emilsoftware-utilities 2.0.0-dev.84 → 2.0.0-dev.85

package/dist/accessi-module/federated-auth/FederatedAuthService.d.ts

@@ -1,102 +0,0 @@
-import { OnModuleInit } from '@nestjs/common';
-import type { AccessiOptions } from '../AccessiModule';
-import { RegisterRequest } from '../Dtos/RegisterRequest';
-import { AuthService } from '../Services/AuthService/AuthService';
-import { UserService } from '../Services/UserService/UserService';
-import { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './FederatedAuthTypes';
-/**
- * Maps externally verified identities to Accessi users and issues the usual
- * Accessi JWT. It deliberately has no provider SDK dependency: validating an
- * Azure, Google, Apple, SAML, or custom token is always the hosting backend's job.
- */
-export declare class FederatedAuthService implements OnModuleInit {
-    private readonly options;
-    private readonly userService;
-    private readonly authService;
-    constructor(options: AccessiOptions, userService: UserService, authService: AuthService);
-    /** Await the same schema barrier as the module updater; never race two DDL implementations. */
-    onModuleInit(): Promise<void>;
-    /** Returns true only when the host application opted in to federated authentication. */
-    isEnabled(): boolean;
-    /**
-     * Exchanges a backend-verified identity for the same login result and JWT
-     * emitted by the local password endpoint. No raw external token is accepted.
-     */
-    authenticate(identity: VerifiedFederatedIdentity): Promise<FederatedAuthenticationResult>;
-    /** Links an external identity to an existing Accessi user. It never changes that user's password policy. */
-    linkIdentity(codiceUtente: number, identity: VerifiedFederatedIdentity, note?: string): Promise<FederatedIdentity>;
-    /** Creates a confirmed Accessi user, associates an SSO identity and defaults the new user to SSO-only. */
-    createManagedFederatedUser(registrationData: RegisterRequest, identity: VerifiedFederatedIdentity, passwordLoginEnabled?: boolean, note?: string): Promise<FederatedIdentity>;
-    /**
-     * Allows self-provisioning only when explicitly enabled. The caller must have
-     * verified the external identity and decide which profile fields are trusted.
-     */
-    registerSelfServiceFederatedUser(registrationData: RegisterRequest, identity: VerifiedFederatedIdentity): Promise<FederatedIdentity>;
-    /** Returns all linked identities for administration; disabled identities are included. */
-    getUserIdentities(codiceUtente: number): Promise<FederatedIdentity[]>;
-    /** Returns the complete provider catalog, including inactive providers, for superuser administration. */
-    getProviders(): Promise<FederatedProvider[]>;
-    /** Registers a provider key that must match the backend's SSO configuration exactly. */
-    createProvider(input: {
-        provider: string;
-        description: string;
-        note?: string;
-    }): Promise<FederatedProvider>;
-    /** Updates provider metadata or disables the provider without removing its identity history. */
-    /**
-     * Aggiorna metadati amministrativi del catalogo. La chiave provider e immutabile perche parte dell'identita
-     * persistita e deve coincidere esattamente con la configurazione del backend validante.
-     */
-    updateProvider(providerValue: string, update: {
-        description?: string;
-        active?: boolean;
-        note?: string;
-    }): Promise<FederatedProvider>;
-    /**
-     * Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK
-     * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un
-     * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.
-     */
-    deleteProvider(providerValue: string): Promise<void>;
-    /** Enables or disables all local password authentication for one user. */
-    /**
-     * Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso
-     * email/password, che restituisce `PASSWORD_LOGIN_DISABLED`. L'assenza della riga mantiene il default legacy `true`.
