emilsoftware-utilities 2.0.0-dev.84 → 2.0.0-dev.85

package/dist/accessi-module/middleware/authenticateGen.js

@@ -1,315 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticateGen = exports.AuthenticateGenService = void 0;
-exports.beginAccessiAuthInitialization = beginAccessiAuthInitialization;
-exports.setAccessiAuthService = setAccessiAuthService;
-exports.failAccessiAuthInitialization = failAccessiAuthInitialization;
-exports.authorizeAccessi = authorizeAccessi;
-const common_1 = require("@nestjs/common");
-const PermissionService_1 = require("../Services/PermissionService/PermissionService");
-const UserService_1 = require("../Services/UserService/UserService");
-const Logger_1 = require("../../Logger");
-const accessiRequirements_1 = require("./accessiRequirements");
-const authenticatedToken_1 = require("../security/authenticatedToken");
-const jwtTokenOptions_1 = require("../security/jwtTokenOptions");
-const sessionRevocation_1 = require("../security/sessionRevocation");
-const logger = new Logger_1.Logger("AuthenticateGen");
-const ACCESSI_AUTH_SERVICE_LOCALS_KEY = "accessiAuthService";
-const ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for("emilsoftware.accessiAuthService");
-const ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;
-class AuthMiddlewareError extends Error {
-    constructor(status, code, message, details) {
-        super(message);
-        this.status = status;
-        this.code = code;
-        this.details = details;
-        this.name = "AuthMiddlewareError";
-    }
-}
-function authError(status, code, message, details) {
-    return new AuthMiddlewareError(status, code, message, details);
-}
-function normalizeAuthError(error) {
-    if (error instanceof AuthMiddlewareError)
-        return error;
-    if (error instanceof accessiRequirements_1.RequirementEvaluationError) {
-        return authError(500, error.code, error.message);
-    }
-    if (error instanceof Error) {
-        return authError(500, "AUTH_INTERNAL_ERROR", error.message, {
-            originalError: error.name,
-        });
-    }
-    return authError(500, "AUTH_INTERNAL_ERROR", "Unexpected authentication error");
-}
-function logAuthFailure(req, authErr) {
-    var _a;
-    const payload = {
-        code: authErr.code,
-        status: authErr.status,
-        message: authErr.message,
-        details: authErr.details,
-        method: req.method,
-        path: (_a = req.originalUrl) !== null && _a !== void 0 ? _a : req.url,
-        ip: req.ip,
-    };
-    const message = `${authErr.status >= 500 ? "Authentication failure" : "Authentication denied"} ${JSON.stringify(payload)}`;
-    if (authErr.status >= 500)
-        logger.error(message);
-    else
-        logger.warning(message);
-}
-/** Sends the documented Accessi error contract from Express middleware. */
-function sendAuthenticationError(res, authErr) {
-    const message = authErr.status === 403
-        ? 'Operazione non autorizzata.'
-        : authErr.status >= 500
-            ? 'Errore interno del modulo Accessi.'
-            : 'Autenticazione non valida o scaduta.';
-    return res.status(authErr.status).json({
-        severity: 'error',
-        status: authErr.status,
-        statusCode: 2,
-        code: authErr.code,
-        // Kept for callers of older versions which already inspected `error`.
-        error: authErr.code,
-        message,
-    });
-}
-function authorizeWithDependencies(req, res, next, options, accessiOptions, permissionService, userService) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const authenticatedRequest = req;
-        try {
-            const authHeader = req.headers.authorization;
-            if (!authHeader) {
-                throw authError(401, "AUTH_HEADER_MISSING", "Authorization header not found");
-            }
-            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(authHeader);
-            if (!token) {
-                throw authError(401, "AUTH_TOKEN_MISSING", "Token not found in Authorization header");
-            }
-            let verification;
-            try {
-                verification = (0, jwtTokenOptions_1.getAccessiAccessTokenVerificationConfig)(accessiOptions);
-            }
-            catch (_a) {
-                throw authError(500, "AUTH_JWT_SECRET_MISSING", "JWT signing key not configured");
-            }
-            let decoded;
-            try {
-                decoded = (0, jwtTokenOptions_1.verifyAccessiJwt)(token, verification);
-            }
-            catch (_b) {
-                throw authError(401, "AUTH_TOKEN_INVALID", "Invalid JWT token");
-            }
-            const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(decoded);
-            if (!codiceUtente) {
-                throw authError(401, "AUTH_USER_CODE_MISSING", "codiceUtente not found in token payload");
-            }
-            if (yield (0, sessionRevocation_1.isAccessiTokenRevoked)(accessiOptions, decoded, codiceUtente)) {
-                throw authError(401, "AUTH_TOKEN_REVOKED", "Session revoked");
-            }
-            const currentUser = yield userService.getAuthenticatedUserSnapshot(codiceUtente);
-            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(decoded, currentUser)) {
-                throw authError(401, "AUTH_USER_DISABLED", "User is no longer authorized");
-            }
-            const authenticatedPayload = (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(decoded, currentUser);
-            const requirementTree = (0, accessiRequirements_1.buildRequirementTree)(options);
-            if (requirementTree) {
-                if (!(accessiOptions === null || accessiOptions === void 0 ? void 0 : accessiOptions.databaseOptions)) {
-                    throw authError(500, "AUTH_DATABASE_OPTIONS_MISSING", "Database options not configured");
-                }
-                let grantsResultCache = null;
-                const getGrantsResult = () => __awaiter(this, void 0, void 0, function* () {
-                    if (!grantsResultCache) {
-                        grantsResultCache = yield permissionService.getUserRolesAndGrants(codiceUtente);
-                    }
-                    return grantsResultCache;
-                });
-                const requirementContext = {
-                    req,
-                    decodedToken: authenticatedPayload,
-                    userCode: codiceUtente,
-                    getGrantsResult,
-                };
-                const hasPermissions = yield (0, accessiRequirements_1.evaluateRequirement)(requirementTree, requirementContext, options);
-                if (!hasPermissions) {
-                    throw authError(403, "AUTH_INSUFFICIENT_PERMISSIONS", "User does not have required permissions");
-                }
-                authenticatedRequest.userGrants = yield getGrantsResult();
-            }
-            authenticatedRequest.user = authenticatedPayload;
-            authenticatedRequest.data = authenticatedPayload;
-            return next();
-        }
-        catch (error) {
-            const authErr = normalizeAuthError(error);
-            logAuthFailure(req, authErr);
-            return sendAuthenticationError(res, authErr);
-        }
-    });
-}
-let AuthenticateGenService = class AuthenticateGenService {
-    constructor(accessiOptions, permissionService, userService) {
-        this.accessiOptions = accessiOptions;
-        this.permissionService = permissionService;
-        this.userService = userService;
-    }
-    /**
-     * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.
-     * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.
-     */
-    authorize(req, res, next, options) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return authorizeWithDependencies(req, res, next, options, this.accessiOptions, this.permissionService, this.userService);
-        });
-    }
-};
-exports.AuthenticateGenService = AuthenticateGenService;
-exports.AuthenticateGenService = AuthenticateGenService = __decorate([
-    (0, common_1.Injectable)()
-    /** Nest service behind the Express-compatible `authorizeAccessi` middleware. */
-    ,
-    __param(0, (0, common_1.Inject)("ACCESSI_OPTIONS")),
-    __metadata("design:paramtypes", [Object, PermissionService_1.PermissionService,
-        UserService_1.UserService])
-], AuthenticateGenService);
-let authenticateGenServiceRef = null;
-let authServiceBootstrapDeferred = null;
-function createDeferred() {
-    let resolve;
-    let reject;
-    const promise = new Promise((res, rej) => {
-        resolve = res;
-        reject = rej;
-    });
-    return { promise, resolve, reject };
-}
-function isAuthenticateGenService(value) {
-    return Boolean(value &&
-        typeof value.authorize === "function");
-}
-/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */
-function beginAccessiAuthInitialization() {
-    if (!authServiceBootstrapDeferred) {
-        authServiceBootstrapDeferred = createDeferred();
-    }
-}
-/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */
-function setAccessiAuthService(service) {
-    authenticateGenServiceRef = service;
-    globalThis[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;
-    if (authServiceBootstrapDeferred) {
-        authServiceBootstrapDeferred.resolve(service);
-        authServiceBootstrapDeferred = null;
-    }
-}
-/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */
-function failAccessiAuthInitialization(error) {
-    if (authServiceBootstrapDeferred) {
-        authServiceBootstrapDeferred.reject(error);
-        authServiceBootstrapDeferred = null;
-    }
-}
-function getAccessiAuthServiceFromRequest(req) {
-    var _a, _b;
-    const appLocalsService = (_b = (_a = req.app) === null || _a === void 0 ? void 0 : _a.locals) === null || _b === void 0 ? void 0 : _b[ACCESSI_AUTH_SERVICE_LOCALS_KEY];
-    if (isAuthenticateGenService(appLocalsService)) {
-        return appLocalsService;
-    }
-    const globalService = globalThis[ACCESSI_AUTH_SERVICE_GLOBAL_KEY];
-    if (isAuthenticateGenService(globalService)) {
-        return globalService;
-    }
-    return authenticateGenServiceRef;
-}
-function waitForBootstrappedService() {
-    return __awaiter(this, void 0, void 0, function* () {
-        if (!authServiceBootstrapDeferred) {
-            return null;
-        }
-        const bootstrapPromise = authServiceBootstrapDeferred.promise;
-        const timeoutPromise = new Promise((resolve) => {
-            setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);
-        });
-        try {
-            const resolved = yield Promise.race([bootstrapPromise, timeoutPromise]);
-            return isAuthenticateGenService(resolved) ? resolved : null;
-        }
-        catch (_a) {
-            return null;
-        }
-    });
-}
-function resolveAccessiAuthService(req) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const immediateService = getAccessiAuthServiceFromRequest(req);
-        if (immediateService) {
-            return immediateService;
-        }
-        const bootstrappedService = yield waitForBootstrappedService();
-        if (bootstrappedService) {
-            return bootstrappedService;
-        }
-        return getAccessiAuthServiceFromRequest(req);
-    });
-}
-/**
- * Middleware Express pubblico di Accessi.
- *
- * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente
- * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente
- * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.
