emilsoftware-utilities 2.0.0-dev.84 → 2.0.0-dev.85

package/dist/accessi-module/Controllers/AccessiConsoleController.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"AccessiConsoleController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AccessiConsoleController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAqE;AACrE,6CAAuD;AAEvD,mCAAqC;AACrC,2BAAkC;AAClC,+BAA4B;AAE5B,iEAGqC;AACrC,yDAA0E;AAE1E,6HAA6H;AAGtH,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YAAwD,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAE3E,SAAS;;QACf,MAAM,OAAO,GAAG,MAAA,IAAI,CAAC,OAAO,CAAC,iBAAiB,0CAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAExF,MAAM,YAAY,GAAG,IAAA,6CAA+B,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG;YAChB,OAAO,CAAC,CAAC,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC5E,YAAY,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE;YAC1D,YAAY,CAAC,CAAC,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACxG,YAAY,CAAC,CAAC,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;SAC1G,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,MAAM,MAAM,GAAG,SAAS;YACtB,CAAC,CAAC,yCAAyC,SAAS,WAAW;YAC/D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC;aACjF,OAAO,CAAC,SAAS,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kFAAkF;IAC1E,iBAAiB;;QACvB,MAAM,OAAO,GAAG,MAAA,IAAI,CAAC,OAAO,CAAC,iBAAiB,0CAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAGD,KAAK,CAAQ,GAAa;;QACxB,MAAM,QAAQ,GAAG,IAAA,+CAA6B,EAAC,MAAA,IAAI,CAAC,OAAO,CAAC,IAAI,0CAAE,eAAe,CAAC,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,YAAY,KAAI,qBAAqB,CAAC,CAAC;QAChF,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,cAAc,KAAI,aAAa,CAAC,CAAC;QAC5E,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,YAAY;gBAAE,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;YACnF,IAAI,QAAQ,CAAC,iBAAiB;gBAAE,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAClG,CAAC;QAED,oGAAoG;QACpG,MAAM,KAAK,GAAG,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,qBAAqB,EAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,QAAQ,EAAE,CAAC;YACb,IAAA,mDAAiC,EAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,kCACrD,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC3B,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,IACpC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAuBD,2EAA2E;IAC3E,qEAAqE;IAErE,KAAK,CAAgB,IAAY,EAAS,GAAa;QACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACrD,uEAAuE;QACvE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;OAGG;IAEH,OAAO,CAAgB,IAAY,EAAS,GAAa;QACvD,IAAI,CAAC,0BAAwB,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,oEAAoE;IAEpE,UAAU,CAAgB,IAAY,EAAgB,GAAW,EAAS,GAAa;QACrF,IAAI,CAAC,0BAAwB,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;;AA7GU,4DAAwB;AA8DnC;;;GAGG;AACqB,qCAAY,GAAG,IAAI,GAAG,CAAC;IAC7C,QAAQ;IACR,eAAe;IACf,eAAe;IACf,sBAAsB;IACtB,oBAAoB;IACpB,yBAAyB;IACzB,QAAQ;IACR,eAAe;IACf,aAAa;IACb,KAAK;IACL,cAAc;IACd,YAAY;IACZ,mBAAmB;IACnB,MAAM;CACP,CAAC,AAfkC,CAejC;AA3CH;IADC,IAAA,YAAG,GAAE;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;qDAsBX;AA0BD;IADC,IAAA,YAAG,EAAC,cAAc,CAAC;IACb,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;qDAMxC;AAOD;IADC,IAAA,YAAG,EAAC,OAAO,CAAC;IACJ,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAG1C;AAID;IADC,IAAA,YAAG,EAAC,YAAY,CAAC;IACN,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;IAAe,WAAA,IAAA,YAAG,GAAE,CAAA;;;;0DAGxE;mCA7GU,wBAAwB;IAFpC,IAAA,8BAAoB,GAAE;IACtB,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAIf,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAH3B,wBAAwB,CA8GpC","sourcesContent":["import { Controller, Get, Inject, Param, Res } from '@nestjs/common';\nimport { ApiExcludeController } from '@nestjs/swagger';\nimport { Response } from 'express';\nimport { randomBytes } from 'crypto';\nimport { readFileSync } from 'fs';\nimport { join } from 'path';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n  applyAccessiContentSecurityPolicy,\n  resolveAccessiSecurityHeaders,\n} from '../security/securityHeaders';\nimport { resolveAccessiAuthCookieOptions } from '../security/authCookies';\n\n/** Serves the framework-free administrative console bundled with Accessi. API authorization remains on each API endpoint. */\n@ApiExcludeController()\n@Controller('accessi/console')\nexport class AccessiConsoleController {\n  private htmlCache?: { baseUrl: string | undefined; content: string };\n\n  constructor(@Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions) {}\n\n  private indexHtml(): string {\n    const baseUrl = this.options.consoleApiBaseUrl?.replace(/\\/+$/, '');\n    if (this.htmlCache && this.htmlCache.baseUrl === baseUrl) return this.htmlCache.content;\n\n    const cookieConfig = resolveAccessiAuthCookieOptions(this.options);\n    const bootstrap = [\n      baseUrl ? `window.__ACCESSI_API_BASE_URL__=${JSON.stringify(baseUrl)};` : '',\n      cookieConfig ? 'window.__ACCESSI_AUTH_COOKIE__=true;' : '',\n      cookieConfig ? `window.__ACCESSI_CSRF_COOKIE_NAME__=${JSON.stringify(cookieConfig.csrfTokenName)};` : '',\n      cookieConfig ? `window.__ACCESSI_CSRF_HEADER_NAME__=${JSON.stringify(cookieConfig.csrfHeaderName)};` : '',\n    ].join('');\n    const marker = bootstrap\n      ? `<script nonce=\"__ACCESSI_CSP_NONCE__\">${bootstrap}</script>`\n      : '';\n    const content = readFileSync(join(__dirname, '..', 'Console', 'index.html'), 'utf8')\n      .replace('</head>', `${marker}</head>`);\n    this.htmlCache = { baseUrl, content };\n    return content;\n  }\n\n  /** Origini raggiungibili dalla console: l'API puo stare su un dominio diverso. */\n  private consoleConnectSrc(): string[] {\n    const baseUrl = this.options.consoleApiBaseUrl?.replace(/\\/+$/, '');\n    if (!baseUrl) return [];\n    try {\n      const url = new URL(baseUrl);\n      return [`${url.protocol}//${url.host}`];\n    } catch {\n      return [];\n    }\n  }\n\n  @Get()\n  index(@Res() res: Response) {\n    const security = resolveAccessiSecurityHeaders(this.options.http?.securityHeaders);\n    res.setHeader('Cache-Control', security?.cacheControl || 'no-store, max-age=0');\n    res.setHeader('Referrer-Policy', security?.referrerPolicy || 'no-referrer');\n    res.setHeader('X-Content-Type-Options', 'nosniff');\n    if (security) {\n      if (security.frameOptions) res.setHeader('X-Frame-Options', security.frameOptions);\n      if (security.permissionsPolicy) res.setHeader('Permissions-Policy', security.permissionsPolicy);\n    }\n\n    // Il nonce cambia a ogni risposta: la shell HTML non puo essere cacheata con il valore incorporato.\n    const nonce = security?.contentSecurityPolicy ? randomBytes(16).toString('base64') : '';\n    if (security) {\n      applyAccessiContentSecurityPolicy(res, security, 'console', {\n        ...(nonce ? { nonce } : {}),\n        connectSrc: this.consoleConnectSrc(),\n      });\n    }\n\n    const html = this.indexHtml().split('__ACCESSI_CSP_NONCE__').join(nonce);\n    res.setHeader('Content-Type', 'text/html; charset=utf-8');\n    return res.send(html);\n  }\n\n  /**\n   * Percorsi SPA ammessi. Deve restare allineato a `routeSegment` (e ai padri dei\n   * sottomenu) in Console/console.ts, altrimenti i deep link restituiscono 404.