-     */
-    setPasswordLoginEnabled(codiceUtente: number, enabled: boolean): Promise<void>;
-    /** Returns the effective local password policy. Users without a policy row retain the historic enabled default. */
-    /** Restituisce la policy effettiva; utenti precedenti alla migrazione restano abilitati alla password. */
-    isPasswordLoginEnabled(codiceUtente: number): Promise<boolean>;
-    /** Soft-disables a linked identity without deleting operational history. */
-    /** Disabilita logicamente un collegamento SSO conservando audit e possibilita di successiva riattivazione. */
-    disableIdentity(identityKey: string): Promise<void>;
-    /** Restituisce il CODUTE proprietario di un collegamento SSO, o null se assente. */
-    getIdentityOwner(identityKey: string): Promise<number | null>;
-    /** Permanently removes one identity link from its owning user after administrative confirmation. */
-    /**
-     * Elimina fisicamente un collegamento SSO soltanto dopo aver verificato che appartenga all'utente indicato.
-     * Non elimina mai l'utente Accessi, password, ruoli o grant associati.
-     */
-    deleteIdentity(codiceUtente: number, identityKey: string): Promise<void>;
-    /** Aggiorna lo stato o la nota di un collegamento SSO usando la sua chiave tecnica amministrativa. */
-    /** Aggiorna stato o nota amministrativa senza modificare provider e subject, che identificano la persona. */
-    updateIdentity(identityKey: string, update: {
-        active?: boolean;
-        note?: string;
-    }): Promise<void>;
-    /** Explicit administrative schema reconciliation, shared with the standard updater. */
-    ensureSchema(): Promise<void>;
-    private findIdentity;
-    private assertUserExists;
-    private assertEnabled;
-    /** Validates the opaque SHA-256 key used only by administrative identity endpoints. */
-    private assertIdentityKey;
-    private normalizeIdentity;
-    private normalizeProvider;
-    private normalizeDescription;
-    private assertProviderActive;
-    private findProvider;
-    private getIdentityKey;
-    private toIdentity;
-    private toProvider;
-}

package/dist/accessi-module/federated-auth/FederatedAuthService.js

@@ -1,472 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FederatedAuthService = void 0;
-const common_1 = require("@nestjs/common");
-const crypto_1 = require("crypto");
-const AccessiDatabaseUpdater_1 = require("../database-updates/AccessiDatabaseUpdater");
-const Orm_1 = require("../../Orm");
-const Utilities_1 = require("../../Utilities");
-const StatoRegistrazione_1 = require("../Dtos/StatoRegistrazione");
-const AuthService_1 = require("../Services/AuthService/AuthService");
-const UserService_1 = require("../Services/UserService/UserService");
-const authenticatedToken_1 = require("../security/authenticatedToken");
-const sessionRevocation_1 = require("../security/sessionRevocation");
-/**
- * Maps externally verified identities to Accessi users and issues the usual
- * Accessi JWT. It deliberately has no provider SDK dependency: validating an
- * Azure, Google, Apple, SAML, or custom token is always the hosting backend's job.
- */
-let FederatedAuthService = class FederatedAuthService {
-    constructor(options, userService, authService) {
-        this.options = options;
-        this.userService = userService;
-        this.authService = authService;
-    }
-    /** Await the same schema barrier as the module updater; never race two DDL implementations. */
-    onModuleInit() {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.initialize(this.options);
-        });
-    }
-    /** Returns true only when the host application opted in to federated authentication. */
-    isEnabled() {
-        var _a;
-        return ((_a = this.options.federatedAuthentication) === null || _a === void 0 ? void 0 : _a.enabled) === true;
-    }
-    /**
-     * Exchanges a backend-verified identity for the same login result and JWT
-     * emitted by the local password endpoint. No raw external token is accepted.