- */
-function authorizeAccessi(req, res, next, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const authService = yield resolveAccessiAuthService(req);
-        if (!authService) {
-            const status = authServiceBootstrapDeferred ? 503 : 500;
-            const code = authServiceBootstrapDeferred
-                ? 'ACCESSI_AUTH_INITIALIZING'
-                : 'ACCESSI_AUTH_NOT_INITIALIZED';
-            logger.error(`Authentication service not initialized ${JSON.stringify({
-                method: req.method,
-                path: (_a = req.originalUrl) !== null && _a !== void 0 ? _a : req.url,
-                status,
-            })}`);
-            return res.status(status).json({
-                severity: 'error',
-                status,
-                statusCode: 2,
-                code,
-                error: code,
-                message: status === 503
-                    ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'
-                    : 'Il modulo Accessi non e disponibile.',
-            });
-        }
-        return authService.authorize(req, res, next, options);
-    });
-}
-/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */
-exports.authenticateGen = authorizeAccessi;
-//# sourceMappingURL=authenticateGen.js.map

package/dist/accessi-module/middleware/authenticateGen.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwRA,wEAIC;AAGD,sDAOC;AAGD,sEAKC;AA4DD,4CAiCC;AA1YD,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAMwC;AACxC,iEAAwG;AACxG,qEAAsE;AAEtE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,GAAa,EAAE,OAA4B;IAC1E,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;YACrB,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,sCAAsC,CAAC;IAE/C,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,sEAAsE;QACtE,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;QAOxB,MAAM,oBAAoB,GAAG,GAA2B,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,IAAI,YAAwE,CAAC;YAC7E,IAAI,CAAC;gBACH,YAAY,GAAG,IAAA,yDAAuC,EAAC,cAAc,CAAC,CAAC;YACzE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,gCAAgC,CAAC,CAAC;YACpF,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAA,kCAAgB,EAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAClD,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAA,yCAAqB,EAAC,cAAc,EAAE,OAAkC,EAAE,YAAY,CAAC,EAAE,CAAC;gBAClG,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,oBAAoB,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5D,CAAC;YAED,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CAAA;AAIM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEL;;;OAGG;IACG,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA5BY,wDAAsB;iCAAtB,sBAAsB;IAFlC,IAAA,mBAAU,GAAE;IACb,gFAAgF;;IAG3E,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CA4BlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED;;;;;;GAMG;AACH,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,IAAI,GAAG,4BAA4B;gBACvC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,8BAA8B,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,CAAC;gBACb,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,sCAAsC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAED,mIAAmI;AACtH,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\nimport { Inject, Injectable } from \"@nestjs/common\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\nimport { UserService } from \"../Services/UserService/UserService\";\nimport { Logger } from \"../../Logger\";\nimport {\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  GrantsResult,\n  RequirementEvaluationError,\n  buildRequirementTree,\n  evaluateRequirement,\n} from \"./accessiRequirements\";\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../security/authenticatedToken\";\nimport { getAccessiAccessTokenVerificationConfig, verifyAccessiJwt } from \"../security/jwtTokenOptions\";\nimport { isAccessiTokenRevoked } from \"../security/sessionRevocation\";\n\nconst logger = new Logger(\"AuthenticateGen\");\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\n\ntype Deferred<T> = {\n  promise: Promise<T>;\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n};\n\nclass AuthMiddlewareError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n    public readonly details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = \"AuthMiddlewareError\";\n  }\n}\n\nfunction authError(\n  status: number,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>\n) {\n  return new AuthMiddlewareError(status, code, message, details);\n}\n\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\n  if (error instanceof AuthMiddlewareError) return error;\n  if (error instanceof RequirementEvaluationError) {\n    return authError(500, error.code, error.message);\n  }\n  if (error instanceof Error) {\n    return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\n      originalError: error.name,\n    });\n  }\n  return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\n}\n\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\n  const payload = {\n    code: authErr.code,\n    status: authErr.status,\n    message: authErr.message,\n    details: authErr.details,\n    method: req.method,\n    path: req.originalUrl ?? req.url,\n    ip: req.ip,\n  };\n\n  const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\n  if (authErr.status >= 500) logger.error(message);\n  else logger.warning(message);\n}\n\n/** Sends the documented Accessi error contract from Express middleware. */\nfunction sendAuthenticationError(res: Response, authErr: AuthMiddlewareError): Response {\n  const message =\n    authErr.status === 403\n      ? 'Operazione non autorizzata.'\n      : authErr.status >= 500\n        ? 'Errore interno del modulo Accessi.'\n        : 'Autenticazione non valida o scaduta.';\n\n  return res.status(authErr.status).json({\n    severity: 'error',\n    status: authErr.status,\n    statusCode: 2,\n    code: authErr.code,\n    // Kept for callers of older versions which already inspected `error`.\n    error: authErr.code,\n    message,\n  });\n}\n\nasync function authorizeWithDependencies(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options: AccessiAuthorizationOptions | undefined,\n  accessiOptions: AccessiOptions,\n  permissionService: PermissionService,\n  userService: UserService\n) {\n  type AuthenticatedRequest = Request & {\n    userGrants?: unknown;\n    user?: unknown;\n    data?: unknown;\n  };\n  const authenticatedRequest = req as AuthenticatedRequest;\n\n  try {\n    const authHeader = req.headers.authorization;\n    if (!authHeader) {\n      throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\n    }\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) {\n      throw authError(\n        401,\n        \"AUTH_TOKEN_MISSING\",\n        \"Token not found in Authorization header\"\n      );\n    }\n\n    let verification: ReturnType<typeof getAccessiAccessTokenVerificationConfig>;\n    try {\n      verification = getAccessiAccessTokenVerificationConfig(accessiOptions);\n    } catch {\n      throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT signing key not configured\");\n    }\n\n    let decoded: unknown;\n    try {\n      decoded = verifyAccessiJwt(token, verification);\n    } catch {\n      throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n    if (!codiceUtente) {\n      throw authError(\n        401,\n        \"AUTH_USER_CODE_MISSING\",\n        \"codiceUtente not found in token payload\"\n      );\n    }\n    if (await isAccessiTokenRevoked(accessiOptions, decoded as Record<string, unknown>, codiceUtente)) {\n      throw authError(401, \"AUTH_TOKEN_REVOKED\", \"Session revoked\");\n    }\n\n    const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw authError(\n        401,\n        \"AUTH_USER_DISABLED\",\n        \"User is no longer authorized\"\n      );\n    }\n\n    const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\n\n    const requirementTree = buildRequirementTree(options);\n    if (requirementTree) {\n      if (!accessiOptions?.databaseOptions) {\n        throw authError(\n          500,\n          \"AUTH_DATABASE_OPTIONS_MISSING\",\n          \"Database options not configured\"\n        );\n      }\n\n      let grantsResultCache: GrantsResult | null = null;\n      const getGrantsResult = async () => {\n        if (!grantsResultCache) {\n          grantsResultCache = await permissionService.getUserRolesAndGrants(\n            codiceUtente\n          );\n        }\n        return grantsResultCache;\n      };\n\n      const requirementContext: AccessiCustomRequirementContext = {\n        req,\n        decodedToken: authenticatedPayload,\n        userCode: codiceUtente,\n        getGrantsResult,\n      };\n\n      const hasPermissions = await evaluateRequirement(\n        requirementTree,\n        requirementContext,\n        options\n      );\n\n      if (!hasPermissions) {\n        throw authError(\n          403,\n          \"AUTH_INSUFFICIENT_PERMISSIONS\",\n          \"User does not have required permissions\"\n        );\n      }\n\n      authenticatedRequest.userGrants = await getGrantsResult();\n    }\n\n    authenticatedRequest.user = authenticatedPayload;\n    authenticatedRequest.data = authenticatedPayload;\n    return next();\n  } catch (error: unknown) {\n    const authErr = normalizeAuthError(error);\n    logAuthFailure(req, authErr);\n    return sendAuthenticationError(res, authErr);\n  }\n}\n\n@Injectable()\n/** Nest service behind the Express-compatible `authorizeAccessi` middleware. */\nexport class AuthenticateGenService {\n  constructor(\n    @Inject(\"ACCESSI_OPTIONS\")\n    private readonly accessiOptions: AccessiOptions,\n    private readonly permissionService: PermissionService,\n    private readonly userService: UserService\n  ) { }\n\n  /**\n   * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.\n   * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.\n   */\n  async authorize(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    options?: AccessiAuthorizationOptions\n  ) {\n    return authorizeWithDependencies(\n      req,\n      res,\n      next,\n      options,\n      this.accessiOptions,\n      this.permissionService,\n      this.userService\n    );\n  }\n}\n\nlet authenticateGenServiceRef: AuthenticateGenService | null = null;\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> | null = null;\n\nfunction createDeferred<T>(): Deferred<T> {\n  let resolve!: (value: T) => void;\n  let reject!: (reason?: unknown) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej;\n  });\n  return { promise, resolve, reject };\n}\n\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\n  return Boolean(\n    value &&\n    typeof (value as { authorize?: unknown }).authorize === \"function\"\n  );\n}\n\n/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */\nexport function beginAccessiAuthInitialization() {\n  if (!authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\n  }\n}\n\n/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */\nexport function setAccessiAuthService(service: AuthenticateGenService) {\n  authenticateGenServiceRef = service;\n  (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.resolve(service);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\n/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */\nexport function failAccessiAuthInitialization(error: unknown) {\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.reject(error);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService | null {\n  const appLocalsService = (req.app?.locals as Record<string, unknown> | undefined)?.