\n   */\n  private static readonly allowedViews = new Set([\n    'utenti',\n    'ruoli-e-grant',\n    'menu-e-gruppi',\n    'menu-e-gruppi/gruppi',\n    'menu-e-gruppi/menu',\n    'menu-e-gruppi/tipi-menu',\n    'filtri',\n    'filtri/utente',\n    'filtri/tipi',\n    'sso',\n    'sso/provider',\n    'sso/utenti',\n    'token-di-servizio',\n    'wiki',\n  ]);\n\n  // Le route statiche vanno dichiarate prima di `:view/:sub`, che altrimenti\n  // catturerebbe `assets/<file>` e restituirebbe 404 per CSS e bundle.\n  @Get('assets/:file')\n  asset(@Param('file') file: string, @Res() res: Response) {\n    const allowed = new Set(['console.css', 'console.js']);\n    if (!allowed.has(file)) return res.status(404).end();\n    // Keep the SPA shell, styles and bundle on the same deployed revision.\n    res.setHeader('Cache-Control', 'no-store, max-age=0');\n    return res.sendFile(join(__dirname, '..', 'Console', file));\n  }\n\n  /**\n   * Serves the SPA shell for the supported console sections, allowing direct\n   * navigation, bookmarks and browser back/forward without server-side state.\n   */\n  @Get(':view')\n  section(@Param('view') view: string, @Res() res: Response) {\n    if (!AccessiConsoleController.allowedViews.has(view)) return res.status(404).end();\n    return this.index(res);\n  }\n\n  /** Serves the SPA shell for nested sections (menu, filtri, SSO). */\n  @Get(':view/:sub')\n  subsection(@Param('view') view: string, @Param('sub') sub: string, @Res() res: Response) {\n    if (!AccessiConsoleController.allowedViews.has(`${view}/${sub}`)) return res.status(404).end();\n    return this.index(res);\n  }\n}\n"]}

package/dist/accessi-module/Controllers/AccessiIntrospectionController.d.ts

@@ -1,17 +0,0 @@
-import { Response } from 'express';
-import { IntrospectAccessiTokenRequest } from '../Dtos';
-import { PermissionService } from '../Services/PermissionService/PermissionService';
-import { AuthService } from '../Services/AuthService/AuthService';
-/**
- * Endpoint service-to-service per validare un access token Accessi.
- *
- * Non e pensato per il browser: richiede un service token con scope
- * `accessi:introspect`. I backend fratelli lo usano per autorizzare richieste
- * senza accedere al database Accessi.
- */
-export declare class AccessiIntrospectionController {
-    private readonly authService;
-    private readonly permissionService;
-    constructor(authService: AuthService, permissionService: PermissionService);
-    introspect(body: IntrospectAccessiTokenRequest, res: Response): Promise<Response>;
-}

package/dist/accessi-module/Controllers/AccessiIntrospectionController.js

@@ -1,102 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var AccessiIntrospectionController_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AccessiIntrospectionController = void 0;
-const common_1 = require("@nestjs/common");
-const swagger_1 = require("@nestjs/swagger");
-const Utilities_1 = require("../../Utilities");
-const Dtos_1 = require("../Dtos");
-const PermissionService_1 = require("../Services/PermissionService/PermissionService");
-const AuthService_1 = require("../Services/AuthService/AuthService");
-const serviceTokenGuard_1 = require("../security/serviceTokenGuard");
-const metrics_1 = require("../observability/metrics");
-/**
- * Endpoint service-to-service per validare un access token Accessi.
- *
- * Non e pensato per il browser: richiede un service token con scope
- * `accessi:introspect`. I backend fratelli lo usano per autorizzare richieste
- * senza accedere al database Accessi.
