\n if (used > 0) {\n throw new BadRequestException(\n `Impossibile eliminare il gruppo ${codiceGruppo}: contiene ${used} menu.`,\n );\n }\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n `DELETE FROM MENU_GRP WHERE CODGRP = ?`,\n [codiceGruppo],\n );\n }\n\n public async createMenu(input: CreateMenuRequest): Promise<void> {\n if ((await this.countWhere('MENU', 'CODMNU', input.codiceMenu)) > 0) {\n throw new BadRequestException(`Il menu ${input.codiceMenu} esiste gia.`);\n }\n await this.assertMenuGroupExists(input.codiceGruppo);\n if (input.tipo) await this.assertMenuTypeExists(input.tipo);\n\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n `INSERT INTO MENU (CODMNU, DESMNU, CODGRP, FLGENABLED, ICON, ORDINE, CODTIP, PAGINA, RIFMENU, NOTE)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n [\n input.codiceMenu,\n input.descrizioneMenu ?? null,\n input.codiceGruppo,\n input.enabled === false ? 0 : 1,\n input.icona ?? null,\n input.ordineMenu ?? null,\n input.tipo ?? null,\n input.pagina ?? null,\n input.rifMenu ?? null,\n input.note ?? null,\n ],\n );\n }\n\n public async updateMenu(codiceMenu: string, input: UpdateMenuRequest): Promise<void> {\n if ((await this.countWhere('MENU', 'CODMNU', codiceMenu)) === 0) {\n throw new BadRequestException(`Il menu ${codiceMenu} non esiste.`);\n }\n if (input.codiceGruppo !== undefined) await this.assertMenuGroupExists(input.codiceGruppo);\n if (input.tipo) await this.assertMenuTypeExists(input.tipo);\n\n const sets: string[] = [];\n const params: unknown[] = [];\n if (input.descrizioneMenu !== undefined) {\n sets.push('DESMNU = ?');\n params.push(input.descrizioneMenu);\n }\n if (input.codiceGruppo !== undefined) {\n sets.push('CODGRP = ?');\n params.push(input.codiceGruppo);\n }\n if (input.tipo !== undefined) {\n sets.push('CODTIP = ?');\n params.push(input.tipo || null);\n }\n if (input.icona !== undefined) {\n sets.push('ICON = ?');\n params.push(input.icona);\n }\n if (input.pagina !== undefined) {\n sets.push('PAGINA = ?');\n params.push(input.pagina);\n }\n if (input.ordineMenu !== undefined) {\n sets.push('ORDINE = ?');\n params.push(input.ordineMenu);\n }\n if (input.enabled !== undefined) {\n sets.push('FLGENABLED = ?');\n params.push(input.enabled ? 1 : 0);\n }\n if (input.rifMenu !== undefined) {\n sets.push('RIFMENU = ?');\n params.push(input.rifMenu);\n }\n if (input.note !== undefined) {\n sets.push('NOTE = ?');\n params.push(input.note);\n }\n if (sets.length === 0) return;\n\n params.push(codiceMenu);\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n `UPDATE MENU SET ${sets.join(', ')} WHERE CODMNU = ?`,\n params,\n );\n }\n\n /** Elimina menu, grant utente e associazioni ruolo in un'unica transazione. */\n public async deleteMenu(codiceMenu: string): Promise<void> {\n if ((await this.countWhere('MENU', 'CODMNU', codiceMenu)) === 0) {\n throw new BadRequestException(`Il menu ${codiceMenu} non esiste.`);\n }\n await Orm.executeMultiple(this.accessiOptions.databaseOptions, [\n { query: `DELETE FROM ABILITAZIONI WHERE CODMNU = ?`, params: [codiceMenu] },\n { query: `DELETE FROM RUOLI_MNU WHERE CODMNU = ?`, params: [codiceMenu] },\n { query: `DELETE FROM MENU WHERE CODMNU = ?`, params: [codiceMenu] },\n ]);\n }\n\n\n /**\n * Calcola l'autorizzazione effettiva: grant diretti e grant dei ruoli sono uniti per codice menu\n * prendendo il livello massimo. I superutenti ricevono tutti i menu attivi.\n */\n public async getUserRolesAndGrants(codiceUtente: number, scope?: string): Promise<{\n abilitazioni: AbilitazioneMenu[],\n ruoli: Role[],\n grants: AbilitazioneMenu[]\n }> {\n const scopeCodes = await this.resolveScopeCodes(scope);\n const codiceUtenteQuery = \"SELECT FLGSUPER as flag_super FROM UTENTI_CONFIG WHERE CODUTE = ?\";\n const result = await Orm.query(this.accessiOptions.databaseOptions, codiceUtenteQuery, [codiceUtente]);\n if (!result || result.length == 0) throw new Error(\"Nessun utente trovato con il codice utente \" + codiceUtente);\n\n const isSuperAdmin = this.isSuperFlag(\n (result.map(RestUtilities.convertKeysToCamelCase)[0] as { flagSuper?: unknown } | undefined)?.flagSuper,\n );\n\n const abilitazioni = await this.getUserDirectPermissions(codiceUtente, scopeCodes);\n const ruoli = await this.getUserRoles(codiceUtente, scopeCodes);\n const grants = this.composeGrants(\n abilitazioni,\n ruoli,\n isSuperAdmin,\n await this.getAllActiveMenusAsGrants(scopeCodes),\n );\n\n return { abilitazioni, ruoli, grants };\n }\n\n private isSuperFlag(value: unknown): boolean {\n return value === true || value === 1 || value === '1';\n }\n\n /**\n * Versione batch di `getUserRolesAndGrants`: esegue un numero costante di query per N utenti\n * (invece di N set di query) e restituisce mappa per codice utente. Stessa composizione della\n * lettura singola.\n */\n public async getUsersRolesAndGrants(codiciUtente: number[], scope?: string): Promise<Map<number, {\n abilitazioni: AbilitazioneMenu[],\n ruoli: Role[],\n grants: AbilitazioneMenu[]\n }>> {\n const scopeCodes = await this.resolveScopeCodes(scope);\n const scopeFilter = this.scopeFilter('M', scopeCodes);\n const result = new Map<number, { abilitazioni: AbilitazioneMenu[], ruoli: Role[], grants: AbilitazioneMenu[] }>();\n const ids = Array.from(new Set(codiciUtente.filter((id) => Number.isInteger(id) && id > 0)));\n if (ids.length === 0) {\n return result;\n }\n\n const placeholders = ids.map(() => '?').join(', ');\n\n const superRows = (await Orm.query(\n this.accessiOptions.databaseOptions,\n `SELECT CODUTE AS codice_utente, FLGSUPER AS flag_super FROM UTENTI_CONFIG WHERE CODUTE IN (${placeholders})`,\n ids,\n )).map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>;\n const superUsers = new Set<number>();\n for (const row of superRows) {\n if (this.isSuperFlag(row.flagSuper)) {\n superUsers.add(Number(row.codiceUtente));\n }\n }\n\n const permissionRows = (await Orm.query(\n this.accessiOptions.databaseOptions,\n `SELECT\n A.CODUTE AS codice_utente,\n A.CODMNU AS codice_menu,\n A.TIPABI AS tipo_abilitazione,\n M.DESMNU AS descrizione_menu,\n G.DESGRP AS descrizione_gruppo,\n G.CODGRP AS codice_gruppo,\n M.ICON AS icona,\n M.CODTIP AS tipo,\n M.PAGINA AS pagina,\n M.NOTE AS note\n FROM ABILITAZIONI A\n INNER JOIN MENU M ON A.CODMNU = M.CODMNU\n LEFT JOIN MENU_GRP G ON G.CODGRP = M.CODGRP\n WHERE A.CODUTE IN (${placeholders}) AND M.FLGENABLED = 1 AND COALESCE(G.FLGENABLED, 1) = 1${scopeFilter.sql}`,\n [...ids, ...scopeFilter.params],\n )).map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>;\n\n const roleRows = (await Orm.query(\n this.accessiOptions.databaseOptions,\n `SELECT\n RU.CODUTE AS codice_utente,\n R.CODRUO AS codice_ruolo,\n R.DESRUO AS descrizione_ruolo,\n CASE WHEN COALESCE(G.FLGENABLED, 1) = 1 THEN M.CODMNU END AS codice_menu,\n RM.TIPABI AS tipo_abilitazione,\n M.DESMNU AS descrizione_menu,\n M.NOTE AS note\n FROM UTENTI_RUOLI RU\n INNER JOIN RUOLI R ON RU.CODRUO = R.CODRUO\n LEFT JOIN RUOLI_MNU RM ON R.CODRUO = RM.CODRUO\n LEFT JOIN MENU M ON RM.CODMNU = M.CODMNU AND M.FLGENABLED = 1\n LEFT JOIN MENU_GRP G ON G.CODGRP = M.CODGRP\n WHERE RU.CODUTE IN (${placeholders})${scopeFilter.sql}`,\n [...ids, ...scopeFilter.params],\n )).map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>;\n\n const allActiveMenus = await this.getAllActiveMenusAsGrants(scopeCodes);\n\n const permissionsByUser = new Map<number, AbilitazioneMenu[]>();\n for (const row of permissionRows) {\n const { codiceUtente, ...grant } = row;\n const key = Number(codiceUtente);\n const bucket = permissionsByUser.get(key);\n if (bucket) {\n bucket.push(grant as unknown as AbilitazioneMenu);\n } else {\n permissionsByUser.set(key, [grant as unknown as AbilitazioneMenu]);\n }\n }\n\n const rolesByUser = new Map<number, Array<Record<string, unknown>>>();\n for (const row of roleRows) {\n const { codiceUtente, ...roleRow } = row;\n const key = Number(codiceUtente);\n const bucket = rolesByUser.get(key);\n if (bucket) {\n bucket.push(roleRow);\n } else {\n rolesByUser.set(key, [roleRow]);\n }\n }\n\n for (const id of ids) {\n const abilitazioni = permissionsByUser.get(id) ?? [];\n const ruoli = this.assembleRoles(rolesByUser.get(id) ?? []);\n const isSuperAdmin = superUsers.has(id);\n result.set(id, {\n abilitazioni,\n ruoli,\n grants: this.composeGrants(abilitazioni, ruoli, isSuperAdmin, allActiveMenus),\n });\n }\n\n return result;\n }\n\n\n\n // -----------------------------------------------------------------------\n // Scope applicativi: catalogo e associazioni menu/scope.\n // -----------------------------------------------------------------------\n\n private normalizeScopeCode(value: string): string {\n const code = String(value ?? '').trim().toUpperCase();\n if (!/^[A-Z][A-Z0-9_]{0,19}$/.test(code)) {\n throw new BadRequestException(\n 'Codice scope non valido: usa lettere maiuscole, cifre e underscore (max 20 caratteri).',\n );\n }\n return code;\n }\n\n private async assertScopeExists(codiceScope: string): Promise<void> {\n if ((await this.countWhere('SCOPES', 'CODICE', codiceScope)) === 0) {\n throw new BadRequestException(`Lo scope ${codiceScope} non esiste.`);\n }\n }\n\n private async assertMenuExists(codiceMenu: string): Promise<void> {\n if ((await this.countWhere('MENU', 'CODMNU', codiceMenu)) === 0) {\n throw new BadRequestException(`Il menu ${codiceMenu} non esiste.`);\n }\n }\n\n /** Catalogo degli scope applicativi (disponibile anche ai client per le etichette). */\n public async getScopes(): Promise<ScopeEntity[]> {\n const rows = await Orm.query(\n this.accessiOptions.databaseOptions,\n 'SELECT CODICE AS codice, NOME AS nome FROM SCOPES ORDER BY CODICE',\n [],\n );\n return rows.map(RestUtilities.convertKeysToCamelCase) as unknown as ScopeEntity[];\n }\n\n public async createScope(input: CreateScopeRequest): Promise<void> {\n const codice = this.normalizeScopeCode(input.codice);\n if ((await this.countWhere('SCOPES', 'CODICE', codice)) > 0) {\n throw new BadRequestException(`Lo scope ${codice} esiste gia.`);\n }\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n 'INSERT INTO SCOPES (CODICE, NOME) VALUES (?, ?)',\n [codice, input.nome],\n );\n }\n\n public async updateScope(codiceScope: string, input: UpdateScopeRequest): Promise<void> {\n const codice = this.normalizeScopeCode(codiceScope);\n await this.assertScopeExists(codice);\n if (input.nome === undefined) return;\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n 'UPDATE SCOPES SET NOME = ? WHERE CODICE = ?',\n [input.nome, codice],\n );\n }\n\n /** Elimina lo scope; le associazioni menu/scope spariscono per FK ON DELETE CASCADE. */\n public async deleteScope(codiceScope: string): Promise<void> {\n const codice = this.normalizeScopeCode(codiceScope);\n await this.assertScopeExists(codice);\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n 'DELETE FROM SCOPES WHERE CODICE = ?',\n [codice],\n );\n }\n\n /** Scope associati a un menu. */\n public async getMenuScopes(codiceMenu: string): Promise<string[]> {\n const code = String(codiceMenu ?? '').trim().toUpperCase();\n await this.assertMenuExists(code);\n const rows = await Orm.query(\n this.accessiOptions.databaseOptions,\n 'SELECT CODICE_SCOPE FROM MENU_SCOPES WHERE CODICE_MENU = ? ORDER BY CODICE_SCOPE',\n [code],\n );\n return rows\n .map((row) => String((row as Record<string, unknown>).CODICE_SCOPE ?? (row as Record<string, unknown>).codiceScope ?? '').trim())\n .filter((value) => value.length > 0);\n }\n\n /** Sostituisce in modo atomico gli scope di un menu. */\n public async setMenuScopes(codiceMenu: string, scopes: string[]): Promise<void> {\n const code = String(codiceMenu ?? '').trim().toUpperCase();\n await this.assertMenuExists(code);\n const normalized = Array.from(\n new Set((scopes ?? []).map((scope) => this.normalizeScopeCode(scope))),\n );\n for (const scope of normalized) {\n await this.assertScopeExists(scope);\n }\n const queries = [\n { query: 'DELETE FROM MENU_SCOPES WHERE CODICE_MENU = ?', params: [code] },\n ...normalized.map((scope) => ({\n query: 'INSERT INTO MENU_SCOPES (CODICE_MENU, CODICE_SCOPE) VALUES (?, ?)',\n params: [code, scope],\n })),\n ];\n await Orm.executeMultiple(this.accessiOptions.databaseOptions, queries);\n }\n\n /** Sostituisce in modo atomico i menu di uno scope (assegnazione massiva). */\n public async setScopeMenus(codiceScope: string, menus: string[]): Promise<void> {\n const scope = this.normalizeScopeCode(codiceScope);\n await this.assertScopeExists(scope);\n const normalized = Array.from(\n new Set((menus ?? []).map((menu) => String(menu ?? '').trim().toUpperCase()).filter(Boolean)),\n );\n for (const menu of normalized) {\n await this.assertMenuExists(menu);\n }\n const queries = [\n { query: 'DELETE FROM MENU_SCOPES WHERE CODICE_SCOPE = ?', params: [scope] },\n ...normalized.map((menu) => ({\n query: 'INSERT INTO MENU_SCOPES (CODICE_MENU, CODICE_SCOPE) VALUES (?, ?)',\n params: [menu, scope],\n })),\n ];\n await Orm.executeMultiple(this.accessiOptions.databaseOptions, queries);\n }\n\n}\n"]}

package/dist/accessi-service/services/schema-export-service/SchemaExportService.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"SchemaExportService.js","sourceRoot":"","sources":["../../../../src/accessi-service/services/schema-export-service/SchemaExportService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,sCAAmC;AACnC,kDAAmD;AAEnD,wEAQ8C;AAqB9C;;;;GAIG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAAwD,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAEnF,0DAA0D;IAC1D,QAAQ;QACN,MAAM,QAAQ,GAAuB;YACnC,IAAI,CAAC,kBAAkB,EAAE;YACzB,IAAI,CAAC,sBAAsB,EAAE;YAC7B,IAAI,CAAC,uBAAuB,EAAE;YAC9B,IAAI,CAAC,mBAAmB,EAAE;YAC1B,IAAI,CAAC,kBAAkB,EAAE;YACzB,IAAI,CAAC,oBAAoB,EAAE;SAC5B,CAAC;QAEF,MAAM,MAAM,GAAG,QAAQ;aACpB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,uEAAuE,OAAO,CAAC,KAAK,sEAAsE,OAAO,CAAC,GAAG,EAAE,CAAC;aACzL,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO,EAAE,OAAO,EAAE,sCAAsB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC;IAED,kGAAkG;IAC5F,eAAe;;YACnB,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,6BAAa,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YAE9C,MAAM,SAAS,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAChC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;kCAG4B,EAC5B,EAAE,EACF,KAAK,CACN,CAAmC,CAAC;YACrC,MAAM,aAAa,GAAG,SAAS;iBAC5B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAC,OAAA,MAAM,CAAC,MAAA,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA,EAAA,CAAC;iBACjF,MAAM,CAAC,OAAO,CAAC,CAAC;YAEnB,MAAM,aAAa,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CACpC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;mCAG6B,EAC7B,EAAE,EACF,KAAK,CACN,CAAmC,CAAC;YACrC,MAAM,iBAAiB,GAAG,aAAa;iBACpC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAC,OAAA,MAAM,CAAC,MAAA,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA,EAAA,CAAC;iBACjF,MAAM,CAAC,OAAO,CAAC,CAAC;YAEnB,OAAO;gBACL,aAAa;gBACb,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpE,eAAe;gBACf,iBAAiB;aAClB,CAAC;QACJ,CAAC;KAAA;IAEO,kBAAkB;QACxB,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,6BAAa,CAAC,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;iBAC3C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI,UAAU,EAAE,CAAC;iBACxD,IAAI,CAAC,KAAK,CAAC,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,gBAAgB,KAAK,OAAO,OAAO,MAAM,CAAC,CAAC;YAC3D,UAAU,CAAC,IAAI,CAAC,eAAe,KAAK,sBAAsB,KAAK,iBAAiB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,MAAM,CAAC,IAAI,CAAC,6BAAa,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACjH,CAAC;IAEO,sBAAsB;QAC5B,MAAM,UAAU,GAAG,iCAAiB,CAAC,GAAG,CACtC,CAAC,SAAS,EAAE,EAAE,CACZ,qCAAqC,SAAS,CAAC,IAAI,qBAAqB,SAAS,CAAC,IAAI,GAAG,CAC5F,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,wBAAwB,iCAAiB,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACxH,CAAC;IAEO,uBAAuB;QAC7B,MAAM,UAAU,GAAG,kCAAkB,CAAC,GAAG,CACvC,CAAC,EAAE,EAAE,EAAE,CACL,eAAe,EAAE,CAAC,KAAK,mBAAmB,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC,MAAM,gBAAgB,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,GAAG,CACxK,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,kCAAkB,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACrH,CAAC;IAEO,mBAAmB;QACzB,MAAM,UAAU,GAAG,8BAAc,CAAC,GAAG,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACzF,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,8BAAc,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACrG,CAAC;IAEO,kBAAkB;QACxB,MAAM,UAAU,GAAG,6BAAa,CAAC,GAAG,CAClC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,KAAK,CAAC,KAAK,mBAAmB,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,UAAU,IAAI,CAClG,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,6BAAa,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1G,CAAC;IAEO,oBAAoB;QAC1B,IAAI,+BAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,+BAA+B,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,UAAU,GAAG,+BAAe,CAAC,GAAG,CACpC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,OAAO,CAAC,IAAI,QAAQ,OAAO,CAAC,KAAK,WAAW,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,CAC3G,CAAC;QACF,OAAO;YACL,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,YAAY,+BAAe,CAAC,MAAM,GAAG;YAC5C,GAAG,EAAE,mBAAmB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB;SACpE,CAAC;IACJ,CAAC;CACF,CAAA;AAnHY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,mBAAmB,CAmH/B","sourcesContent":["import { Inject, Injectable } from '@nestjs/common';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport {\n ACCESSI_SCHEMA_VERSION,\n accessiTables,\n accessiForeignKeys,\n accessiIndexes,\n accessiChecks,\n accessiTriggers,\n accessiGenerators,\n} from '../../database-updates/accessiSchema';\n\nexport interface SchemaDdlSection {\n id: string;\n title: string;\n sql: string;\n}\n\nexport interface SchemaDdlResult {\n version: string;\n sections: SchemaDdlSection[];\n script: string;\n}\n\nexport interface SchemaEntitiesResult {\n presentTables: string[];\n extraTables: string[];\n canonicalTables: string[];\n presentGenerators: string[];\n}\n\n/**\n * Genera il DDL delle entita Accessi a partire dallo schema canonico (stessa fonte della\n * riconciliazione) e rileva le entita effettivamente presenti nel database. Serve a\n * esportare lo schema per replicarlo su altre installazioni.\n */\n@Injectable()\nexport class SchemaExportService {\n constructor(@Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions) {}\n\n /** DDL completo e deterministico dello schema Accessi. */\n buildDdl(): SchemaDdlResult {\n const sections: SchemaDdlSection[] = [\n this.buildTablesSection(),\n this.buildGeneratorsSection(),\n this.buildForeignKeysSection(),\n this.buildIndexesSection(),\n this.buildChecksSection(),\n this.buildTriggersSection(),\n ];\n\n const script = sections\n .map((section) => `-- ============================================================\\n-- ${section.title}\\n-- ============================================================\\n${section.sql}`)\n .join('\\n\\n');\n\n return { version: ACCESSI_SCHEMA_VERSION, sections, script };\n }\n\n /** Elenca le tabelle/generatori presenti nel database e segnala quelli fuori schema canonical. */\n async presentEntities(): Promise<SchemaEntitiesResult> {\n const canonicalTables = Object.keys(accessiTables).sort();\n const canonicalSet = new Set(canonicalTables);\n\n const tableRows = (await Orm.query(\n this.options.databaseOptions,\n `SELECT TRIM(RDB$RELATION_NAME) AS NAME\n FROM RDB$RELATIONS\n WHERE COALESCE(RDB$SYSTEM_FLAG, 0) = 0 AND RDB$VIEW_BLR IS NULL\n ORDER BY RDB$RELATION_NAME`,\n [],\n false,\n )) as Array<Record<string, unknown>>;\n const presentTables = tableRows\n .map((row) => String(RestUtilities.convertKeysToCamelCase(row).name ?? '').trim())\n .filter(Boolean);\n\n const generatorRows = (await Orm.query(\n this.options.databaseOptions,\n `SELECT TRIM(RDB$GENERATOR_NAME) AS NAME\n FROM RDB$GENERATORS\n WHERE COALESCE(RDB$SYSTEM_FLAG, 0) = 0\n ORDER BY RDB$GENERATOR_NAME`,\n [],\n false,\n )) as Array<Record<string, unknown>>;\n const presentGenerators = generatorRows\n .map((row) => String(RestUtilities.convertKeysToCamelCase(row).name ?? '').trim())\n .filter(Boolean);\n\n return {\n presentTables,\n extraTables: presentTables.filter((name) => !canonicalSet.has(name)),\n canonicalTables,\n presentGenerators,\n };\n }\n\n private buildTablesSection(): SchemaDdlSection {\n const statements: string[] = [];\n for (const [table, schema] of Object.entries(accessiTables)) {\n const columns = Object.entries(schema.columns)\n .map(([name, definition]) => ` ${name} ${definition}`)\n .join(',\\n');\n statements.push(`CREATE TABLE ${table} (\\n${columns}\\n);`);\n statements.push(`ALTER TABLE ${table} ADD CONSTRAINT PK_${table} PRIMARY KEY (${schema.primaryKey.join(', ')});`);\n }\n return { id: 'tables', title: `Tabelle (${Object.keys(accessiTables).length})`, sql: statements.join('\\n\\n') };\n }\n\n private buildGeneratorsSection(): SchemaDdlSection {\n const statements = accessiGenerators.map(\n (generator) =>\n `-- Firebird 2.5: CREATE GENERATOR ${generator.name}\\nCREATE SEQUENCE ${generator.name};`,\n );\n return { id: 'generators', title: `Generatori/Sequenze (${accessiGenerators.length})`, sql: statements.join('\\n\\n') };\n }\n\n private buildForeignKeysSection(): SchemaDdlSection {\n const statements = accessiForeignKeys.map(\n (fk) =>\n `ALTER TABLE ${fk.table} ADD CONSTRAINT ${fk.name} FOREIGN KEY (${fk.column}) REFERENCES ${fk.target} (${fk.targetColumn})${fk.cascade ? ' ON DELETE CASCADE' : ''};`,\n );\n return { id: 'foreignKeys', title: `Chiavi esterne (${accessiForeignKeys.length})`, sql: statements.join('\\n\\n') };\n }\n\n private buildIndexesSection(): SchemaDdlSection {\n const statements = accessiIndexes.map(\n (index) => `CREATE INDEX ${index.name} ON ${index.table} (${index.columns.join(', ')});`,\n );\n return { id: 'indexes', title: `Indici (${accessiIndexes.length})`, sql: statements.join('\\n\\n') };\n }\n\n private buildChecksSection(): SchemaDdlSection {\n const statements = accessiChecks.map(\n (check) => `ALTER TABLE ${check.table} ADD CONSTRAINT ${check.name} CHECK (${check.expression});`,\n );\n return { id: 'checks', title: `Vincoli CHECK (${accessiChecks.length})`, sql: statements.join('\\n\\n') };\n }\n\n private buildTriggersSection(): SchemaDdlSection {\n if (accessiTriggers.length === 0) {\n return { id: 'triggers', title: 'Trigger (0)', sql: '-- Nessun trigger di dominio.' };\n }\n const statements = accessiTriggers.map(\n (trigger) => `CREATE TRIGGER ${trigger.name} FOR ${trigger.table} ACTIVE ${trigger.event} ${trigger.body}`,\n );\n return {\n id: 'triggers',\n title: `Trigger (${accessiTriggers.length})`,\n sql: `SET TERM ^ ;\\n\\n${statements.join('^\\n\\n')}^\\n\\nSET TERM ; ^`,\n };\n }\n}\n"]}

package/dist/accessi-service/services/service-token-service/ServiceTokenService.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"ServiceTokenService.js","sourceRoot":"","sources":["../../../../src/accessi-service/services/service-token-service/ServiceTokenService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgDA,oDAIC;AAGD,8CAiBC;AAGD,wDAEC;AAGD,kEAmBC;AAGD,oDAKC;AA3GD,2CAA4F;AAC5F,mCAAkE;AAClE,gDAA6C;AAC7C,sCAAmC;AACnC,kDAAmD;AAGnD,+FAA+F;AAClF,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAC1C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAC7C,MAAM,oBAAoB,GAAG,KAAM,CAAC;AAoCpC,6FAA6F;AAC7F,SAAgB,oBAAoB;IAClC,MAAM,OAAO,GAAG,GAAG,4BAAoB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,sFAAsF;AACtF,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,0GAA0G;AAC1G,SAAgB,sBAAsB,CAAC,MAAc;IACnD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,0EAA0E;AAC1E,SAAgB,2BAA2B,CAAC,MAA4B;IACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,4BAAmB,CAAC,+CAA+C,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,iGAAiG;AACjG,SAAgB,oBAAoB,CAAC,MAAgB,EAAE,QAA4B;IACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA6B,EAAE,cAAuB;;IAC/E,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QACxF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACxG,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,MAAA,KAAK,CAAC,OAAO,mCAAI,cAAc,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AAGjG,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAAwD,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAE1F,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;IAC7C,CAAC;IAEO,UAAU,CAAC,GAA4B;;QAC7C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC;YAClC,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrD,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;YACjC,UAAU,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACpG,OAAO,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAC9D,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;SACrE,CAAC;IACJ,CAAC;IAEa,OAAO,CAAC,OAAe;;YACnC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,eAAe,EACpB;qDAC+C,EAC/C,CAAC,OAAO,CAAC,EACT,KAAK,CACN,CAAC;YACF,OAAQ,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAoC,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;KAAA;IAED,kGAAkG;IAC5F,KAAK,CAAC,KAA6B,EAAE,SAAkB;;;YAC3D,MAAM,KAAK,GAAG,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAmB,CAAC,sEAAsE,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAA,IAAI,CAAC,cAAc,CAAC,aAAa,0CAAE,cAAc,CAAC,CAAC;YAC9F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;YAE1D,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB;iCAC2B,EAC3B,CAAC,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,IAAI,EAAE,SAAS,CAAC,CACjG,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACxC,uCAAY,IAAI,CAAC,UAAU,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAE,KAAK,IAAG;QAC5F,CAAC;KAAA;IAED,0DAA0D;IACpD,IAAI;6DAAC,cAAc,GAAG,KAAK;YAC/B,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,eAAe,EACpB;oCAC8B,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B;+CACrC,EACzC,EAAE,EACF,KAAK,CACN,CAAC;YACF,OAAQ,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAoC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/H,CAAC;KAAA;IAED,mGAAmG;IAC7F,MAAM,CAAC,OAAe,EAAE,SAAkB;;;YAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,mCAAI,OAAO,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,YAAY,eAAe,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB,oGAAoG,EACpG,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,IAAI,EAAE,YAAY,CAAC,CAClC,CAAC;QACJ,CAAC;KAAA;IAED,+EAA+E;IACzE,MAAM,CAAC,OAAe,EAAE,SAAkB;;;YAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,mCAAI,OAAO,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,YAAY,eAAe,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC,KAAK,CACf;gBACE,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,MAAA,QAAQ,CAAC,SAAS,mCAAI,IAAI;aACtC,EACD,SAAS,CACV,CAAC;QACJ,CAAC;KAAA;IAED;;;OAGG;IACG,MAAM,CAAC,KAAa,EAAE,OAAyB;;YACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1D,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC7D,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC3F,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAE7F,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvF,CAAC;KAAA;IAEO,cAAc,CAAC,SAAiB,EAAE,MAAc;QACtD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IAEa,aAAa,CAAC,OAAe,EAAE,UAAmB,EAAE,EAAW;;YAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,oBAAoB,EAAE,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB,wGAAwG,EACxG,CAAC,EAAE,aAAF,EAAE,cAAF,EAAE,GAAI,IAAI,EAAE,OAAO,CAAC,EACrB,KAAK,CACN,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AArKY,kDAAmB;8BAAnB,mBAAmB;IAF/B,mBAAQ;IACR,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,mBAAmB,CAqK/B","sourcesContent":["import { BadRequestException, Inject, Injectable, NotFoundException } from '@nestjs/common';\nimport { createHash, randomBytes, timingSafeEqual } from 'crypto';\nimport { autobind } from '../../../autobind';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\n\n/** Prefisso riconoscibile dei token di servizio; il formato completo e `st_<id>.<segreto>`. */\nexport const SERVICE_TOKEN_PREFIX = 'st_';\nconst TOKEN_ID_PATTERN = /^st_[a-f0-9]{32}$/;\nconst SCOPE_PATTERN = /^[a-z0-9:_-]{1,40}$/i;\nconst LAST_USED_REFRESH_MS = 60_000;\n\n/** Metadati pubblici di un token (mai il segreto). */\nexport interface ServiceTokenMetadata {\n tokenId: string;\n label: string;\n scopes: string[];\n createdAt?: string;\n expiresAt?: string;\n lastUsedAt?: string;\n lastUsedIp?: string;\n revoked: boolean;\n revokedAt?: string;\n revokedBy?: number;\n}\n\n/** Risultato dell'emissione: contiene il segreto in chiaro, mostrato una sola volta. */\nexport interface IssuedServiceToken extends ServiceTokenMetadata {\n token: string;\n}\n\n/** Risultato della verifica di un token presentato. */\nexport interface VerifiedServiceToken {\n tokenId: string;\n label: string;\n scopes: string[];\n}\n\nexport interface IssueServiceTokenInput {\n label: string;\n scopes?: string[];\n expiresAt?: Date | string | null;\n /** Giorni di validita; ignorato se `expiresAt` e valorizzato. */\n ttlDays?: number;\n}\n\n/** Genera un nuovo token di servizio: identificativo pubblico + segreto ad alta entropia. */\nexport function generateServiceToken(): { token: string; tokenId: string; secret: string } {\n const tokenId = `${SERVICE_TOKEN_PREFIX}${randomBytes(16).toString('hex')}`;\n const secret = randomBytes(32).toString('base64url');\n return { token: `${tokenId}.