-     */
-    authenticate(identity) {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.assertEnabled();
-            const normalized = this.normalizeIdentity(identity);
-            yield this.assertProviderActive(normalized.provider);
-            const linkedIdentity = yield this.findIdentity(normalized, true);
-            if (!linkedIdentity) {
-                throw new common_1.NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_LINKED', message: 'Identita esterna non associata a un utente Accessi.' });
-            }
-            const currentUser = yield this.userService.getAuthenticatedUserSnapshot(linkedIdentity.codiceUtente);
-            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
-                throw new common_1.ForbiddenException({ code: 'FEDERATED_USER_DISABLED', message: 'Utente Accessi non abilitato.' });
-            }
-            if (currentUser.flagDueFattori) {
-                const login = yield this.authService.beginFederatedTwoFactor(linkedIdentity.codiceUtente, linkedIdentity.identityKey);
-                return { codiceUtente: linkedIdentity.codiceUtente, login };
-            }
-            yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [linkedIdentity.identityKey]);
-            yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [linkedIdentity.codiceUtente]);
-            const login = yield this.authService.getLoginResultForUser(linkedIdentity.codiceUtente);
-            const tokens = typeof this.authService.createTokenPair === 'function'
-                ? this.authService.createTokenPair(login.utente, ['federated'])
-                : { access: this.authService.createAccessiToken(login.utente, ['federated']), refresh: undefined };
-            login.token = tokens.access;
-            if (tokens.refresh)
-                login.refreshToken = tokens.refresh;
-            return {
-                codiceUtente: linkedIdentity.codiceUtente,
-                login,
-                token: tokens.access,
-            };
-        });
-    }
-    /** Links an external identity to an existing Accessi user. It never changes that user's password policy. */
-    linkIdentity(codiceUtente, identity, note) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            this.assertEnabled();
-            yield this.assertUserExists(codiceUtente);
-            const normalized = this.normalizeIdentity(identity);
-            yield this.assertProviderActive(normalized.provider);
-            const existing = yield this.findIdentity(normalized, false);
-            if (existing && existing.codiceUtente !== codiceUtente) {
-                throw new common_1.ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identita esterna gia associata a un altro utente.' });
-            }
-            if (existing) {
-                yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 1, DATDISATT = NULL, NOTA = ? WHERE IDNKEY = ?', [(_a = note !== null && note !== void 0 ? note : existing.note) !== null && _a !== void 0 ? _a : null, existing.identityKey]);
-            }
-            else {
-                yield Orm_1.Orm.execute(this.options.databaseOptions, `INSERT INTO UTENTI_IDENTITA_EXT (IDNKEY, CODUTE, PROVIDER, SUBJECT, FLGATTIVO, NOTA)
-         VALUES (?, ?, ?, ?, 1, ?)`, [this.getIdentityKey(normalized), codiceUtente, normalized.provider, normalized.subject, note !== null && note !== void 0 ? note : null]);
-            }
-            return (yield this.findIdentity(normalized, false));
-        });
-    }
-    /** Creates a confirmed Accessi user, associates an SSO identity and defaults the new user to SSO-only. */
-    createManagedFederatedUser(registrationData_1, identity_1) {
-        return __awaiter(this, arguments, void 0, function* (registrationData, identity, passwordLoginEnabled = false, note) {
-            this.assertEnabled();
-            const normalizedIdentity = this.normalizeIdentity(identity);
-            yield this.assertProviderActive(normalizedIdentity.provider);
-            if (yield this.findIdentity(normalizedIdentity, false)) {
-                throw new common_1.ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identità esterna già associata a un utente Accessi.' });
-            }
-            try {
-                const codiceUtente = yield this.userService.register(registrationData, {
-                    allowPrivilegedFields: true,
-                    initialState: StatoRegistrazione_1.StatoRegistrazione.CONF,
-                });
-                yield this.setPasswordLoginEnabled(codiceUtente, passwordLoginEnabled);
-                return yield this.linkIdentity(codiceUtente, normalizedIdentity, note);
-            }
-            catch (error) {
-                if (error instanceof common_1.BadRequestException || error instanceof common_1.ConflictException || error instanceof common_1.ForbiddenException || error instanceof common_1.NotFoundException || error instanceof common_1.ServiceUnavailableException) {
-                    throw error;
-                }
-                if (Utilities_1.RestUtilities.isDatabaseSchemaError(error)) {
-                    throw new common_1.ServiceUnavailableException({ code: 'ACCESSI_DATABASE_SCHEMA_OUTDATED', message: 'Lo schema del database Accessi non è aggiornato. Eseguire la migrazione database e riprovare.' });
-                }
-                throw new common_1.InternalServerErrorException({ code: 'FEDERATED_USER_PROVISIONING_FAILED', message: 'La creazione dell’utente SSO non è stata completata. Verificare il log del backend e l’eventuale utente creato senza identità SSO.' });
-            }
-        });
-    }
-    /**
-     * Allows self-provisioning only when explicitly enabled. The caller must have
-     * verified the external identity and decide which profile fields are trusted.