[\n    ACCESSI_AUTH_SERVICE_LOCALS_KEY\n  ];\n\n  if (isAuthenticateGenService(appLocalsService)) {\n    return appLocalsService as AuthenticateGenService;\n  }\n\n  const globalService = (globalThis as Record<symbol, unknown>)[\n    ACCESSI_AUTH_SERVICE_GLOBAL_KEY\n  ];\n  if (isAuthenticateGenService(globalService)) {\n    return globalService as AuthenticateGenService;\n  }\n\n  return authenticateGenServiceRef;\n}\n\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService | null> {\n  if (!authServiceBootstrapDeferred) {\n    return null;\n  }\n\n  const bootstrapPromise = authServiceBootstrapDeferred.promise;\n  const timeoutPromise = new Promise<null>((resolve) => {\n    setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\n  });\n\n  try {\n    const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\n    return isAuthenticateGenService(resolved) ? resolved : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService | null> {\n  const immediateService = getAccessiAuthServiceFromRequest(req);\n  if (immediateService) {\n    return immediateService;\n  }\n\n  const bootstrappedService = await waitForBootstrappedService();\n  if (bootstrappedService) {\n    return bootstrappedService;\n  }\n\n  return getAccessiAuthServiceFromRequest(req);\n}\n\n/**\n * Middleware Express pubblico di Accessi.\n *\n * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente\n * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente\n * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.\n */\nexport async function authorizeAccessi(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options?: AccessiAuthorizationOptions\n) {\n  const authService = await resolveAccessiAuthService(req);\n\n  if (!authService) {\n    const status = authServiceBootstrapDeferred ? 503 : 500;\n    const code = authServiceBootstrapDeferred\n      ? 'ACCESSI_AUTH_INITIALIZING'\n      : 'ACCESSI_AUTH_NOT_INITIALIZED';\n    logger.error(\n      `Authentication service not initialized ${JSON.stringify({\n        method: req.method,\n        path: req.originalUrl ?? req.url,\n        status,\n      })}`\n    );\n    return res.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: 2,\n      code,\n      error: code,\n      message: status === 503\n        ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'\n        : 'Il modulo Accessi non e disponibile.',\n    });\n  }\n\n  return authService.authorize(req, res, next, options);\n}\n\n/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */\nexport const authenticateGen = authorizeAccessi;\n"]}

package/dist/accessi-module/observability/metrics.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../../src/accessi-module/observability/metrics.ts"],"names":[],"mappings":";;AAiGA,oEAkHC;AAKD,8DAEC;AAGD,sDAGC;AASD,kDAMC;AAGD,sDAMC;AAGD,oDAEC;AAGD,kDAEC;AAGD,8CAIC;AAGD,gDAUC;AAGD,oDAWC;AAnSD,4DAA8D;AAiD9D,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAK,EAAE,IAAK,EAAE,IAAK,EAAE,KAAM,CAAC,CAAC;AACzF,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAE9C,SAAS,cAAc,CAAC,KAA8B;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,MAAuC;IAC9D,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,MAA8B;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SACvB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,YAAY,CAAC,MAA8B,EAAE,KAAwB;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5F,IAAI,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5F,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,4BAA4B;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2E,CAAC;IACpG,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2E,CAAC;IAClG,MAAM,UAAU,GAAG,IAAI,GAAG,EAMtB,CAAC;IAEL,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,MAA8B,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAE7G,OAAO;QACL,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM;YAC/B,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,OAAO;gBAAE,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;;gBAC/B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM;YACvB,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,EAAE;gBACrD,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,gBAAgB;gBACxB,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM;YAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO;YACrD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;YACvD,IAAI,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG;oBACN,IAAI,EAAE,cAAc;oBACpB,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBACzC,GAAG,EAAE,CAAC;oBACN,KAAK,EAAE,CAAC;iBACT,CAAC;gBACF,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC;YACD,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC;YACrB,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YACjB,MAAM,SAAS,GAAG,KAAK,CAAC;YACxB,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;;gBAC7C,IAAI,OAAO,IAAI,MAAM;oBAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAA,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACtF,CAAC,CAAC,CAAC;QACL,CAAC;QACD,gBAAgB;YACd,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,CAA6B,OAAY,EAAwB,EAAE;gBACjF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAe,CAAC;gBACtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACtC,IAAI,MAAM;wBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;wBAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvC,CAAC;gBACD,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YACpF,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,CAA6D,OAAY,EAAE,EAAE,CAC1F,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAElG,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC9D,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC;gBACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC;gBACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,CAAC;gBACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpC,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;wBAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC3G,CAAC,CAAC,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;oBACzF,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBACpE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,CAAC;QACD,QAAQ;YACN,OAAO;gBACL,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAM,KAAK,KAAE,MAAM,oBAAO,KAAK,CAAC,MAAM,KAAK,CAAC;gBAC5F,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iCAAM,KAAK,KAAE,MAAM,oBAAO,KAAK,CAAC,MAAM,KAAK,CAAC;gBACxF,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACnD,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,oBAAO,KAAK,CAAC,MAAM,CAAE;oBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,WAAC,OAAA,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAA,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAI,CAAC,EAAE,CAAC,CAAA,EAAA,CAAC;iBAC5F,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;QACD,KAAK;YACH,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,4BAA4B,EAAE,CAAC;AAEvD,mEAAmE;AACnE,SAAgB,yBAAyB;IACvC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,+DAA+D;AAC/D,SAAgB,qBAAqB,CAAC,OAAmC;;IACvE,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,0CAAE,IAAI,mCAAI,eAAe,CAAC;AACnD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA4B;IACrD,MAAM,MAAM,GAAG,IAAA,kCAAkB,GAAE,CAAC;IACpC,IAAI,CAAC,MAAM,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,MAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC3D,uBAAS,MAAM,IAAK,MAAM,EAAG;AAC/B,CAAC;AAED,yFAAyF;AACzF,SAAgB,mBAAmB,CACjC,IAAY,EACZ,KAAK,GAAG,CAAC,EACT,MAA4B;IAE5B,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,gEAAgE;AAChE,SAAgB,qBAAqB,CACnC,IAAY,EACZ,OAAe,EACf,MAA4B;IAE5B,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8CAA8C;AAC9C,SAAgB,oBAAoB;IAClC,OAAO,eAAe,CAAC,gBAAgB,EAAE,CAAC;AAC5C,CAAC;AAED,2DAA2D;AAC3D,SAAgB,mBAAmB;IACjC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,6EAA6E;AAC7E,SAAgB,iBAAiB,CAAC,OAAmC,EAAE,IAAY;;IACjF,MAAM,MAAM,GAAG,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,0CAAE,MAAM,mCAAI,SAAS,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACpE,CAAC;AAED,gFAAgF;AAChF,SAAgB,kBAAkB,CAChC,OAAmC,EACnC,IAAY,EACZ,MAA4B,EAC5B,KAAK,GAAG,CAAC;;IAET,MAAM,UAAU,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ;QAClC,CAAC,CAAC,iBAAiB,iBAAG,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAK,MAAM,EAAG;QAC5D,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAA,qBAAqB,CAAC,OAAO,CAAC,0CAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AACjG,CAAC;AAED,sDAAsD;AACtD,SAAgB,oBAAoB,CAClC,OAAmC,EACnC,IAAY,EACZ,OAAe,EACf,MAA4B;;IAE5B,MAAM,UAAU,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ;QAClC,CAAC,CAAC,iBAAiB,iBAAG,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAK,MAAM,EAAG;QAC5D,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,qDAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\nimport { getAccessiTenantId } from '../tenancy/tenantContext';\n\n/** Valore ammesso per un label Prometheus. */\nexport type AccessiMetricLabelValue = string | number | boolean | undefined;\nexport type AccessiMetricLabels = Record<string, AccessiMetricLabelValue>;\n\n/**\n * Destinazione delle metriche Accessi.\n *\n * L'implementazione predefinita e il registry in memoria renderizzato in\n * formato Prometheus. Un host puo passare un sink custom (OpenTelemetry,\n * StatsD, ...) tramite `metrics.sink`.\n */\nexport interface AccessiMetricsSink {\n  increment(name: string, value?: number, labels?: AccessiMetricLabels): void;\n  gauge?(name: string, value: number, labels?: AccessiMetricLabels): void;\n  observe?(name: string, valueMs: number, labels?: AccessiMetricLabels): void;\n}\n\n/** Opzioni di osservabilita di Accessi. */\nexport interface AccessiMetricsOptions {\n  /** `false` disabilita le metriche di dominio. Default: abilitate. */\n  enabled?: boolean;\n  /** Sink custom. Default: registry in memoria. */\n  sink?: AccessiMetricsSink;\n  /** Prefisso dei nomi. Default `accessi`. */\n  prefix?: string;\n}\n\nexport interface AccessiMetricsRegistry extends AccessiMetricsSink {\n  observe(name: string, valueMs: number, labels?: AccessiMetricLabels): void;\n  gauge(name: string, value: number, labels?: AccessiMetricLabels): void;\n  renderPrometheus(): string;\n  snapshot(): AccessiMetricsSnapshot;\n  reset(): void;\n}\n\nexport interface AccessiMetricsSnapshot {\n  counters: Array<{ name: string; labels: Record<string, string>; value: number }>;\n  gauges: Array<{ name: string; labels: Record<string, string>; value: number }>;\n  histograms: Array<{\n    name: string;\n    labels: Record<string, string>;\n    count: number;\n    sum: number;\n    buckets: Array<{ le: number; count: number }>;\n  }>;\n}\n\nconst HISTOGRAM_BUCKETS_MS = [5, 10, 25, 50, 100, 250, 500, 1_000, 2_500, 5_000, 10_000];\nconst METRIC_NAME = /^[a-zA-Z_:][a-zA-Z0-9_:]*$/;\nconst LABEL_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;\n\nfunction normalizeValue(value: AccessiMetricLabelValue): string | undefined {\n  if (value === undefined) return undefined;\n  if (typeof value === 'boolean') return value ? 