${secret}`, tokenId, secret };\n}\n\n/** Estrae identificativo e segreto; restituisce `null` se il formato non e valido. */\nexport function parseServiceToken(token: unknown): { tokenId: string; secret: string } | null {\n if (typeof token !== 'string') {\n return null;\n }\n\n const separator = token.indexOf('.');\n if (separator <= 0) {\n return null;\n }\n\n const tokenId = token.slice(0, separator);\n const secret = token.slice(separator + 1);\n if (!TOKEN_ID_PATTERN.test(tokenId) || secret.length < 16) {\n return null;\n }\n\n return { tokenId, secret };\n}\n\n/** Hash del segreto per lo storage at-rest. Il segreto e ad alta entropia (256 bit), non una password. */\nexport function hashServiceTokenSecret(secret: string): string {\n return createHash('sha256').update(secret, 'utf8').digest('hex');\n}\n\n/** Normalizza e valida gli scope: trim, dedup e controllo del formato. */\nexport function normalizeServiceTokenScopes(scopes: string[] | undefined): string[] {\n if (scopes === undefined) {\n return [];\n }\n if (!Array.isArray(scopes)) {\n throw new BadRequestException('Gli scope devono essere un array di stringhe.');\n }\n\n const normalized: string[] = [];\n for (const rawScope of scopes) {\n if (typeof rawScope !== 'string' || !SCOPE_PATTERN.test(rawScope.trim())) {\n throw new BadRequestException(`Scope non valido: ${String(rawScope)}. Usare lettere, numeri, ':', '_' o '-'.`);\n }\n const scope = rawScope.trim().toLowerCase();\n if (!normalized.includes(scope)) {\n normalized.push(scope);\n }\n }\n return normalized;\n}\n\n/** True se l'insieme di scope soddisfa quello richiesto (uno scope vuoto non richiede nulla). */\nexport function serviceTokenHasScope(scopes: string[], required: string | undefined): boolean {\n if (!required) {\n return true;\n }\n return scopes.includes(required.toLowerCase());\n}\n\nfunction toIso(value: unknown): string | undefined {\n if (value === undefined || value === null) {\n return undefined;\n }\n const date = value instanceof Date ? value : new Date(String(value));\n return Number.isNaN(date.getTime()) ? undefined : date.toISOString();\n}\n\nfunction resolveExpiration(input: IssueServiceTokenInput, defaultTtlDays?: number): Date | null {\n if (input.expiresAt !== undefined && input.expiresAt !== null && input.expiresAt !== '') {\n const expiresAt = input.expiresAt instanceof Date ? input.expiresAt : new Date(String(input.expiresAt));\n if (Number.isNaN(expiresAt.getTime())) {\n throw new BadRequestException('Data di scadenza non valida.');\n }\n if (expiresAt.getTime() <= Date.now()) {\n throw new BadRequestException('La data di scadenza deve essere nel futuro.');\n }\n return expiresAt;\n }\n\n const ttlDays = input.ttlDays ?? defaultTtlDays;\n if (typeof ttlDays === 'number' && Number.isFinite(ttlDays) && ttlDays > 0) {\n return new Date(Date.now() + ttlDays * 24 * 60 * 60 * 1000);\n }\n\n return null;\n}\n\n/** Gestisce il ciclo di vita dei token di servizio (emissione, elenco, revoca, rotazione, verifica). */\n@autobind\n@Injectable()\nexport class ServiceTokenService {\n constructor(@Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions) {}\n\n private get databaseOptions() {\n return this.accessiOptions.databaseOptions;\n }\n\n private toMetadata(row: Record<string, unknown>): ServiceTokenMetadata {\n const scopesRaw = typeof row.scopes === 'string' ? row.scopes.trim() : '';\n return {\n tokenId: String(row.tokenId ?? ''),\n label: typeof row.label === 'string' ? row.label : '',\n scopes: scopesRaw === '' ? [] : scopesRaw.split(/\\s+/),\n createdAt: toIso(row.createdAt),\n expiresAt: toIso(row.expiresAt),\n lastUsedAt: toIso(row.lastUsedAt),\n lastUsedIp: typeof row.lastUsedIp === 'string' && row.lastUsedIp !== '' ? row.lastUsedIp : undefined,\n revoked: row.revokedAt !== undefined && row.revokedAt !== null,\n revokedAt: toIso(row.revokedAt),\n revokedBy: row.revokedBy == null ? undefined : Number(row.revokedBy),\n };\n }\n\n private async readRow(tokenId: string): Promise<Record<string, unknown> | undefined> {\n const rows = await Orm.query(\n this.databaseOptions,\n `SELECT TOKEN_ID, TOKEN_HASH, LABEL, SCOPES, CREATED_BY, CREATED_AT, EXPIRES_AT, LAST_USED_AT, LAST_USED_IP, REVOKED_AT, REVOKED_BY\n FROM ACCESSI_SERVICE_TOKEN WHERE TOKEN_ID = ?`,\n [tokenId],\n false,\n );\n return (rows.map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>)[0];\n }\n\n /** Crea un nuovo token. Il segreto in chiaro e restituito una sola volta e non e recuperabile. */\n async issue(input: IssueServiceTokenInput, createdBy?: number): Promise<IssuedServiceToken> {\n const label = typeof input?.label === 'string' ? input.label.trim() : '';\n if (label.length < 1 || label.length > 100) {\n throw new BadRequestException('La descrizione del token deve essere compresa tra 1 e 100 caratteri.');\n }\n\n const scopes = normalizeServiceTokenScopes(input.scopes);\n const expiresAt = resolveExpiration(input, this.accessiOptions.serviceTokens?.defaultTtlDays);\n const { token, tokenId, secret } = generateServiceToken();\n\n await Orm.execute(\n this.databaseOptions,\n `INSERT INTO ACCESSI_SERVICE_TOKEN (TOKEN_ID, TOKEN_HASH, LABEL, SCOPES, CREATED_BY, EXPIRES_AT)\n VALUES (?, ?, ?, ?, ?, ?)`,\n [tokenId, hashServiceTokenSecret(secret), label, scopes.join(' '), createdBy ?? null, expiresAt],\n );\n\n const row = await this.readRow(tokenId);\n return { ...this.toMetadata(row ?? { tokenId, label, scopes: scopes.join(' ') }), token };\n }\n\n /** Elenca i token (metadati soltanto, mai il segreto). */\n async list(includeRevoked = false): Promise<ServiceTokenMetadata[]> {\n const rows = await Orm.query(\n this.databaseOptions,\n `SELECT TOKEN_ID, LABEL, SCOPES, CREATED_BY, CREATED_AT, EXPIRES_AT, LAST_USED_AT, LAST_USED_IP, REVOKED_AT, REVOKED_BY\n FROM ACCESSI_SERVICE_TOKEN ${includeRevoked ? '' : 'WHERE REVOKED_AT IS NULL'}\n ORDER BY CREATED_AT DESC, TOKEN_ID DESC`,\n [],\n false,\n );\n return (rows.map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>).map((row) => this.toMetadata(row));\n }\n\n /** Revoca un token rendendolo immediatamente inutilizzabile. Idempotente su token gia revocati. */\n async revoke(tokenId: string, revokedBy?: number): Promise<void> {\n const parsed = parseServiceToken(tokenId);\n const normalizedId = parsed?.tokenId ?? tokenId;\n const row = await this.readRow(normalizedId);\n if (!row) {\n throw new NotFoundException(`Token di servizio ${normalizedId} non trovato.`);\n }\n if (row.revokedAt !== undefined && row.revokedAt !