-     */
-    registerSelfServiceFederatedUser(registrationData, identity) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            this.assertEnabled();
-            if (((_a = this.options.federatedAuthentication) === null || _a === void 0 ? void 0 : _a.allowSelfRegistration) !== true) {
-                throw new common_1.ForbiddenException({ code: 'FEDERATED_SELF_REGISTRATION_DISABLED', message: 'Auto-registrazione SSO non abilitata.' });
-            }
-            const codiceUtente = yield this.userService.register(registrationData, {
-                allowPrivilegedFields: false,
-                initialState: StatoRegistrazione_1.StatoRegistrazione.CONF,
-            });
-            yield this.setPasswordLoginEnabled(codiceUtente, false);
-            return this.linkIdentity(codiceUtente, identity);
-        });
-    }
-    /** Returns all linked identities for administration; disabled identities are included. */
-    getUserIdentities(codiceUtente) {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.assertEnabled();
-            const rows = yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,
-              I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,
-              I.DATDISATT AS disabled_at, I.NOTA,
-              COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled
-       FROM UTENTI_IDENTITA_EXT I
-       LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE
-       WHERE I.CODUTE = ?
-       ORDER BY I.DATINS DESC`, [codiceUtente]);
-            return rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase).map((row) => this.toIdentity(row));
-        });
-    }
-    /** Returns the complete provider catalog, including inactive providers, for superuser administration. */
-    getProviders() {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.assertEnabled();
-            const rows = yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,
-              DATINS AS created_at, NOTA AS note
-       FROM SSO_PROVIDER
-       ORDER BY FLGATTIVO DESC, DESCRIZIONE, PROVIDER`);
-            return rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase).map((row) => this.toProvider(row));
-        });
-    }
-    /** Registers a provider key that must match the backend's SSO configuration exactly. */
-    createProvider(input) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            this.assertEnabled();
-            const provider = this.normalizeProvider(input.provider);
-            const description = this.normalizeDescription(input.description);
-            const existing = yield this.findProvider(provider);
-            if (existing) {
-                throw new common_1.ConflictException({ code: 'FEDERATED_PROVIDER_ALREADY_EXISTS', message: 'Il provider SSO è già registrato.' });
-            }
-            yield Orm_1.Orm.execute(this.options.databaseOptions, 'INSERT INTO SSO_PROVIDER (PROVIDER, DESCRIZIONE, FLGATTIVO, NOTA) VALUES (?, ?, 1, ?)', [provider, description, ((_a = input.note) === null || _a === void 0 ? void 0 : _a.trim()) || null]);
-            return (yield this.findProvider(provider));
-        });
-    }
-    /** Updates provider metadata or disables the provider without removing its identity history. */
-    /**
-     * Aggiorna metadati amministrativi del catalogo. La chiave provider e immutabile perche parte dell'identita
-     * persistita e deve coincidere esattamente con la configurazione del backend validante.
-     */
-    updateProvider(providerValue, update) {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.assertEnabled();
-            const provider = this.normalizeProvider(providerValue);
-            if (!(yield this.findProvider(provider))) {
-                throw new common_1.NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });
-            }
-            const changes = [];
-            const params = [];
-            if (update.description !== undefined) {
-                changes.push('DESCRIZIONE = ?');
-                params.push(this.normalizeDescription(update.description));
-            }
-            if (update.active !== undefined) {
-                changes.push('FLGATTIVO = ?');
-                params.push(update.active ? 1 : 0);
-            }
-            if (update.note !== undefined) {
-                changes.push('NOTA = ?');
-                params.push(update.note.trim() || null);
-            }
-            if (changes.length > 0) {
-                params.push(provider);
-                yield Orm_1.Orm.execute(this.options.databaseOptions, `UPDATE SSO_PROVIDER SET ${changes.join(', ')} WHERE PROVIDER = ?`, params);
-            }
-            return (yield this.findProvider(provider));
-        });
-    }
-    /**
-     * Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK
-     * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un
-     * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.