'true' : 'false';\n  return String(value);\n}\n\nfunction normalizeLabels(labels: AccessiMetricLabels | undefined): Record<string, string> {\n  const normalized: Record<string, string> = {};\n  for (const [name, value] of Object.entries(labels ?? {})) {\n    const text = normalizeValue(value);\n    if (text !== undefined && LABEL_NAME.test(name)) normalized[name] = text;\n  }\n  return normalized;\n}\n\nfunction labelKey(labels: Record<string, string>): string {\n  return Object.keys(labels)\n    .sort()\n    .map((name) => `${name}=${labels[name]}`)\n    .join(',');\n}\n\nfunction escapeLabel(value: string): string {\n  return value.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"').replace(/\\n/g, '\\\\n');\n}\n\nfunction renderLabels(labels: Record<string, string>, extra?: [string, string]): string {\n  const entries = Object.entries(labels).sort(([left], [right]) => left.localeCompare(right));\n  if (extra) entries.push(extra);\n  if (entries.length === 0) return '';\n  return `{${entries.map(([name, value]) => `${name}=\"${escapeLabel(value)}\"`).join(',')}}`;\n}\n\nfunction metricName(name: string): string {\n  return METRIC_NAME.test(name) ? name : name.replace(/[^a-zA-Z0-9_:]/g, '_');\n}\n\n/**\n * Registry in memoria con rendering Prometheus.\n *\n * Non usa dipendenze: la stessa struttura e usata dal servizio standalone e\n * dai test. `reset()` serve per isolare i test.\n */\nexport function createAccessiMetricsRegistry(): AccessiMetricsRegistry {\n  const counters = new Map<string, { name: string; labels: Record<string, string>; value: number }>();\n  const gauges = new Map<string, { name: string; labels: Record<string, string>; value: number }>();\n  const histograms = new Map<string, {\n    name: string;\n    labels: Record<string, string>;\n    counts: number[];\n    sum: number;\n    count: number;\n  }>();\n\n  const entryKey = (name: string, labels: Record<string, string>) => `${metricName(name)}|${labelKey(labels)}`;\n\n  return {\n    increment(name, value = 1, labels) {\n      const normalizedName = metricName(name);\n      const normalizedLabels = normalizeLabels(labels);\n      const key = entryKey(normalizedName, normalizedLabels);\n      const current = counters.get(key);\n      if (current) current.value += value;\n      else counters.set(key, { name: normalizedName, labels: normalizedLabels, value });\n    },\n    gauge(name, value, labels) {\n      const normalizedName = metricName(name);\n      const normalizedLabels = normalizeLabels(labels);\n      gauges.set(entryKey(normalizedName, normalizedLabels), {\n        name: normalizedName,\n        labels: normalizedLabels,\n        value,\n      });\n    },\n    observe(name, valueMs, labels) {\n      if (!Number.isFinite(valueMs) || valueMs < 0) return;\n      const normalizedName = metricName(name);\n      const normalizedLabels = normalizeLabels(labels);\n      const key = entryKey(normalizedName, normalizedLabels);\n      let entry = histograms.get(key);\n      if (!entry) {\n        entry = {\n          name: normalizedName,\n          labels: normalizedLabels,\n          counts: HISTOGRAM_BUCKETS_MS.map(() => 0),\n          sum: 0,\n          count: 0,\n        };\n        histograms.set(key, entry);\n      }\n      entry.sum += valueMs;\n      entry.count += 1;\n      const histogram = entry;\n      HISTOGRAM_BUCKETS_MS.forEach((bucket, index) => {\n        if (valueMs <= bucket) histogram.counts[index] = (histogram.counts[index] ?? 0) + 1;\n      });\n    },\n    renderPrometheus() {\n      const lines: string[] = [];\n      const grouped = <T extends { name: string }>(entries: T[]): Array<[string, T[]]> => {\n        const byName = new Map<string, T[]>();\n        for (const entry of entries) {\n          const bucket = byName.get(entry.name);\n          if (bucket) bucket.push(entry);\n          else byName.set(entry.name, [entry]);\n        }\n        return [...byName.entries()].sort(([left], [right]) => left.localeCompare(right));\n      };\n      const sorted = <T extends { name: string; labels: Record<string, string> }>(entries: T[]) =>\n        [...entries].sort((left, right) => labelKey(left.labels).localeCompare(labelKey(right.labels)));\n\n      for (const [name, entries] of grouped([...counters.values()])) {\n        lines.push(`# HELP ${name} Accessi metric.`);\n        lines.push(`# TYPE ${name} counter`);\n        for (const entry of sorted(entries)) lines.push(`${name}${renderLabels(entry.labels)} ${entry.value}`);\n      }\n\n      for (const [name, entries] of grouped([...gauges.values()])) {\n        lines.push(`# HELP ${name} Accessi metric.`);\n        lines.push(`# TYPE ${name} gauge`);\n        for (const entry of sorted(entries)) lines.push(`${name}${renderLabels(entry.labels)} ${entry.value}`);\n      }\n\n      for (const [name, entries] of grouped([...histograms.values()])) {\n        lines.push(`# HELP ${name} Accessi metric.`);\n        lines.push(`# TYPE ${name} histogram`);\n        for (const entry of sorted(entries)) {\n          HISTOGRAM_BUCKETS_MS.forEach((bucket, index) => {\n            lines.push(`${name}_bucket${renderLabels(entry.labels, ['le', String(bucket)])} ${entry.counts[index]}`);\n          });\n          lines.push(`${name}_bucket${renderLabels(entry.labels, ['le', '+Inf'])} ${entry.count}`);\n          lines.push(`${name}_sum${renderLabels(entry.labels)} ${entry.sum}`);\n          lines.push(`${name}_count${renderLabels(entry.labels)} ${entry.count}`);\n        }\n      }\n\n      return lines.length > 0 ? `${lines.join('\\n')}\\n` : '';\n    },\n    snapshot() {\n      return {\n        counters: [...counters.values()].map((entry) => ({ ...entry, labels: { ...entry.labels } })),\n        gauges: [...gauges.values()].map((entry) => ({ ...entry, labels: { ...entry.labels } })),\n        histograms: [...histograms.values()].map((entry) => ({\n          name: entry.name,\n          labels: { ...entry.labels },\n          count: entry.count,\n          sum: entry.sum,\n          buckets: HISTOGRAM_BUCKETS_MS.map((le, index) => ({ le, count: entry.counts[index] ?? 0 })),\n        })),\n      };\n    },\n    reset() {\n      counters.clear();\n      gauges.clear();\n      histograms.clear();\n    },\n  };\n}\n\nconst defaultRegistry = createAccessiMetricsRegistry();\n\n/** Registry globale usato da Accessi e dal servizio standalone. */\nexport function getAccessiMetricsRegistry(): AccessiMetricsRegistry {\n  return defaultRegistry;\n}\n\n/** Sink configurato per l'istanza, oppure registry globale. */\nexport function getAccessiMetricsSink(options: AccessiOptions | undefined): AccessiMetricsSink | undefined {\n  if (options?.metrics?.enabled === false) return undefined;\n  return options?.metrics?.sink ?? defaultRegistry;\n}\n\nfunction withTenantContext(labels?: AccessiMetricLabels): AccessiMetricLabels | undefined {\n  const tenant = getAccessiTenantId();\n  if (!tenant || labels?.tenant !== undefined) return labels;\n  return { tenant, ...labels };\n}\n\n/** Registra una metrica sul registry globale (usato da store e moduli senza options). */\nexport function recordAccessiMetric(\n  name: string,\n  value = 1,\n  labels?: AccessiMetricLabels,\n): void {\n  defaultRegistry.increment(name, value, withTenantContext(labels));\n}\n\n/** Registra una durata in millisecondi sul registry globale. */\nexport function recordAccessiDuration(\n  name: string,\n  valueMs: number,\n  labels?: AccessiMetricLabels,\n): void {\n  defaultRegistry.observe(name, valueMs, withTenantContext(labels));\n}\n\n/** Render Prometheus del registry globale. */\nexport function renderAccessiMetrics(): string {\n  return defaultRegistry.renderPrometheus();\n}\n\n/** Azzera il registry globale (test e reset espliciti). */\nexport function resetAccessiMetrics(): void {\n  defaultRegistry.reset();\n}\n\n/** Prefisso configurato, con normalizzazione per evitare nomi non validi. */\nexport function accessiMetricName(options: AccessiOptions | undefined, name: string): string {\n  const prefix = options?.metrics?.prefix ?? 'accessi';\n  if (!prefix.trim()) return name;\n  return `${prefix.trim().replace(/[^a-zA-Z0-9_:]/g, '_')}_${name}`;\n}\n\n/** Incrementa un contatore di dominio sull'istanza (o sul registry globale). */\nexport function countAccessiMetric(\n  options: AccessiOptions | undefined,\n  name: string,\n  labels?: AccessiMetricLabels,\n  value = 1,\n): void {\n  const withTenant = options?.tenantId\n    ? withTenantContext({ tenant: options.tenantId, ...labels })\n    : withTenantContext(labels);\n  getAccessiMetricsSink(options)?.increment(accessiMetricName(options, name), value, withTenant);\n}\n\n/** Registra una durata di dominio in millisecondi. */\nexport function observeAccessiMetric(\n  options: AccessiOptions | undefined,\n  name: string,\n  valueMs: number,\n  labels?: AccessiMetricLabels,\n): void {\n  const withTenant = options?.tenantId\n    ? withTenantContext({ tenant: options.tenantId, ...labels })\n    : withTenantContext(labels);\n  const sink = getAccessiMetricsSink(options);\n  sink?.observe?.(accessiMetricName(options, name), valueMs, withTenant);\n}\n"]}

package/dist/accessi-module/observability/redisMetrics.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redisMetrics.js","sourceRoot":"","sources":["../../../src/accessi-module/observability/redisMetrics.ts"],"names":[],"mappings":";;;;;;;;;;;AAcA,oEAuBC;AArCD,uCAAuE;AAOvE;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAC1C,KAAa,EACb,MAAS;IAET,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,QAAQ;YAClB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,OAAO,CAAO,MAAc,EAAE,OAAe,EAAE,GAAG,IAA4B,EAAoB,EAAE;oBAClG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC7B,IAAI,CAAC;wBACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;oBACrD,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAA,6BAAmB,EAAC,4BAA4B,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;wBAChE,MAAM,KAAK,CAAC;oBACd,CAAC;4BAAS,CAAC;wBACT,IAAA,+BAAqB,EAAC,qCAAqC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;oBAClG,CAAC;gBACH,CAAC,CAAA,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClE,CAAC;KACF,CAAM,CAAC;AACV,CAAC","sourcesContent":["import { recordAccessiDuration, recordAccessiMetric } from './metrics';\n\n/** Client Redis minimo usato dagli store Accessi. */\nexport interface AccessiRedisEvalClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\n/**\n * Avvolge un client Redis per misurare errori e latenza degli script Lua.\n *\n * Gli store accettano qualsiasi client con `eval` (ioredis, node-redis, client\n * di test). Il wrapper e trasparente: altri metodi (`quit`, `command`, ...)\n * restano disponibili e legati all'istanza originale.\n */\nexport function instrumentAccessiRedisClient<T extends AccessiRedisEvalClient>(\n  store: string,\n  client: T,\n): T {\n  return new Proxy(client, {\n    get(target, property) {\n      if (property === 'eval') {\n        return async (script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown> => {\n          const startedAt = Date.now();\n          try {\n            return await target.eval(script, numKeys, ...args);\n          } catch (error) {\n            recordAccessiMetric('accessi_store_errors_total', 1, { store });\n            throw error;\n          } finally {\n            recordAccessiDuration('accessi_store_operation_duration_ms', Date.now() - startedAt, { store });\n          }\n        };\n      }\n      const value = Reflect.get(target, property, target);\n      return typeof value === 'function' ? value.bind(target) : value;\n    },\n  }) as T;\n}\n"]}