== null) {\n return;\n }\n await Orm.execute(\n this.databaseOptions,\n 'UPDATE ACCESSI_SERVICE_TOKEN SET REVOKED_AT = CURRENT_TIMESTAMP, REVOKED_BY = ? WHERE TOKEN_ID = ?',\n [revokedBy ?? null, normalizedId],\n );\n }\n\n /** Revoca il token indicato ed emette un sostituto con gli stessi metadati. */\n async rotate(tokenId: string, createdBy?: number): Promise<IssuedServiceToken> {\n const parsed = parseServiceToken(tokenId);\n const normalizedId = parsed?.tokenId ?? tokenId;\n const row = await this.readRow(normalizedId);\n if (!row) {\n throw new NotFoundException(`Token di servizio ${normalizedId} non trovato.`);\n }\n\n const metadata = this.toMetadata(row);\n await this.revoke(normalizedId, createdBy);\n\n return this.issue(\n {\n label: metadata.label,\n scopes: metadata.scopes,\n expiresAt: metadata.expiresAt ?? null,\n },\n createdBy,\n );\n }\n\n /**\n * Verifica un token presentato: formato, esistenza, revoca, scadenza e hash a tempo costante.\n * Aggiorna `LAST_USED_AT` (best-effort, al massimo una volta al minuto).\n */\n async verify(token: string, context?: { ip?: string }): Promise<VerifiedServiceToken | undefined> {\n const parsed = parseServiceToken(token);\n if (!parsed) {\n return undefined;\n }\n\n const row = await this.readRow(parsed.tokenId);\n if (!row) {\n return undefined;\n }\n\n if (row.revokedAt !== undefined && row.revokedAt !== null) {\n return undefined;\n }\n\n const expiresAt = toIso(row.expiresAt);\n if (expiresAt && new Date(expiresAt).getTime() <= Date.now()) {\n return undefined;\n }\n\n const storedHash = typeof row.tokenHash === 'string' ? row.tokenHash : '';\n if (!storedHash || !this.safeHashEquals(hashServiceTokenSecret(parsed.secret), storedHash)) {\n return undefined;\n }\n\n const metadata = this.toMetadata(row);\n await this.touchLastUsed(parsed.tokenId, row.lastUsedAt, context?.ip).catch(() => undefined);\n\n return { tokenId: metadata.tokenId, label: metadata.label, scopes: metadata.scopes };\n }\n\n private safeHashEquals(candidate: string, stored: string): boolean {\n const candidateBuffer = Buffer.from(candidate, 'hex');\n const storedBuffer = Buffer.from(stored, 'hex');\n if (candidateBuffer.length !== storedBuffer.length || candidateBuffer.length === 0) {\n return false;\n }\n return timingSafeEqual(candidateBuffer, storedBuffer);\n }\n\n private async touchLastUsed(tokenId: string, lastUsedAt: unknown, ip?: string): Promise<void> {\n const lastUsed = toIso(lastUsedAt);\n if (lastUsed && Date.now() - new Date(lastUsed).getTime() < LAST_USED_REFRESH_MS) {\n return;\n }\n await Orm.execute(\n this.databaseOptions,\n 'UPDATE ACCESSI_SERVICE_TOKEN SET LAST_USED_AT = CURRENT_TIMESTAMP, LAST_USED_IP = ? WHERE TOKEN_ID = ?',\n [ip ?? null, tokenId],\n false,\n );\n }\n}\n"]}

package/dist/accessi-service/services/two-factor-service/TwoFactorService.d.ts ADDED Viewed

@@ -0,0 +1,27 @@
+import type { AccessiOptions } from '../../AccessiModule';
+import { TwoFactorChallengeDto } from '../../dtos/TwoFactorDtos';
+import { EmailService } from '../email-service/EmailService';
+export type TwoFactorMode = 'password' | 'passwordless' | 'federated';
+export interface TwoFactorProof {
+    codiceUtente: number;
+    email: string;
+    mode: TwoFactorMode;
+    identityKey?: string;
+}
+/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */
+export declare class TwoFactorService {
+    private readonly options;
+    private readonly emailService;
+    constructor(options: AccessiOptions, emailService: EmailService);
+    private invalid;
+    private limited;
+    private hash;
+    private row;
+    private transaction;
+    private response;
+    private deliver;
+    issue(proof: TwoFactorProof): Promise<TwoFactorChallengeDto>;
+    describe(id: string): Promise<TwoFactorProof>;
+    resend(id: string): Promise<TwoFactorChallengeDto>;
+    consume(id: string, code: string): Promise<TwoFactorProof>;
+}

package/dist/accessi-service/services/two-factor-service/TwoFactorService.js ADDED Viewed

@@ -0,0 +1,175 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const Orm_1 = require("../../../Orm");
+const Utilities_1 = require("../../../Utilities");
+const passwordResetToken_1 = require("../../security/passwordResetToken");
+const EmailService_1 = require("../email-service/EmailService");
+const LIFETIME_SECONDS = 600;
+const MAX_ATTEMPTS = 5;
+const RESEND_SECONDS = 60;
+const MAX_SENDS = 3;
+const RETURN_FIELDS = 'CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT, ATTEMPTS, SENDS, SENT_AT';
+/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */
+let TwoFactorService = class TwoFactorService {
+    constructor(options, emailService) {
+        this.options = options;
+        this.emailService = emailService;
+    }
+    invalid() {
+        return new common_1.UnauthorizedException({ code: 'ACCESSI_2FA_INVALID', message: 'Codice non valido o scaduto. Ripeti l accesso se hai esaurito i tentativi.' });
+    }
+    limited() {
+        return new common_1.HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);
+    }
+    hash(id, code) {
+        return (0, crypto_1.createHmac)('sha256', (0, passwordResetToken_1.getAccessiJwtSecret)(this.options, '2fa')).update(`accessi-2fa:${id}:${code}`).digest('hex');
+    }
+    row(result) {
+        var _a, _b, _c, _d, _e, _f;
+        const row = (Array.isArray(result) ? result[0] : result);
+        if (!row)
+            return undefined;
+        const raw = Utilities_1.RestUtilities.convertKeysToCamelCase(row);
+        const asString = (value) => typeof value === 'string' ? value : undefined;
+        const codiceUtente = Number(raw.codute);
+        if (!codiceUtente)
+            return undefined;
+        const converted = {
+            codiceUtente,
+            email: (_b = (_a = asString(raw.email)) === null || _a === void 0 ? void 0 : _a.trim()) !== null && _b !== void 0 ? _b : '',
+            mode: (_d = (_c = asString(raw.authmode)) === null || _c === void 0 ? void 0 : _c.trim()) !== null && _d !== void 0 ? _d : 'password',
+            identityKey: (_e = asString(raw.idnkey)) === null || _e === void 0 ? void 0 : _e.trim(),
+            codeHash: (_f = asString(raw.codehash)) !== null && _f !== void 0 ? _f : '',
+            expiresAt: raw.expiresAt,
+            attempts: Number(raw.attempts),
+            sends: Number(raw.sends),
+            sentAt: raw.sentAt,
+        };
+        return converted;
+    }
+    transaction(operation) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return Orm_1.Orm.withTransaction(this.options.databaseOptions, (transaction) => __awaiter(this, void 0, void 0, function* () {
+                const query = (sql, params = []) => Orm_1.Orm.transactionQuery(transaction, sql, params);
+                return operation(query);
+            }));
+        });
+    }
+    response(id, expiresAt) {
+        return { twoFactorRequired: true, challengeId: id, expiresAt: new Date(expiresAt).toISOString(), resendAfterSeconds: RESEND_SECONDS, method: 'email' };
+    }
+    deliver(id, code, email) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield this.emailService.sendTwoFactorCode(email, code, LIFETIME_SECONDS / 60);
+            }
+            catch (_a) {
+                // Invalidate only the code whose delivery failed, preserving a concurrent newer code.