- */
-let AccessiIntrospectionController = AccessiIntrospectionController_1 = class AccessiIntrospectionController {
-    constructor(authService, permissionService) {
-        this.authService = authService;
-        this.permissionService = permissionService;
-    }
-    introspect(body, res) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const startedAt = Date.now();
-            try {
-                if (!(body === null || body === void 0 ? void 0 : body.token)) {
-                    (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'bad_request' });
-                    return Utilities_1.RestUtilities.sendErrorMessage(res, 'Token non fornito.', AccessiIntrospectionController_1.name, common_1.HttpStatus.BAD_REQUEST);
-                }
-                const introspection = yield this.authService.introspectAccessToken(body.token);
-                if (!introspection.active || !introspection.codiceUtente) {
-                    (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'inactive' });
-                    return Utilities_1.RestUtilities.sendBaseResponse(res, { active: false });
-                }
-                const user = (_a = introspection.payload) === null || _a === void 0 ? void 0 : _a.utente;
-                const grants = yield this.permissionService.getUserRolesAndGrants(introspection.codiceUtente);
-                (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'active' });
-                return Utilities_1.RestUtilities.sendBaseResponse(res, Object.assign(Object.assign({ active: true }, (user ? { user } : {})), { grants }));
-            }
-            catch (error) {
-                (0, metrics_1.recordAccessiMetric)('accessi_introspection_total', 1, { result: 'error' });
-                return Utilities_1.RestUtilities.sendErrorMessage(res, error, AccessiIntrospectionController_1.name);
-            }
-            finally {
-                (0, metrics_1.recordAccessiDuration)('accessi_introspection_duration_ms', Date.now() - startedAt);
-            }
-        });
-    }
-};
-exports.AccessiIntrospectionController = AccessiIntrospectionController;
-__decorate([
-    (0, common_1.Post)('introspect'),
-    (0, serviceTokenGuard_1.RequireServiceTokenScopes)('accessi:introspect'),
-    (0, swagger_1.ApiOperation)({
-        summary: 'Verifica un access token Accessi',
-        operationId: 'introspectAccessiToken',
-        description: 'Restituisce active=false per token invalido, scaduto o utente non piu abilitato. Richiede un service token con scope accessi:introspect.',
-    }),
-    (0, swagger_1.ApiBody)({ type: Dtos_1.IntrospectAccessiTokenRequest }),
-    (0, swagger_1.ApiOkResponse)({ description: 'Esito della verifica token.', type: Dtos_1.IntrospectAccessiTokenResponse }),
-    (0, swagger_1.ApiResponse)({ status: common_1.HttpStatus.UNAUTHORIZED, description: 'Service token mancante o non valido.', type: Dtos_1.ErrorResponse }),
-    (0, swagger_1.ApiResponse)({ status: common_1.HttpStatus.FORBIDDEN, description: 'Scope accessi:introspect mancante.', type: Dtos_1.ErrorResponse }),
-    __param(0, (0, common_1.Body)()),
-    __param(1, (0, common_1.Res)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Dtos_1.IntrospectAccessiTokenRequest, Object]),
-    __metadata("design:returntype", Promise)
-], AccessiIntrospectionController.prototype, "introspect", null);
-exports.AccessiIntrospectionController = AccessiIntrospectionController = AccessiIntrospectionController_1 = __decorate([
-    (0, swagger_1.ApiTags)('ServiceToken'),
-    (0, swagger_1.ApiBearerAuth)(),
-    (0, common_1.Controller)('accessi/auth'),
-    (0, common_1.UseGuards)(serviceTokenGuard_1.ServiceTokenGuard),
-    __metadata("design:paramtypes", [AuthService_1.AuthService,
-        PermissionService_1.PermissionService])
-], AccessiIntrospectionController);
-//# sourceMappingURL=AccessiIntrospectionController.js.map