package/dist/accessi-module/security/AccessiHttpExceptionFilter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"AccessiHttpExceptionFilter.js","sourceRoot":"","sources":["../../../src/accessi-module/security/AccessiHttpExceptionFilter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAkG;AAElG,+CAA4D;AAC5D,yCAAsC;AAStC;;;;;GAKG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,KAAK,CAAC,SAAkB,EAAE,IAAmB;;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;QAC7D,IAAI,QAAQ,CAAC,WAAW;YAAE,OAAO;QAEjC,MAAM,MAAM,GAAG,SAAS,YAAY,sBAAa;YAC/C,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE;YACvB,CAAC,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;gBAC9C,CAAC,CAAC,mBAAU,CAAC,mBAAmB;gBAChC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,KAAK,mBAAU,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChG,MAAM,eAAe,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCACpB,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;YAChD,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,WAAW;oBACjC,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBAClC,CAAC,CAAC,sBAAsB;wBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,mBAAmB;4BACrB,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,KAAK,0BAA0B;YACjD,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,IAAI,KAAK,kCAAkC;gBAC3C,CAAC,CAAC,+FAA+F;gBACjG,CAAC,CAAC,WAAW;oBACX,CAAC,CAAC,oDAAoD;oBACtD,CAAC,CAAC,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBACtD,CAAC,CAAC,sCAAsC;wBACxC,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,6BAA6B;4BAC/B,CAAC,CAAC,MAAM,IAAI,mBAAU,CAAC,qBAAqB;gCAC1C,CAAC,CAAC,oCAAoC;gCACtC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAEvC,MAAM,KAAK,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,eAAM,CAAC,qBAAqB,CAAC,CAAC,KAAK,CACrC,QAAQ,MAAM,IAAI,IAAI,KAAK,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAC/F,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1B,CAAC;QAEF,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,iBAC1B,QAAQ,EAAE,OAAO,EACjB,MAAM,EACN,UAAU,EAAE,sBAAU,CAAC,KAAK,EAC5B,IAAI,EACJ,KAAK,EAAE,IAAI,EACX,OAAO,IACJ,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,MAAM,EAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAChE,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,SAAkB;QACnC,IAAI,CAAC,CAAC,SAAS,YAAY,sBAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAA4B,CAAC;IAC7F,CAAC;IAEO,aAAa,CAAC,SAAkB,EAAE,OAAyB;QACjE,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACjF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;QAChF,OAAO,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;CACF,CAAA;AApEY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,cAAK,GAAE;GACK,0BAA0B,CAoEtC","sourcesContent":["import { ArgumentsHost, Catch, ExceptionFilter, HttpException, HttpStatus } from '@nestjs/common';\nimport { Response } from 'express';\nimport { RestUtilities, StatusCode } from '../../Utilities';\nimport { Logger } from '../../Logger';\n\ntype ExceptionPayload = {\n  code?: string;\n  error?: string;\n  message?: string | string[];\n  details?: string[];\n};\n\n/**\n * Finalizes every exception raised before an Accessi controller can reply.\n *\n * This includes invalid JSON, validation-pipe errors and guard failures. The\n * filter deliberately never return SQL, stack traces or provider diagnostics.\n */\n@Catch()\nexport class AccessiHttpExceptionFilter implements ExceptionFilter {\n  catch(exception: unknown, host: ArgumentsHost): void {\n    const response = host.switchToHttp().getResponse<Response>();\n    if (response.headersSent) return;\n\n    const status = exception instanceof HttpException\n      ? exception.getStatus()\n      : RestUtilities.isDatabaseSchemaError(exception)\n        ? HttpStatus.SERVICE_UNAVAILABLE\n        : HttpStatus.INTERNAL_SERVER_ERROR;\n    const payload = this.getPayload(exception);\n    const invalidJson = status === HttpStatus.BAD_REQUEST && this.isInvalidJson(exception, payload);\n    const explicitMessage = typeof payload.message === 'string' ? payload.message : undefined;\n    const code = payload.code\n      ?? (RestUtilities.isDatabaseSchemaError(exception)\n        ? 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n        : invalidJson\n          ? 'ACCESSI_INVALID_JSON'\n          : status === HttpStatus.BAD_REQUEST\n            ? 'ACCESSI_REQUEST_ERROR'\n            : status === HttpStatus.UNAUTHORIZED\n              ? 'ACCESSI_UNAUTHORIZED'\n              : status === HttpStatus.FORBIDDEN\n                ? 'ACCESSI_FORBIDDEN'\n                : 'ACCESSI_INTERNAL_ERROR');\n\n    const message = code === 'ACCESSI_VALIDATION_ERROR'\n      ? 'La richiesta contiene dati non validi.'\n      : code === 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n        ? 'Lo schema del database Accessi non e aggiornato. Eseguire la migrazione database e riprovare.'\n        : invalidJson\n          ? 'Il corpo della richiesta non contiene JSON valido.'\n          : explicitMessage ?? (status === HttpStatus.UNAUTHORIZED\n            ? 'Autenticazione non valida o scaduta.'\n            : status === HttpStatus.FORBIDDEN\n              ? 'Operazione non autorizzata.'\n              : status >= HttpStatus.INTERNAL_SERVER_ERROR\n                ? 'Errore interno del modulo Accessi.'\n                : 'Richiesta non valida.');\n\n    const stack = exception instanceof Error ? exception.stack : undefined;\n    new Logger('[ACCESSI-EXCEPTION]').error(\n      `HTTP ${status} ${code}: ${exception instanceof Error ? exception.message : String(exception)}`,\n      ...(stack ? [stack] : [])\n    );\n\n    response.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: StatusCode.Error,\n      code,\n      error: code,\n      message,\n      ...(payload.details?.length ? { details: payload.details } : {}),\n    });\n  }\n\n  private getPayload(exception: unknown): ExceptionPayload {\n    if (!(exception instanceof HttpException)) return {};\n    const response = exception.getResponse();\n    return typeof response === 'string' ? { message: response } : response as ExceptionPayload;\n  }\n\n  private isInvalidJson(exception: unknown, payload: ExceptionPayload): boolean {\n    const message = exception instanceof Error ? exception.message : payload.message;\n    const text = Array.isArray(message) ? message.join(' ') : String(message ?? '');\n    return /json|unexpected token|expected property name|unterminated string/i.test(text);\n  }\n}\n"]}

package/dist/accessi-module/security/accessControl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,kCAOC;AAMD,oDAOC;AAOD,0CAIC;AAMD,8DAQC;AAOD,gEAUC;AAGD,kDAOC;AAGD,sDAUC;AAGD,4DAoBC;AAhKD,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,sCAAsC;IAEhD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,WAAW,CACzB,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAkD;IAChF,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,KAA+B,EAC/B,MAAoD,EACpD,OAAO,GAAG,uDAAuD;IAEjE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,IAA8B,EAC9B,OAAqD;IAErD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,2BAAkB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,2BAAkB,CAAC,oEAAoE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,mBAAmB,CACjC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */\nexport interface AuthenticatedAccessiUser {\n  codiceUtente: number;\n  email?: string;\n  flagSuper: boolean;\n  flagAdmin: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\n/**\n * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n */\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n  const payload = (req as Request & { user?: unknown }).user;\n  const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\n  const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\n    ? payloadRecord.userData as Record<string, unknown>\n    : undefined;\n  const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\n  const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\n  const codiceUtente = Number(utente?.codiceUtente);\n\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n    throw new UnauthorizedException('Utente non autenticato.');\n  }\n\n  return {\n    codiceUtente,\n    email: typeof utente?.email === 'string' ? utente.email : undefined,\n    flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n    flagAdmin: normalizeBooleanFlag(utente?.flagAdmin),\n  };\n}\n\n/** Impone il flag superutente: gestione utenti e dei loro grant. */\nexport function ensureSuperUser(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata ai superutenti.',\n): void {\n  if (!user.flagSuper) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */\nexport function ensureAdmin(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori.',\n): void {\n  if (!user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Gestione utenti e assegnazioni: consentita a superutenti e admin.\n * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.\n */\nexport function ensureUserManagement(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori degli utenti.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.\n * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango\n * pari o inferiore, quindi un superutente non puo' toccare un admin.\n */\nexport function accessiUserRank(user: { flagSuper?: boolean; flagAdmin?: boolean }): number {\n  if (user.flagAdmin) return 2;\n  if (user.flagSuper) return 1;\n  return 0;\n}\n\n/**\n * Impone che l'attore possa gestire il target: rango attore >= rango target.\n * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).\n */\nexport function ensureCanManageTargetUser(\n  actor: AuthenticatedAccessiUser,\n  target: { flagSuper?: boolean; flagAdmin?: boolean },\n  message = 'Non puoi gestire un utente di rango superiore al tuo.',\n): void {\n  if (accessiUserRank(actor) < accessiUserRank(target)) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:\n * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza\n * `flagAdmin` gestisce solo `flagSuper`.\n */\nexport function ensurePrivilegeFlagChanges(\n  user: AuthenticatedAccessiUser,\n  changes: { flagSuper?: unknown; flagAdmin?: unknown },\n): void {\n  if (changes.flagAdmin !== undefined && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un admin puo modificare il flag admin.');\n  }\n  if (changes.flagSuper !== undefined && !user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un superutente o un admin puo modificare il flag superutente.');\n  }\n}\n\n/** Accesso alla console: superutenti e admin. */\nexport function ensureConsoleAccess(\n  user: AuthenticatedAccessiUser,\n  message = 'La console richiede un superutente o un admin Accessi.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */\nexport function ensureSelfOrSuperUser(\n  user: AuthenticatedAccessiUser,\n  targetUserCode: number,\n  message = 'Operazione non autorizzata su questo utente.',\n): void {\n  if (user.flagSuper || user.flagAdmin || user.codiceUtente === targetUserCode) {\n    return;\n  }\n\n  throw new ForbiddenException(message);\n}\n\n/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n  statoRegistrazione?: unknown;\n  flagSuper?: unknown;\n  flagAdmin?: unknown;\n  passwordLoginEnabled?: unknown;\n  passwordlessLoginEnabled?: unknown;\n  flagDueFattori?: unknown;\n  roles?: unknown;\n  permissions?: unknown;\n}): boolean {\n  return (\n    user.statoRegistrazione !== undefined ||\n    user.flagSuper !== undefined ||\n    user.flagAdmin !== undefined ||\n    user.passwordLoginEnabled !== undefined ||\n    user.passwordlessLoginEnabled !== undefined ||\n    user.flagDueFattori !== undefined ||\n    user.roles !== undefined ||\n    user.permissions !== undefined\n  );\n}\n"]}