+                yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ? AND CODEHASH = ?', [MAX_ATTEMPTS, id, this.hash(id, code)], false).catch(() => undefined);
+                throw new common_1.ServiceUnavailableException({ code: 'ACCESSI_2FA_DELIVERY_FAILED', message: 'Invio del codice non riuscito. Riprova tra poco.' });
+            }
+        });
+    }
+    issue(proof) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test((_a = proof.email) !== null && _a !== void 0 ? _a : '')) {
+                throw new common_1.ServiceUnavailableException({ code: 'ACCESSI_2FA_EMAIL_REQUIRED', message: 'Per il codice di accesso serve un indirizzo email valido. Contatta un amministratore.' });
+            }
+            const id = (0, crypto_1.randomBytes)(32).toString('hex');
+            const code = String((0, crypto_1.randomInt)(1000000)).padStart(6, '0');
+            const expiresAt = yield this.transaction((query) => __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c, _d, _e, _f;
+                // Serialize issuance for this account across backend instances.
+                yield query('SELECT CODUTE FROM UTENTI WHERE CODUTE = ? WITH LOCK', [proof.codiceUtente]);
+                const recent = yield query('SELECT COUNT(*) AS TOTAL FROM ACCESSI_2FA WHERE CODUTE = ? AND CREATED_AT > DATEADD(-15 MINUTE TO CURRENT_TIMESTAMP)', [proof.codiceUtente]);
+                if (Number((_d = (_b = (_a = recent === null || recent === void 0 ? void 0 : recent[0]) === null || _a === void 0 ? void 0 : _a.TOTAL) !== null && _b !== void 0 ? _b : (_c = recent === null || recent === void 0 ? void 0 : recent[0]) === null || _c === void 0 ? void 0 : _c.total) !== null && _d !== void 0 ? _d : 0) >= 5)
+                    throw this.limited();
+                yield query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');
+                const created = yield query(`INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`, [id, proof.codiceUtente, proof.email, proof.mode, (_e = proof.identityKey) !== null && _e !== void 0 ? _e : null, this.hash(id, code)]);
+                const row = (Array.isArray(created) ? created[0] : created);
+                return ((_f = row === null || row === void 0 ? void 0 : row.EXPIRES_AT) !== null && _f !== void 0 ? _f : row === null || row === void 0 ? void 0 : row.expires_at);
+            }));
+            yield this.deliver(id, code, proof.email);
+            return this.response(id, expiresAt);
+        });
+    }
+    describe(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[a-f0-9]{64}$/.test(id))
+                throw this.invalid();
+            const row = this.row(yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT ${RETURN_FIELDS} FROM ACCESSI_2FA WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ?`, [id, MAX_ATTEMPTS], false));
+            if (!row)
+                throw this.invalid();
+            return row;
+        });
+    }
+    resend(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[a-f0-9]{64}$/.test(id))
+                throw this.invalid();
+            const code = String((0, crypto_1.randomInt)(1000000)).padStart(6, '0');
+            const row = yield this.transaction((query) => __awaiter(this, void 0, void 0, function* () {
+                const result = this.row(yield query(`UPDATE ACCESSI_2FA SET CODEHASH = ?, SENDS = SENDS + 1, SENT_AT = CURRENT_TIMESTAMP WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? AND SENDS < ? AND SENT_AT <= DATEADD(-${RESEND_SECONDS} SECOND TO CURRENT_TIMESTAMP) RETURNING ${RETURN_FIELDS}`, [this.hash(id, code), id, MAX_ATTEMPTS, MAX_SENDS]));
+                if (!result)
+                    throw this.limited();
+                return result;
+            }));
+            yield this.deliver(id, code, row.email);
+            return this.response(id, row.expiresAt);
+        });
+    }
+    consume(id, code) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[a-f0-9]{64}$/.test(id) || !/^\d{6}$/.test(code))
+                throw this.invalid();
+            const proof = yield this.transaction((query) => __awaiter(this, void 0, void 0, function* () {
+                // The conditional write serializes verification and persists failed attempts.
+                const row = this.row(yield query(`UPDATE ACCESSI_2FA SET ATTEMPTS = ATTEMPTS + 1 WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? RETURNING ${RETURN_FIELDS}`, [id, MAX_ATTEMPTS]));
+                if (!row)
+                    return null;
+                const expected = Buffer.from(row.codeHash.trim(), 'hex');
+                const actual = Buffer.from(this.hash(id, code), 'hex');
+                if (expected.length !== actual.length || !(0, crypto_1.timingSafeEqual)(expected, actual))
+                    return null;
+                yield query('UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ?', [MAX_ATTEMPTS, id]);
+                return row;
+            }));
+            // Throw after commit, otherwise a wrong code would roll back the attempt counter.
+            if (!proof)
+                throw this.invalid();
+            return proof;
+        });
+    }
+};
+exports.TwoFactorService = TwoFactorService;
+exports.TwoFactorService = TwoFactorService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object, EmailService_1.EmailService])
+], TwoFactorService);
+//# sourceMappingURL=TwoFactorService.js.map

package/dist/accessi-service/services/two-factor-service/TwoFactorService.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"TwoFactorService.js","sourceRoot":"","sources":["../../../../src/accessi-service/services/two-factor-service/TwoFactorService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAuH;AACvH,mCAA6E;AAC7E,sCAAmC;AACnC,kDAAmD;AAGnD,0EAAwE;AACxE,gEAA6D;AAkB7D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,aAAa,GAAG,iFAAiF,CAAC;AAExG,8GAA8G;AAEvG,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAC8C,OAAuB,EAClD,YAA0B;QADC,YAAO,GAAP,OAAO,CAAgB;QAClD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAEI,OAAO;QACb,OAAO,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAAC,CAAC;IAC3J,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,CAAC;IAEO,IAAI,CAAC,EAAU,EAAE,IAAY;QACnC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAA,wCAAmB,EAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1H,CAAC;IAEO,GAAG,CAAC,MAAe;;QACzB,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAwC,CAAC;QAChG,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAE3B,MAAM,GAAG,GAAG,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAEpC,MAAM,SAAS,GAAiB;YAC9B,YAAY;YACZ,KAAK,EAAE,MAAA,MAAA,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,0CAAE,IAAI,EAAE,mCAAI,EAAE;YACxC,IAAI,EAAE,MAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,0CAAE,IAAI,EAAgC,mCAAI,UAAU;YACjF,WAAW,EAAE,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,0CAAE,IAAI,EAAE;YACzC,QAAQ,EAAE,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,mCAAI,EAAE;YACtC,SAAS,EAAE,GAAG,CAAC,SAAiB;YAChC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,EAAE,GAAG,CAAC,MAAc;SAC3B,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEa,WAAW,CAAI,SAAuC;;YAClE,OAAO,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;gBAC7E,MAAM,KAAK,GAAU,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,SAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC1F,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAA,CAAC,CAAC;QACL,CAAC;KAAA;IAEO,QAAQ,CAAC,EAAU,EAAE,SAAe;QAC1C,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzJ,CAAC;IAEa,OAAO,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;;YAC3D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,WAAM,CAAC;gBACP,sFAAsF;gBACtF,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5C,6EAA6E,EAC7E,CAAC,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzE,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;YAC9I,CAAC;QACH,CAAC;KAAA;IAEK,KAAK,CAAC,KAAqB;;;YAC/B,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC,CAAC;YAClL,CAAC;YACD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;;gBACrD,gEAAgE;gBAChE,MAAM,KAAK,CAAC,sDAAsD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC1F,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sHAAsH,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAA+C,CAAC;gBACvN,IAAI,MAAM,CAAC,MAAA,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrF,MAAM,KAAK,CAAC,iFAAiF,CAAC,CAAC;gBAC/F,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB,mIAAmI,gBAAgB,qDAAqD,EACxM,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAA,KAAK,CAAC,WAAW,mCAAI,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAClG,CAAC;gBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;gBACnG,OAAO,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAS,CAAC;YACtD,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;KAAA;IAEK,QAAQ,CAAC,EAAU;;YACvB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC/D,UAAU,aAAa,8FAA8F,EAAE,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACrJ,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC;QACb,CAAC;KAAA;IAEK,MAAM,CAAC,EAAU;;YACrB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CACjC,wMAAwM,cAAc,2CAA2C,aAAa,EAAE,EAChR,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CACnD,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;KAAA;IAEK,OAAO,CAAC,EAAU,EAAE,IAAY;;YACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBACjD,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAC9B,uIAAuI,aAAa,EAAE,EACtJ,CAAC,EAAE,EAAE,YAAY,CAAC,CACnB,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzF,MAAM,KAAK,CAAC,4DAA4D,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO,GAAG,CAAC;YACb,CAAC,CAAA,CAAC,CAAC;YACH,kFAAkF;YAClF,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;CACF,CAAA;AAjIY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,gBAAgB,CAiI5B","sourcesContent":["import { HttpException, Inject, Injectable, ServiceUnavailableException, UnauthorizedException } from '@nestjs/common';\nimport { createHmac, randomBytes, randomInt, timingSafeEqual } from 'crypto';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { TwoFactorChallengeDto } from '../../dtos/TwoFactorDtos';\nimport { getAccessiJwtSecret } from '../../security/passwordResetToken';\nimport { EmailService } from '../email-service/EmailService';\n\nexport type TwoFactorMode = 'password' | 'passwordless' | 'federated';\nexport interface TwoFactorProof {\n codiceUtente: number;\n email: string;\n mode: TwoFactorMode;\n identityKey?: string;\n}\ntype ChallengeRow = TwoFactorProof & {\n codeHash: string;\n expiresAt: Date;\n attempts: number;\n sends: number;\n sentAt: Date;\n};\ntype Query = (sql: string, params?: unknown[]) => Promise<unknown>;\n\nconst LIFETIME_SECONDS = 600;\nconst MAX_ATTEMPTS = 5;\nconst RESEND_SECONDS = 60;\nconst MAX_SENDS = 3;\nconst RETURN_FIELDS = 'CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT, ATTEMPTS, SENDS, SENT_AT';\n\n/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */\n@Injectable()\nexport class TwoFactorService {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n private readonly emailService: EmailService,\n ) {}\n\n private invalid(): UnauthorizedException {\n return new UnauthorizedException({ code: 'ACCESSI_2FA_INVALID', message: 'Codice non valido o scaduto. Ripeti l accesso se hai esaurito i tentativi.' });\n }\n\n private limited(): HttpException {\n return new HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);\n }\n\n private hash(id: string, code: string): string {\n return createHmac('sha256', getAccessiJwtSecret(this.options, '2fa')).update(`accessi-2fa:${id}:${code}`).digest('hex');\n }\n\n private row(result: unknown): ChallengeRow | undefined {\n const row = (Array.isArray(result) ? result[0] : result) as Record<string, unknown> | undefined;\n if (!row) return undefined;\n\n const raw = RestUtilities.convertKeysToCamelCase(row);\n const asString = (value: unknown): string | undefined => typeof value === 'string' ? value : undefined;\n const codiceUtente = Number(raw.codute);\n if (!codiceUtente) return undefined;\n\n const converted: ChallengeRow = {\n codiceUtente,\n email: asString(raw.email)?.trim() ?? '',\n mode: (asString(raw.authmode)?.trim() as TwoFactorMode | undefined) ?? 'password',\n identityKey: asString(raw.idnkey)?.trim(),\n codeHash: asString(raw.codehash) ?? '',\n expiresAt: raw.expiresAt as Date,\n attempts: Number(raw.attempts),\n sends: Number(raw.sends),\n sentAt: raw.sentAt as Date,\n };\n return converted;\n }\n\n private async transaction<T>(operation: (query: Query) => Promise<T>): Promise<T> {\n return Orm.withTransaction(this.options.databaseOptions, async (transaction) => {\n const query: Query = (sql, params = []) => Orm.transactionQuery(transaction, sql, params);\n return operation(query);\n });\n }\n\n private response(id: string, expiresAt: Date): TwoFactorChallengeDto {\n return { twoFactorRequired: true, challengeId: id, expiresAt: new Date(expiresAt).toISOString(), resendAfterSeconds: RESEND_SECONDS, method: 'email' };\n }\n\n private async deliver(id: string, code: string, email: string): Promise<void> {\n try {\n await this.emailService.sendTwoFactorCode(email, code, LIFETIME_SECONDS / 60);\n } catch {\n // Invalidate only the code whose delivery failed, preserving a concurrent newer code.\n await Orm.execute(this.options.databaseOptions,\n 'UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ? AND CODEHASH = ?',\n [MAX_ATTEMPTS, id, this.hash(id, code)], false).catch(() => undefined);\n throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_DELIVERY_FAILED', message: 'Invio del codice non riuscito. Riprova tra poco.' });\n }\n }\n\n async issue(proof: TwoFactorProof): Promise<TwoFactorChallengeDto> {\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(proof.email ?? '')) {\n throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_EMAIL_REQUIRED', message: 'Per il codice di accesso serve un indirizzo email valido. Contatta un amministratore.' });\n }\n const id = randomBytes(32).toString('hex');\n const code = String(randomInt(1000000)).padStart(6, '0');\n const expiresAt = await this.transaction(async query => {\n // Serialize issuance for this account across backend instances.\n await query('SELECT CODUTE FROM UTENTI WHERE CODUTE = ? WITH LOCK', [proof.codiceUtente]);\n const recent = await query('SELECT COUNT(*) AS TOTAL FROM ACCESSI_2FA WHERE CODUTE = ? AND CREATED_AT > DATEADD(-15 MINUTE TO CURRENT_TIMESTAMP)', [proof.codiceUtente]) as Array<Record<string, unknown>> | undefined;\n if (Number(recent?.[0]?.TOTAL ?? recent?.[0]?.total ?? 0) >= 5) throw this.limited();\n await query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');\n const created = await query(\n `INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`,\n [id, proof.codiceUtente, proof.email, proof.mode, proof.identityKey ?? null, this.hash(id, code)],\n );\n const row = (Array.isArray(created) ? created[0] : created) as Record<string, unknown> | undefined;\n return (row?.EXPIRES_AT ?? row?.expires_at) as Date;\n });\n await this.deliver(id, code, proof.email);\n return this.response(id, expiresAt);\n }\n\n async describe(id: string): Promise<TwoFactorProof> {\n if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n const row = this.row(await Orm.query(this.options.databaseOptions,\n `SELECT ${RETURN_FIELDS} FROM ACCESSI_2FA WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ?`, [id, MAX_ATTEMPTS], false));\n if (!row) throw this.invalid();\n return row;\n }\n\n async resend(id: string): Promise<TwoFactorChallengeDto> {\n if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n const code = String(randomInt(1000000)).padStart(6, '0');\n const row = await this.transaction(async query => {\n const result = this.row(await query(\n `UPDATE ACCESSI_2FA SET CODEHASH = ?, SENDS = SENDS + 1, SENT_AT = CURRENT_TIMESTAMP WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? AND SENDS < ? AND SENT_AT <= DATEADD(-${RESEND_SECONDS} SECOND TO CURRENT_TIMESTAMP) RETURNING ${RETURN_FIELDS}`,\n [this.hash(id, code), id, MAX_ATTEMPTS, MAX_SENDS],\n ));\n if (!result) throw this.limited();\n return result;\n });\n await this.deliver(id, code, row.email);\n return this.response(id, row.expiresAt);\n }\n\n async consume(id: string, code: string): Promise<TwoFactorProof> {\n if (!/^[a-f0-9]{64}$/.test(id) || !/^\\d{6}$/.test(code)) throw this.invalid();\n const proof = await this.transaction(async query => {\n // The conditional write serializes verification and persists failed attempts.\n const row = this.row(await query(\n `UPDATE ACCESSI_2FA SET ATTEMPTS = ATTEMPTS + 1 WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? RETURNING ${RETURN_FIELDS}`,\n [id, MAX_ATTEMPTS],\n ));\n if (!row) return null;\n const expected = Buffer.from(row.codeHash.trim(), 'hex');\n const actual = Buffer.from(this.hash(id, code), 'hex');\n if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) return null;\n await query('UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ?', [MAX_ATTEMPTS, id]);\n return row;\n });\n // Throw after commit, otherwise a wrong code would roll back the attempt counter.\n if (!proof) throw this.invalid();\n return proof;\n }\n}\n"]}