-     */
-    deleteProvider(providerValue) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c;
-            this.assertEnabled();
-            const provider = this.normalizeProvider(providerValue);
-            if (!(yield this.findProvider(provider))) {
-                throw new common_1.NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });
-            }
-            const usage = yield Orm_1.Orm.query(this.options.databaseOptions, 'SELECT COUNT(*) AS total FROM UTENTI_IDENTITA_EXT WHERE PROVIDER = ?', [provider]);
-            const rawTotal = (_b = (_a = usage === null || usage === void 0 ? void 0 : usage[0]) === null || _a === void 0 ? void 0 : _a.TOTAL) !== null && _b !== void 0 ? _b : (_c = usage === null || usage === void 0 ? void 0 : usage[0]) === null || _c === void 0 ? void 0 : _c.total;
-            const total = typeof rawTotal === 'number' ? rawTotal : Number.parseInt(`${rawTotal !== null && rawTotal !== void 0 ? rawTotal : '0'}`, 10);
-            if (total > 0) {
-                throw new common_1.ConflictException({
-                    code: 'FEDERATED_PROVIDER_IN_USE',
-                    message: `Impossibile eliminare il provider ${provider}: ${total} identita collegate. Disabilitalo oppure rimuovi prima i collegamenti.`,
-                });
-            }
-            yield Orm_1.Orm.execute(this.options.databaseOptions, 'DELETE FROM SSO_PROVIDER WHERE PROVIDER = ?', [provider]);
-        });
-    }
-    /** Enables or disables all local password authentication for one user. */
-    /**
-     * Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso
-     * email/password, che restituisce `PASSWORD_LOGIN_DISABLED`. L'assenza della riga mantiene il default legacy `true`.
-     */
-    setPasswordLoginEnabled(codiceUtente, enabled) {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.assertEnabled();
-            yield this.assertUserExists(codiceUtente);
-            const previous = yield this.isPasswordLoginEnabled(codiceUtente);
-            // Upsert: per utenti legacy senza riga in UTENTI_CONFIG una UPDATE a vuoto
-            // lasciava la policy al default, rendendo la disattivazione un no-op silenzioso.
-            yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE OR INSERT INTO UTENTI_CONFIG (CODUTE, FLGPASSWORD) VALUES (?, ?) MATCHING (CODUTE)', [codiceUtente, enabled ? 1 : 0]);
-            if (previous !== enabled) {
-                yield (0, sessionRevocation_1.revokeAccessiUserSessionsIfConfigured)(this.options, codiceUtente, 'login_policy_change');
-            }
-        });
-    }
-    /** Returns the effective local password policy. Users without a policy row retain the historic enabled default. */
-    /** Restituisce la policy effettiva; utenti precedenti alla migrazione restano abilitati alla password. */
-    isPasswordLoginEnabled(codiceUtente) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!this.isEnabled())
-                return true;
-            const rows = yield Orm_1.Orm.query(this.options.databaseOptions, 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?', [codiceUtente]);
-            const row = rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
-            return (row === null || row === void 0 ? void 0 : row.passwordLoginEnabled) !== false && (row === null || row === void 0 ? void 0 : row.passwordLoginEnabled) !== 0 && (row === null || row === void 0 ? void 0 : row.passwordLoginEnabled) !== '0';
-        });
-    }
-    /** Soft-disables a linked identity without deleting operational history. */
-    /** Disabilita logicamente un collegamento SSO conservando audit e possibilita di successiva riattivazione. */
-    disableIdentity(identityKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.assertEnabled();
-            this.assertIdentityKey(identityKey);
-            yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 0, DATDISATT = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [identityKey]);
-        });
-    }
-    /** Restituisce il CODUTE proprietario di un collegamento SSO, o null se assente. */
-    getIdentityOwner(identityKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.assertIdentityKey(identityKey);
-            const rows = (yield Orm_1.Orm.query(this.options.databaseOptions, 'SELECT CODUTE AS codice_utente FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ?', [identityKey]));
-            const row = rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
-            const owner = Number(row === null || row === void 0 ? void 0 : row.codiceUtente);
-            return Number.isSafeInteger(owner) && owner > 0 ? owner : null;
-        });
-    }
-    /** Permanently removes one identity link from its owning user after administrative confirmation. */
-    /**
-     * Elimina fisicamente un collegamento SSO soltanto dopo aver verificato che appartenga all'utente indicato.