package/dist/accessi-module/security/accessTokenRevocation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"accessTokenRevocation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessTokenRevocation.ts"],"names":[],"mappings":";;;;;;;;;;;AAkCA,wFA6BC;AAeD,sFAoCC;AAID,sEAMC;AAGD,kEASC;AAGD,4DAYC;AAGD,oFAQC;AAGD,gFAEC;AAtKD,gEAA6E;AA6B7E,MAAM,aAAa,GACjB,qIAAqI,CAAC;AACxI,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE,SAAgB,sCAAsC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,SAAS,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACC,MAAM,CAAC,GAAG,EAAE,WAAW;;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;SAAA;QACK,SAAS,CAAC,GAAG;;gBACjB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC1C,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACpB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACK,WAAW;;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;SAAA;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAcD,0DAA0D;AAC1D,SAAgB,qCAAqC,CACnD,OAA+C;;IAE/C,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAA,2CAA4B,EAAC,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvF,OAAO;QACC,MAAM,CAAC,GAAG,EAAE,WAAW;;gBAC3B,wEAAwE;gBACxE,0EAA0E;gBAC1E,uCAAuC;gBACvC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBACnD,CAAC,CAAC,KAAK,CAAC;gBACV,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,SAAS,GAAG,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;SAAA;QAEK,SAAS,CAAC,GAAG;;gBACjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,GAAG,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC7E,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;SAAA;QAEK,WAAW;;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;gBACjD,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,sCAAsC,EAAE,CAAC;AAEpE,SAAgB,6BAA6B,CAC3C,OAAuB;;IAEvB,IAAI,CAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,OAAO,MAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,MAAA,OAAO,CAAC,qBAAqB,0CAAE,KAAK;QAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;IACrF,OAAO,CAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,OAAO,MAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED,mDAAmD;AACnD,SAAsB,2BAA2B,CAC/C,OAAuB,EACvB,OAAgC;;QAEhC,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CAAA;AAED,sEAAsE;AACtE,SAAsB,wBAAwB,CAC5C,OAAuB,EACvB,GAAW,EACX,WAAoB;;;QAEpB,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,MAAA,OAAO,CAAC,qBAAqB,0CAAE,KAAK,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACnG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IAC7D,CAAC;CAAA;AAED,+EAA+E;AAC/E,SAAsB,oCAAoC,CACxD,OAAuB,EACvB,GAAW,EACX,WAAoB;;QAEpB,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,4DAA4D;AAC5D,SAAgB,kCAAkC;IAChD,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\nimport { instrumentAccessiRedisClient } from '../observability/redisMetrics';\n\n/**\n * Revoca dei singoli access token tramite `jti`.\n *\n * A differenza della revoca per utente, questa annulla un solo token senza\n * toccare le altre sessioni. La chiave scade al massimo a `exp` del token, cosi\n * la memoria usata resta limitata alla durata dei token emessi.\n */\nexport interface AccessTokenRevocationStore {\n  revoke(jti: string, expiresAtMs: number): Promise<void>;\n  isRevoked(jti: string): Promise<boolean>;\n  /** Health check opzionale per readiness del servizio. */\n  healthCheck?(): Promise<boolean>;\n}\n\nexport interface AccessTokenRevocationOptions {\n  /** Default: disabilitata se non viene fornito uno store. */\n  enabled?: boolean;\n  /** Store condiviso (es. Redis) per revocare i token tra istanze. */\n  store?: AccessTokenRevocationStore;\n  /** TTL di default quando `exp` non e noto. Default: 24 ore. */\n  ttlMs?: number;\n}\n\nexport interface MemoryAccessTokenRevocationStore extends AccessTokenRevocationStore {\n  clear(): void;\n}\n\nconst REVOKE_SCRIPT =\n  \"if tonumber(ARGV[1]) > 0 then return redis.call('SET', KEYS[1], '1', 'PX', ARGV[1]) else return redis.call('SET', KEYS[1], '1') end\";\nconst IS_REVOKED_SCRIPT = \"return redis.call('EXISTS', KEYS[1])\";\n\nexport function createMemoryAccessTokenRevocationStore(): MemoryAccessTokenRevocationStore {\n  const revoked = new Map<string, number>();\n  const prune = (now: number) => {\n    for (const [jti, expiresAt] of revoked) {\n      if (expiresAt <= now) revoked.delete(jti);\n    }\n  };\n  return {\n    async revoke(jti, expiresAtMs) {\n      const now = Date.now();\n      prune(now);\n      revoked.set(jti, Math.max(expiresAtMs, now + 1));\n    },\n    async isRevoked(jti) {\n      const expiresAt = revoked.get(jti);\n      if (expiresAt === undefined) return false;\n      if (expiresAt <= Date.now()) {\n        revoked.delete(jti);\n        return false;\n      }\n      return true;\n    },\n    async healthCheck() {\n      return true;\n    },\n    clear() {\n      revoked.clear();\n    },\n  };\n}\n\nexport interface AccessTokenRevocationRedisClient {\n  eval(script: string, numKeys: number, ...args: Array<string | number>): Promise<unknown>;\n}\n\nexport interface RedisAccessTokenRevocationStoreOptions {\n  client: AccessTokenRevocationRedisClient;\n  /** Default: `accessi:revoked-token:`. */\n  keyPrefix?: string;\n  /** Default: 24 ore. */\n  ttlMs?: number;\n}\n\n/** Store Redis per la revoca dei singoli access token. */\nexport function createRedisAccessTokenRevocationStore(\n  options: RedisAccessTokenRevocationStoreOptions,\n): AccessTokenRevocationStore {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Redis access token revocation store: client.eval non configurato.');\n  }\n\n  const keyPrefix = (options.keyPrefix ?? 'accessi:revoked-token:').replace(/:+$/, ':');\n  const ttlMs = Math.max(0, Math.trunc(options.ttlMs ?? 24 * 60 * 60 * 1000));\n  const client = instrumentAccessiRedisClient('access_token_revocation', options.client);\n\n  return {\n    async revoke(jti, expiresAtMs) {\n      // Se il token e gia scaduto non serve conservare la revoca a lungo: una\n      // chiave senza TTL resterebbe per sempre. Il minimo di 1 ms la fa sparire\n      // subito, come nello store in memoria.\n      const ttl = Number.isFinite(expiresAtMs)\n        ? Math.max(1, Math.trunc(expiresAtMs - Date.now()))\n        : ttlMs;\n      await client.eval(REVOKE_SCRIPT, 1, `${keyPrefix}${jti}`, ttl);\n    },\n\n    async isRevoked(jti) {\n      const result = await client.eval(IS_REVOKED_SCRIPT, 1, `${keyPrefix}${jti}`);\n      return Number(result) > 0;\n    },\n\n    async healthCheck() {\n      try {\n        const result = await client.eval(\"return redis.call('PING')\", 0);\n        return String(result).toUpperCase() === 'PONG';\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n\nconst defaultMemoryStore = createMemoryAccessTokenRevocationStore();\n\nexport function getAccessTokenRevocationStore(\n  options: AccessiOptions,\n): AccessTokenRevocationStore | undefined {\n  if (options.accessTokenRevocation?.enabled === false) return undefined;\n  if (options.accessTokenRevocation?.store) return options.accessTokenRevocation.store;\n  return options.accessTokenRevocation?.enabled === true ? defaultMemoryStore : undefined;\n}\n\n/** True se il `jti` del token risulta revocato. */\nexport async function isAccessiAccessTokenRevoked(\n  options: AccessiOptions,\n  payload: Record<string, unknown>,\n): Promise<boolean> {\n  const store = getAccessTokenRevocationStore(options);\n  if (!store) return false;\n  const jti = typeof payload.jti === 'string' ? payload.jti : undefined;\n  if (!jti) return false;\n  return store.isRevoked(jti);\n}\n\n/** Revoca un singolo access token. Richiede uno store configurato. */\nexport async function revokeAccessiAccessToken(\n  options: AccessiOptions,\n  jti: string,\n  expiresAtMs?: number,\n): Promise<void> {\n  const store = getAccessTokenRevocationStore(options);\n  if (!store) throw new Error('Access token revocation store non configurato.');\n  if (typeof jti !== 'string' || jti.trim() === '') {\n    throw new Error('jti non valido.');\n  }\n  const ttlMs = Math.max(0, Math.trunc(options.accessTokenRevocation?.ttlMs ?? 24 * 60 * 60 * 1000));\n  await store.revoke(jti, expiresAtMs ?? Date.now() + ttlMs);\n}\n\n/** Variante per i flussi applicativi: no-op se la revoca non e configurata. */\nexport async function revokeAccessiAccessTokenIfConfigured(\n  options: AccessiOptions,\n  jti: string,\n  expiresAtMs?: number,\n): Promise<boolean> {\n  if (!getAccessTokenRevocationStore(options)) return false;\n  await revokeAccessiAccessToken(options, jti, expiresAtMs);\n  return true;\n}\n\n/** Solo per test: azzera lo store in memoria di default. */\nexport function clearDefaultAccessTokenRevocations(): void {\n  defaultMemoryStore.clear();\n}\n"]}

package/dist/accessi-module/security/accessiValidation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"accessiValidation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessiValidation.ts"],"names":[],"mappings":";;AAUA,kEAmBC;AA7BD,2CAAsF;AACtF,+CAA6C;AAE7C;;;;;;GAMG;AACH,SAAgB,2BAA2B;IACzC,OAAO,IAAI,uBAAc,CAAC;QACxB,SAAS,EAAE,IAAI;QACf,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE;YAChB,wBAAwB,EAAE,IAAI;SAC/B;QACD,gBAAgB,EAAE,CAAC,MAAyB,EAAE,EAAE,CAC9C,IAAI,4BAAmB,CAAC;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,sBAAU,CAAC,KAAK;YAC5B,IAAI,EAAE,0BAA0B;YAChC,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,wCAAwC;YACjD,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC;SACzC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,uBAAuB,CAAC,MAAyB,EAAE,UAAU,GAAG,EAAE;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,uBAAuB,CAAC,MAAA,KAAK,CAAC,QAAQ,mCAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { BadRequestException, ValidationError, ValidationPipe } from '@nestjs/common';\nimport { StatusCode } from '../../Utilities';\n\n/**\n * Creates the validation pipe used by every Accessi bootstrap path.\n *\n * It deliberately returns one stable, documented error contract instead of\n * Nest's default array. Consumers can branch on `code`; `details` is safe to\n * display or log because it contains only DTO field names and validation text.\n */\nexport function createAccessiValidationPipe(): ValidationPipe {\n  return new ValidationPipe({\n    whitelist: true,\n    forbidNonWhitelisted: true,\n    transform: true,\n    transformOptions: {\n      enableImplicitConversion: true,\n    },\n    exceptionFactory: (errors: ValidationError[]) =>\n      new BadRequestException({\n        severity: 'error',\n        status: 400,\n        statusCode: StatusCode.Error,\n        code: 'ACCESSI_VALIDATION_ERROR',\n        error: 'ACCESSI_VALIDATION_ERROR',\n        message: 'La richiesta contiene dati non validi.',\n        details: flattenValidationErrors(errors),\n      }),\n  });\n}\n\n/** Converts nested class-validator failures into deterministic client details. */\nfunction flattenValidationErrors(errors: ValidationError[], parentPath = ''): string[] {\n  return errors.flatMap((error) => {\n    const path = parentPath ? `${parentPath}.${error.property}` : error.property;\n    const ownMessages = Object.values(error.constraints ?? {}).map((message) => `${path}: ${message}`);\n    return [...ownMessages, ...flattenValidationErrors(error.children ?? [], path)];\n  });\n}\n"]}