package/dist/accessi-module/Controllers/AccessiIntrospectionController.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"AccessiIntrospectionController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AccessiIntrospectionController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoF;AACpF,6CAOyB;AAEzB,+CAAgD;AAChD,kCAIiB;AACjB,uFAAoF;AACpF,qEAAkE;AAClE,qEAA6F;AAC7F,sDAAsF;AAEtF;;;;;;GAMG;AAKI,IAAM,8BAA8B,sCAApC,MAAM,8BAA8B;IACzC,YACmB,WAAwB,EACxB,iBAAoC;QADpC,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAcE,UAAU,CACN,IAAmC,EACpC,GAAa;;;YAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,EAAE,CAAC;oBACjB,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;oBACjF,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,oBAAoB,EACpB,gCAA8B,CAAC,IAAI,EACnC,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/E,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;oBACzD,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,GAAG,MAAC,aAAa,CAAC,OAA4C,0CAAE,MAAM,CAAC;gBACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC9F,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,gCACvC,MAAM,EAAE,IAAI,IACT,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACzB,MAAM,IACN,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,6BAAmB,EAAC,6BAA6B,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC3E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gCAA8B,CAAC,IAAI,CAAC,CAAC;YACzF,CAAC;oBAAS,CAAC;gBACT,IAAA,+BAAqB,EAAC,mCAAmC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAvDY,wEAA8B;AAkBnC;IAZL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,6CAAyB,EAAC,oBAAoB,CAAC;IAC/C,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,wBAAwB;QACrC,WAAW,EACT,0IAA0I;KAC7I,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,oCAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,qCAA8B,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,mBAAU,CAAC,YAAY,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC1H,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAEnH,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADQ,oCAA6B;;gEAmC5C;yCAtDU,8BAA8B;IAJ1C,IAAA,iBAAO,EAAC,cAAc,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC1B,IAAA,kBAAS,EAAC,qCAAiB,CAAC;qCAGK,yBAAW;QACL,qCAAiB;GAH5C,8BAA8B,CAuD1C","sourcesContent":["import { Body, Controller, HttpStatus, Post, Res, UseGuards } from '@nestjs/common';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiOkResponse,\n  ApiOperation,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport {\n  ErrorResponse,\n  IntrospectAccessiTokenRequest,\n  IntrospectAccessiTokenResponse,\n} from '../Dtos';\nimport { PermissionService } from '../Services/PermissionService/PermissionService';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { RequireServiceTokenScopes, ServiceTokenGuard } from '../security/serviceTokenGuard';\nimport { recordAccessiDuration, recordAccessiMetric } from '../observability/metrics';\n\n/**\n * Endpoint service-to-service per validare un access token Accessi.\n *\n * Non e pensato per il browser: richiede un service token con scope\n * `accessi:introspect`. I backend fratelli lo usano per autorizzare richieste\n * senza accedere al database Accessi.\n */\n@ApiTags('ServiceToken')\n@ApiBearerAuth()\n@Controller('accessi/auth')\n@UseGuards(ServiceTokenGuard)\nexport class AccessiIntrospectionController {\n  constructor(\n    private readonly authService: AuthService,\n    private readonly permissionService: PermissionService,\n  ) {}\n\n  @Post('introspect')\n  @RequireServiceTokenScopes('accessi:introspect')\n  @ApiOperation({\n    summary: 'Verifica un access token Accessi',\n    operationId: 'introspectAccessiToken',\n    description:\n      'Restituisce active=false per token invalido, scaduto o utente non piu abilitato. Richiede un service token con scope accessi:introspect.',\n  })\n  @ApiBody({ type: IntrospectAccessiTokenRequest })\n  @ApiOkResponse({ description: 'Esito della verifica token.', type: IntrospectAccessiTokenResponse })\n  @ApiResponse({ status: HttpStatus.UNAUTHORIZED, description: 'Service token mancante o non valido.', type: ErrorResponse })\n  @ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Scope accessi:introspect mancante.', type: ErrorResponse })\n  async introspect(\n    @Body() body: IntrospectAccessiTokenRequest,\n    @Res() res: Response,\n  ): Promise<Response> {\n    const startedAt = Date.now();\n    try {\n      if (!body?.token) {\n        recordAccessiMetric('accessi_introspection_total', 1, { result: 'bad_request' });\n        return RestUtilities.sendErrorMessage(\n          res,\n          'Token non fornito.',\n          AccessiIntrospectionController.name,\n          HttpStatus.BAD_REQUEST,\n        );\n      }\n\n      const introspection = await this.authService.introspectAccessToken(body.token);\n      if (!introspection.active || !introspection.codiceUtente) {\n        recordAccessiMetric('accessi_introspection_total', 1, { result: 'inactive' });\n        return RestUtilities.sendBaseResponse(res, { active: false });\n      }\n\n      const user = (introspection.payload as { utente?: unknown } | undefined)?.utente;\n      const grants = await this.permissionService.getUserRolesAndGrants(introspection.codiceUtente);\n      recordAccessiMetric('accessi_introspection_total', 1, { result: 'active' });\n      return RestUtilities.sendBaseResponse(res, {\n        active: true,\n        ...(user ? { user } : {}),\n        grants,\n      });\n    } catch (error) {\n      recordAccessiMetric('accessi_introspection_total', 1, { result: 'error' });\n      return RestUtilities.sendErrorMessage(res, error, AccessiIntrospectionController.name);\n    } finally {\n      recordAccessiDuration('accessi_introspection_duration_ms', Date.now() - startedAt);\n    }\n  }\n}\n"]}

package/dist/accessi-module/Controllers/AuthController.d.ts

@@ -1,24 +0,0 @@
-import { ResendTwoFactorRequest, VerifyTwoFactorRequest } from '../Dtos/TwoFactorDtos';
-import { Request, Response } from 'express';
-import { Logger } from '../../Logger';
-import type { AccessiOptions } from '../AccessiModule';
-import { BootstrapAdminRequest, ConfirmResetPasswordRequest, GetUserByTokenRequest, LoginRequest, RefreshTokenRequest, RevokeTokenRequest } from '../Dtos';
-import { AuthService } from '../Services/AuthService/AuthService';
-import { AdminBootstrapService } from '../Services/AdminBootstrapService/AdminBootstrapService';
-export declare class AuthController {
-    private readonly authService;
-    private readonly adminBootstrapService;
-    private readonly options;
-    logger: Logger;
-    constructor(authService: AuthService, adminBootstrapService: AdminBootstrapService, options: AccessiOptions);
-    resetPassword(request: Request, res: Response, token: string, body: ConfirmResetPasswordRequest): Promise<Response<any, Record<string, any>>>;
-    getUserByToken(request: Request, body: GetUserByTokenRequest, res: Response): Promise<Response<any, Record<string, any>>>;
-    revokeSessions(request: Request, res: Response): Promise<Response<any, Record<string, any>>>;
-    revokeToken(request: Request, body: RevokeTokenRequest, res: Response): Promise<Response<any, Record<string, any>>>;
-    login(request: Request, loginRequest: LoginRequest, res: Response): Promise<Response<any, Record<string, any>>>;
-    refresh(request: Request, body: RefreshTokenRequest, res: Response): Promise<Response<any, Record<string, any>>>;
-    verifyTwoFactor(request: Request, body: VerifyTwoFactorRequest, res: Response): Promise<Response<any, Record<string, any>>>;
-    resendTwoFactor(request: Request, body: ResendTwoFactorRequest, res: Response): Promise<Response<any, Record<string, any>>>;
-    bootstrapAdmin(request: Request, body: BootstrapAdminRequest, res: Response): Promise<Response<any, Record<string, any>>>;
-    adminBootstrapStatus(res: Response): Promise<Response<any, Record<string, any>>>;
-}