-     * Non elimina mai l'utente Accessi, password, ruoli o grant associati.
-     */
-    deleteIdentity(codiceUtente, identityKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.assertEnabled();
-            this.assertIdentityKey(identityKey);
-            const identity = (yield this.getUserIdentities(codiceUtente)).find((item) => item.identityKey === identityKey);
-            if (!identity) {
-                throw new common_1.NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_FOUND', message: 'Collegamento SSO non trovato per questo utente.' });
-            }
-            yield Orm_1.Orm.execute(this.options.databaseOptions, 'DELETE FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ? AND CODUTE = ?', [identityKey, codiceUtente]);
-        });
-    }
-    /** Aggiorna lo stato o la nota di un collegamento SSO usando la sua chiave tecnica amministrativa. */
-    /** Aggiorna stato o nota amministrativa senza modificare provider e subject, che identificano la persona. */
-    updateIdentity(identityKey, update) {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.assertEnabled();
-            this.assertIdentityKey(identityKey);
-            const changes = [];
-            const params = [];
-            if (update.active !== undefined) {
-                changes.push('FLGATTIVO = ?');
-                params.push(update.active ? 1 : 0);
-                if (update.active)
-                    changes.push('DATDISATT = NULL');
-                else
-                    changes.push('DATDISATT = CURRENT_TIMESTAMP');
-            }
-            if (update.note !== undefined) {
-                changes.push('NOTA = ?');
-                params.push(update.note);
-            }
-            if (changes.length === 0)
-                return;
-            params.push(identityKey);
-            yield Orm_1.Orm.execute(this.options.databaseOptions, `UPDATE UTENTI_IDENTITA_EXT SET ${changes.join(', ')} WHERE IDNKEY = ?`, params);
-        });
-    }
-    /** Explicit administrative schema reconciliation, shared with the standard updater. */
-    ensureSchema() {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (this.isEnabled())
-                yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.run(this.options);
-        });
-    }
-    findIdentity(identity, onlyActive) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const rows = yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,
-              I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,
-              I.DATDISATT AS disabled_at, I.NOTA,
-              COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled
-       FROM UTENTI_IDENTITA_EXT I
-       LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE
-       WHERE I.IDNKEY = ? AND I.PROVIDER = ? AND I.SUBJECT = ?${onlyActive ? ' AND I.FLGATTIVO = 1' : ''}`, [this.getIdentityKey(identity), identity.provider, identity.subject]);
-            const row = rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
-            return row ? this.toIdentity(row) : null;
-        });
-    }
-    assertUserExists(codiceUtente) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const user = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
-            if (!user)
-                throw new common_1.NotFoundException('Utente Accessi non trovato.');
-        });
-    }
-    assertEnabled() {
-        if (!this.isEnabled()) {
-            throw new common_1.ForbiddenException({ code: 'FEDERATED_AUTH_DISABLED', message: 'Autenticazione federata non abilitata in AccessiOptions.' });
-        }
-    }
-    /** Validates the opaque SHA-256 key used only by administrative identity endpoints. */
-    assertIdentityKey(identityKey) {
-        if (!/^[a-f0-9]{64}$/i.test(identityKey)) {
-            throw new common_1.BadRequestException({ code: 'FEDERATED_IDENTITY_KEY_INVALID', message: 'Chiave del collegamento SSO non valida.' });
-        }
-    }
-    normalizeIdentity(identity) {
-        const provider = this.normalizeProvider(identity === null || identity === void 0 ? void 0 : identity.provider);