package/dist/accessi-module/security/adminBootstrap.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"adminBootstrap.js","sourceRoot":"","sources":["../../../src/accessi-module/security/adminBootstrap.ts"],"names":[],"mappings":";;AAUA,wEAKC;AAGD,wDAEC;AAGD,4DAEC;AAGD,gEAYC;AAxCD,mCAAsD;AAEtD;;;;GAIG;AACH,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC,wEAAwE;AACxE,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,0DAA0D;AAC1D,SAAgB,sBAAsB;IACpC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iFAAiF;AACjF,SAAgB,wBAAwB;IACtC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,0BAA0B,CAAC,SAAkB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAA,wBAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { randomBytes, timingSafeEqual } from 'crypto';\n\n/**\n * Token di bootstrap admin, valido per il singolo processo Accessi.\n * Viene generato al primo accesso (avvio del modulo) e rigenerato a ogni riavvio: non e mai\n * persistito ne restituito via API, e viene stampato solo nel log del backend.\n */\nlet processToken: string | null = null;\n\n/** Genera (una sola volta per processo) il token di bootstrap admin. */\nexport function getOrCreateAdminBootstrapToken(): string {\n  if (!processToken) {\n    processToken = randomBytes(32).toString('hex');\n  }\n  return processToken;\n}\n\n/** Token corrente, oppure null se non ancora generato. */\nexport function getAdminBootstrapToken(): string | null {\n  return processToken;\n}\n\n/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */\nexport function clearAdminBootstrapToken(): void {\n  processToken = null;\n}\n\n/** Confronto a tempo costante del token candidato con quello generato. */\nexport function isValidAdminBootstrapToken(candidate: unknown): boolean {\n  if (!processToken || typeof candidate !== 'string' || candidate.length === 0) {\n    return false;\n  }\n\n  const expected = Buffer.from(processToken, 'utf8');\n  const provided = Buffer.from(candidate, 'utf8');\n  if (expected.length !== provided.length) {\n    return false;\n  }\n\n  return timingSafeEqual(expected, provided);\n}\n"]}

package/dist/accessi-module/security/audit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/audit.ts"],"names":[],"mappings":";;AA4IA,0DAEC;AAkFD,sDAEC;AASD,kEAMC;AAGD,8CAGC;AAGD,oDASC;AAQD,oCAqBC;AAhSD,yCAAsC;AACtC,sDAA+D;AAC/D,4DAA8D;AAyD9D,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO;IACP,aAAa;IACb,cAAc;IACd,SAAS;IACT,QAAQ;IACR,KAAK;IACL,eAAe;IACf,QAAQ;IACR,WAAW;IACX,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,MAAM;IACN,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAWzC,SAAS,aAAa,CAAC,OAAwC;;IAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,EAAE;QAAE,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,CAAC,CAAC;IACrD,iEACE,KAAK,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,MAAK,KAAK;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,GAAG,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAK,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,CAAC;aACpE,EACL,YAAY,IACT,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACjF,aAAa,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,MAAK,KAAK,KACrC,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,EAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC5D,WAAW,EAAE,CAAC,IACd;AACJ,CAAC;AAED,IAAI,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsC,CAAC;AAEpE,SAAS,aAAa;IACpB,MAAM,QAAQ,GAAG,IAAA,kCAAkB,GAAE,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;IACxC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC/D,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,YAAY,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa,EAAE,IAAiB;IACnE,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;YACtG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACxC,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC;IACrD,OAAO,uBAAuB,CAAC,OAAO,CAA4B,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,IAAsB,EAAE,KAAc;;IAC7D,IAAA,6BAAmB,EAAC,iCAAiC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAA,IAAI,CAAC,IAAI,mCAAI,SAAS,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC;QACH,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAC9B,6BAA6B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7H,CAAC;IACJ,CAAC;IAAC,WAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB,EAAE,MAA0B;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,IAAI,OAAQ,MAAwB,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACnE,MAAwB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAkC;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC;QAAE,OAAO;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,iBAAiB;QAAE,OAAO;IACzD,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU;YAAE,SAAS;QAC9E,IAAI,CAAC;YACH,MAAM,MAAM,GAAI,IAAkC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,MAAM,IAAI,OAAQ,MAA0B,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACrE,MAA0B,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,OAAwC;IAC5E,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,2BAA2B,CACzC,QAAgB,EAChB,OAAwC;IAExC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACtF,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,iCAAM,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,KAAE,QAAQ,IAAG,CAAC,CAAC;AAC/E,CAAC;AAED,0EAA0E;AAC1E,SAAgB,iBAAiB;IAC/B,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,2EAA2E;AAC3E,SAAgB,oBAAoB,CAAC,QAAiB;;IACpD,MAAM,cAAc,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,IAAA,kCAAkB,GAAE,CAAC;IACxD,MAAM,MAAM,GAAG,cAAc;QAC3B,CAAC,CAAC,MAAA,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,mCAAI,aAAa;QACpD,CAAC,CAAC,aAAa,CAAC;IAClB,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAqC,EAAE,CACnE,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU;WAC5D,OAAQ,IAAkC,CAAC,KAAK,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAa,EAAE,UAAmC,EAAE;IAC/E,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,aAAa,GAAG,IAAA,kCAAkB,GAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,MAAM,CAAC,QAAQ,CAAC;IAClD,MAAM,MAAM,iCACV,KAAK,EACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAChC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACtC,aAAa,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAChC,CAAC;IAEF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,WAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3D,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC","sourcesContent":["import { Logger } from '../../Logger';\nimport { recordAccessiMetric } from '../observability/metrics';\nimport { getAccessiTenantId } from '../tenancy/tenantContext';\n\n/** Record di audit normalizzato e gia redatto. */\nexport interface AccessiAuditRecord {\n  event: string;\n  timestamp: string;\n  [key: string]: unknown;\n}\n\n/** Destinazione di un record di audit. */\nexport interface AccessiAuditSink {\n  /** Nome usato nelle metriche di errore del sink. */\n  name?: string;\n  write(record: AccessiAuditRecord): void | Promise<void>;\n}\n\nexport interface AccessiAuditQuery {\n  event?: string;\n  from?: string;\n  to?: string;\n  codiceUtente?: number;\n  limit?: number;\n  offset?: number;\n  order?: 'asc' | 'desc';\n}\n\nexport interface AccessiAuditPage {\n  records: AccessiAuditRecord[];\n  total: number;\n  limit: number;\n  offset: number;\n}\n\n/** Sink interrogabile dagli endpoint amministrativi e dalla retention. */\nexport interface AccessiAuditQueryableSink extends AccessiAuditSink {\n  query(filter?: AccessiAuditQuery): Promise<AccessiAuditPage>;\n  purge(before: Date): Promise<number>;\n}\n\n/** Opzioni di audit del modulo. */\nexport interface AccessiAuditOptions {\n  /** `false` disattiva i sink ma lascia il log strutturato. Default: abilitati. */\n  enabled?: boolean;\n  /** Sink aggiuntivi (HTTP, DB, OpenTelemetry). */\n  sinks?: AccessiAuditSink[];\n  /** Sink interrogabile usato da `/api/accessi/audit`. Default: primo sink queryable. */\n  store?: AccessiAuditQueryableSink;\n  /** Giorni di retention applicati ai sink queryable. Default: nessuna scadenza automatica. */\n  retentionDays?: number;\n  /** Chiavi aggiuntive da redigere, oltre a quelle predefinite. */\n  redact?: string[];\n  /** Etichetta tenant aggiunta a ogni record (multi-tenancy). */\n  tenantId?: string;\n  /** Scrivi anche sul Logger strutturato. Default: true. */\n  logger?: boolean;\n}\n\nconst REDACTED = '[REDACTED]';\nconst TRUNCATED = '[TRUNCATED]';\n\nconst DEFAULT_REDACTED_KEYS = new Set([\n  'token',\n  'accesstoken',\n  'refreshtoken',\n  'idtoken',\n  'bearer',\n  'jwt',\n  'authorization',\n  'cookie',\n  'setcookie',\n  'password',\n  'passwordhash',\n  'hashedpassword',\n  'resettoken',\n  'secret',\n  'clientsecret',\n  'privatekey',\n  'apikey',\n  'csrf',\n  'csrftoken',\n]);\n\nconst MAX_STRING_LENGTH = 512;\nconst MAX_ARRAY_LENGTH = 50;\nconst MAX_OBJECT_KEYS = 100;\nconst MAX_DEPTH = 4;\nconst PURGE_INTERVAL_MS = 60 * 60 * 1000;\n\ninterface ResolvedAccessiAuditConfig {\n  sinks: AccessiAuditSink[];\n  redactedKeys: Set<string>;\n  retentionDays?: number;\n  loggerEnabled: boolean;\n  tenantId?: string;\n  lastPurgeAt: number;\n}\n\nfunction resolveConfig(options: AccessiAuditOptions | undefined): ResolvedAccessiAuditConfig {\n  const redactedKeys = new Set(DEFAULT_REDACTED_KEYS);\n  for (const key of options?.redact ?? []) redactedKeys.add(normalizedKey(key));\n  const retentionDays = Number(options?.retentionDays);\n  return {\n    sinks: options?.enabled === false\n      ? []\n      : [\n          ...(options?.store ? [options.store] : []),\n          ...(options?.sinks ?? []).filter((sink) => sink !== options?.store),\n        ],\n    redactedKeys,\n    ...(Number.isFinite(retentionDays) && retentionDays > 0 ? { retentionDays } : {}),\n    loggerEnabled: options?.logger !== false,\n    ...(options?.tenantId ? { tenantId: options.tenantId } : {}),\n    lastPurgeAt: 0,\n  };\n}\n\nlet defaultConfig = resolveConfig(undefined);\nconst tenantConfigs = new Map<string, ResolvedAccessiAuditConfig>();\n\nfunction currentConfig(): ResolvedAccessiAuditConfig {\n  const tenantId = getAccessiTenantId();\n  if (tenantId) {\n    const tenantConfig = tenantConfigs.get(tenantId);\n    if (tenantConfig) return tenantConfig;\n  }\n  return defaultConfig;\n}\n\nfunction normalizedKey(key: string): string {\n  return key.toLowerCase().replace(/[-_\\s]/g, '');\n}\n\n/**\n * Redige ricorsivamente token, segreti, cookie e header sensibili.\n *\n * Limita profondita, lunghezza delle stringhe e numero di elementi per evitare\n * che un payload applicativo finisca per intero nell'audit.