-        const subject = typeof (identity === null || identity === void 0 ? void 0 : identity.subject) === 'string' ? identity.subject.trim() : '';
-        if (!subject || Buffer.byteLength(subject, 'utf8') > 512) {
-            throw new common_1.BadRequestException({ code: 'FEDERATED_SUBJECT_INVALID', message: 'Subject non valido: è obbligatorio e può occupare al massimo 512 byte UTF-8.' });
-        }
-        return { provider, subject };
-    }
-    normalizeProvider(value) {
-        const provider = typeof value === 'string' ? value.trim().toLowerCase() : '';
-        if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(provider)) {
-            throw new common_1.BadRequestException({ code: 'FEDERATED_PROVIDER_INVALID', message: 'Provider non valido: usare un namespace ASCII stabile di massimo 64 caratteri.' });
-        }
-        return provider;
-    }
-    normalizeDescription(value) {
-        const description = typeof value === 'string' ? value.trim() : '';
-        if (!description || description.length > 160) {
-            throw new common_1.BadRequestException({ code: 'FEDERATED_PROVIDER_DESCRIPTION_INVALID', message: 'La descrizione del provider deve contenere da 1 a 160 caratteri.' });
-        }
-        return description;
-    }
-    assertProviderActive(provider) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const registered = yield this.findProvider(provider);
-            if (!registered) {
-                throw new common_1.NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });
-            }
-            if (!registered.active) {
-                throw new common_1.ForbiddenException({ code: 'FEDERATED_PROVIDER_DISABLED', message: 'Provider SSO disabilitato.' });
-            }
-            return registered;
-        });
-    }
-    findProvider(provider) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const rows = yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,
-              DATINS AS created_at, NOTA AS note
-       FROM SSO_PROVIDER
-       WHERE PROVIDER = ?`, [provider]);
-            const row = rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
-            return row ? this.toProvider(row) : null;
-        });
-    }
-    getIdentityKey(identity) {
-        const provider = Buffer.from(identity.provider, 'utf8');
-        const subject = Buffer.from(identity.subject, 'utf8');
-        const payload = Buffer.concat([Buffer.from('accessi:federated:v1:'), Buffer.from(`${provider.length}:`), provider, Buffer.from(`${subject.length}:`), subject]);
-        return (0, crypto_1.createHash)('sha256').update(payload).digest('hex');
-    }
-    toIdentity(row) {
-        return {
-            identityKey: String(row.identityKey),
-            codiceUtente: Number(row.codiceUtente),
-            provider: String(row.provider).trim(),
-            subject: String(row.subject),
-            active: row.active === true || row.active === 1 || row.active === '1',
-            passwordLoginEnabled: !(row.passwordLoginEnabled === false || row.passwordLoginEnabled === 0 || row.passwordLoginEnabled === '0'),
-            createdAt: row.createdAt,
-            lastLoginAt: row.lastLoginAt,
-            disabledAt: row.disabledAt,
-            note: row.note,
-        };
-    }
-    toProvider(row) {
-        var _a;
-        return {
-            provider: String(row.provider).trim(),
-            description: String((_a = row.description) !== null && _a !== void 0 ? _a : '').trim(),
-            active: row.active === true || row.active === 1 || row.active === '1',
-            createdAt: row.createdAt,
-            note: row.note,
-        };
-    }
-};
-exports.FederatedAuthService = FederatedAuthService;
-exports.FederatedAuthService = FederatedAuthService = __decorate([
-    (0, common_1.Injectable)(),
-    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
-    __metadata("design:paramtypes", [Object, UserService_1.UserService,
-        AuthService_1.AuthService])
-], FederatedAuthService);
-//# sourceMappingURL=FederatedAuthService.js.map