\n */\nexport function redactAccessiAuditValue(value: unknown, depth = 0): unknown {\n  return redactValue(value, depth, currentConfig().redactedKeys);\n}\n\nfunction redactValue(value: unknown, depth: number, keys: Set<string>): unknown {\n  if (depth > MAX_DEPTH) return TRUNCATED;\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return value.length > MAX_STRING_LENGTH ? `${value.slice(0, MAX_STRING_LENGTH - 3)}...` : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'bigint') return value.toString();\n  if (value instanceof Date) return value.toISOString();\n  if (value instanceof Error) {\n    return { name: value.name, message: redactValue(value.message, depth + 1, keys) };\n  }\n  if (Array.isArray(value)) {\n    return value.slice(0, MAX_ARRAY_LENGTH).map((item) => redactValue(item, depth + 1, keys));\n  }\n  if (typeof value === 'object') {\n    const result: Record<string, unknown> = {};\n    for (const [key, entry] of Object.entries(value as Record<string, unknown>).slice(0, MAX_OBJECT_KEYS)) {\n      result[key] = keys.has(normalizedKey(key))\n        ? REDACTED\n        : redactValue(entry, depth + 1, keys);\n    }\n    return result;\n  }\n  return String(value);\n}\n\nfunction redactDetails(details: Record<string, unknown>): Record<string, unknown> {\n  return redactAccessiAuditValue(details) as Record<string, unknown>;\n}\n\nfunction reportSinkError(sink: AccessiAuditSink, error: unknown): void {\n  recordAccessiMetric('accessi_audit_sink_errors_total', 1, { sink: sink.name ?? 'unknown' });\n  try {\n    new Logger('AccessiAudit').error(\n      `Audit sink non disponibile${sink.name ? ` (${sink.name})` : ''}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  } catch {\n    // Il logging non deve mai interrompere l'operazione applicativa.\n  }\n}\n\nfunction writeToSink(sink: AccessiAuditSink, record: AccessiAuditRecord): void {\n  try {\n    const result = sink.write(record);\n    if (result && typeof (result as Promise<void>).catch === 'function') {\n      (result as Promise<void>).catch((error) => reportSinkError(sink, error));\n    }\n  } catch (error) {\n    reportSinkError(sink, error);\n  }\n}\n\nfunction maybePurge(config: ResolvedAccessiAuditConfig): void {\n  if (!config.retentionDays || config.retentionDays <= 0) return;\n  const now = Date.now();\n  if (now - config.lastPurgeAt < PURGE_INTERVAL_MS) return;\n  config.lastPurgeAt = now;\n  const before = new Date(now - config.retentionDays * 24 * 60 * 60 * 1000);\n  for (const sink of config.sinks) {\n    if (typeof (sink as AccessiAuditQueryableSink).purge !== 'function') continue;\n    try {\n      const result = (sink as AccessiAuditQueryableSink).purge(before);\n      if (result && typeof (result as Promise<number>).catch === 'function') {\n        (result as Promise<number>).catch((error) => reportSinkError(sink, error));\n      }\n    } catch (error) {\n      reportSinkError(sink, error);\n    }\n  }\n}\n\n/**\n * Configura i sink di audit.\n *\n * Chiamato da `AccessiModule.forRoot`. Con `tenantId` la configurazione vale\n * solo per quel tenant e non sovrascrive quella degli altri: e il presupposto\n * per il router multi-tenant in-process. Senza `tenantId` aggiorna la\n * configurazione di default (comportamento single-tenant).\n */\nexport function configureAccessiAudit(options: AccessiAuditOptions | undefined): void {\n  defaultConfig = resolveConfig(options);\n}\n\n/**\n * Configura audit e sink per un tenant specifico (router in-process).\n *\n * La configurazione vale quando la richiesta e dentro\n * `runWithAccessiTenant`/`createAccessiTenantRouter`; gli eventi fuori da un\n * contesto tenant usano la configurazione di default del processo.\n */\nexport function configureAccessiTenantAudit(\n  tenantId: string,\n  options: AccessiAuditOptions | undefined,\n): void {\n  if (!tenantId) throw new Error('configureAccessiTenantAudit: tenantId obbligatorio.');\n  tenantConfigs.set(tenantId, resolveConfig({ ...(options ?? {}), tenantId }));\n}\n\n/** Ripristina la configurazione iniziale (logger attivo, nessun sink). */\nexport function resetAccessiAudit(): void {\n  defaultConfig = resolveConfig(undefined);\n  tenantConfigs.clear();\n}\n\n/** Sink interrogabile configurato, usato dagli endpoint amministrativi. */\nexport function getAccessiAuditStore(tenantId?: string): AccessiAuditQueryableSink | undefined {\n  const resolvedTenant = tenantId ?? getAccessiTenantId();\n  const config = resolvedTenant\n    ? tenantConfigs.get(resolvedTenant) ?? defaultConfig\n    : defaultConfig;\n  return config.sinks.find((sink): sink is AccessiAuditQueryableSink =>\n    typeof (sink as AccessiAuditQueryableSink).query === 'function'\n    && typeof (sink as AccessiAuditQueryableSink).purge === 'function',\n  );\n}\n\n/**\n * Registra un evento di sicurezza.\n *\n * Il record viene redatto prima di raggiungere logger e sink. Un sink guasto\n * non interrompe mai il flusso applicativo.\n */\nexport function auditAccessi(event: string, details: Record<string, unknown> = {}): void {\n  const config = currentConfig();\n  const contextTenant = getAccessiTenantId();\n  const tenantId = contextTenant ?? config.tenantId;\n  const record: AccessiAuditRecord = {\n    event,\n    timestamp: new Date().toISOString(),\n    ...(tenantId ? { tenant: tenantId } : {}),\n    ...redactDetails(details ?? {}),\n  };\n\n  if (config.loggerEnabled) {\n    try {\n      new Logger('AccessiAudit').warning(JSON.stringify(record));\n    } catch {\n      // Il logging non deve mai interrompere l'operazione applicativa.\n    }\n  }\n\n  for (const sink of config.sinks) writeToSink(sink, record);\n  maybePurge(config);\n}\n"]}

package/dist/accessi-module/security/auditSinks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auditSinks.js","sourceRoot":"","sources":["../../../src/accessi-module/security/auditSinks.ts"],"names":[],"mappings":";;;;;;;;;;;AA+EA,oEAsCC;AAWD,gEA+BC;AAOD,wEAKC;AAwDD,kEAqCC;AAjQD,gEAA6E;AAG7E,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,SAAS,GAAG,IAAK,CAAC;AAExB,SAAS,cAAc,CAAC,QAA2B,EAAE;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAe,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,MAA0B;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,MAA0B,EAAE,KAAwB;IACnE,IAAI,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,KAAK,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACzG,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,OAA6B,EAAE,KAAwB;IACvE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAC9C,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAA0B;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAuB,CAAC;AAClE,CAAC;AAkBD;;;;;GAKG;AACH,SAAgB,4BAA4B,CAC1C,UAAyC,EAAE;;IAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,KAAM,CAAC,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAA,OAAO,CAAC,WAAW,mCAAI,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAI,CAAC,GAAG,CAAC;IACpC,IAAI,OAAO,GAAyB,EAAE,CAAC;IAEvC,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,WAAW,CAAC;QACtC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,MAAA,OAAO,CAAC,IAAI,mCAAI,QAAQ;QAC9B,KAAK,CAAC,MAAM;YACV,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAClC,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU;gBAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;YACtF,YAAY,EAAE,CAAC;QACjB,CAAC;QACK,KAAK;iEAAC,KAAK,GAAG,EAAE;gBACpB,YAAY,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;SAAA;QACK,KAAK,CAAC,MAAY;;gBACtB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;gBACnC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;gBACtE,OAAO,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YACtC,CAAC;SAAA;QACD,GAAG;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;QACD,KAAK;YACH,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,SAAgB,0BAA0B,CACxC,OAAoC;;IAEpC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAA;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACzE,OAAO;QACL,IAAI,EAAE,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM;QACtB,KAAK,CAAC,MAAM;;;gBAChB,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,UAAU,CAAC,KAAK,CAAC;gBACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAA,OAAO,CAAC,SAAS,mCAAI,IAAI,CAAC,CAAC;gBAChF,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;wBAC5C,MAAM,EAAE,MAAM;wBACd,OAAO,kBACL,cAAc,EAAE,kBAAkB,IAC/B,CAAC,MAAA,OAAO,CAAC,OAAO,mCAAI,EAAE,CAAC,CAC3B;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;wBAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;oBACnE,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,YAAY,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,8BAA8B,CAC5C,KAA2D,EAC3D,IAAI,GAAG,UAAU;IAEjB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAaD,MAAM,kBAAkB,GAAG;;;;;;CAM1B,CAAC;AAEF,MAAM,iBAAiB,GAAG,6CAA6C,CAAC;AAExE,MAAM,oBAAoB,GAAG;;;;;;;;CAQ5B,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAuB,CAAC;YACvD,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACvF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,WAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,OAAqC;;IAErC,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,2CAA4B,EAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAA,OAAO,CAAC,SAAS,mCAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC;IACnF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,KAAM,CAAC,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAA,OAAO,CAAC,WAAW,mCAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAEjG,MAAM,OAAO,GAAG,GAAwC,EAAE,gDACxD,OAAA,iBAAiB,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA,GAAA,CAAC;IAElE,OAAO;QACL,IAAI,EAAE,MAAA,OAAO,CAAC,IAAI,mCAAI,OAAO;QACvB,KAAK,CAAC,MAAM;;gBAChB,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACjG,CAAC;SAAA;QACK,KAAK;iEAAC,KAAK,GAAG,EAAE;gBACpB,OAAO,QAAQ,CAAC,MAAM,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;SAAA;QACK,KAAK,CAAC,MAAY;;gBACtB,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC7C,IAAI,OAAO,KAAK,CAAC;oBAAE,OAAO,CAAC,CAAC;gBAC5B,MAAM,MAAM,CAAC,IAAI,CACf,oBAAoB,EACpB,CAAC,EACD,GAAG,EACH,WAAW,EACX,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAChD,CAAC;gBACF,OAAO,OAAO,CAAC;YACjB,CAAC;SAAA;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AccessiAuditPage,\n  AccessiAuditQuery,\n  AccessiAuditQueryableSink,\n  AccessiAuditRecord,\n  AccessiAuditSink,\n} from './audit';\nimport { instrumentAccessiRedisClient } from '../observability/redisMetrics';\nimport type { AccessiRedisEvalClient } from '../observability/redisMetrics';\n\nconst DEFAULT_LIMIT = 100;\nconst MAX_LIMIT = 1_000;\n\nfunction normalizeQuery(query: AccessiAuditQuery = {}): Required<Pick<AccessiAuditQuery, 'limit' | 'offset' | 'order'>> {\n  const limit = Number.isFinite(query.limit)\n    ? Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query.limit as number)))\n    : DEFAULT_LIMIT;\n  const offset = Number.isFinite(query.offset) ? Math.max(0, Math.trunc(query.offset as number)) : 0;\n  return { limit, offset, order: query.order === 'asc' ? 'asc' : 'desc' };\n}\n\nfunction recordTime(record: AccessiAuditRecord): number {\n  const time = Date.parse(record.timestamp);\n  return Number.isFinite(time) ? time : 0;\n}\n\nfunction matches(record: AccessiAuditRecord, query: AccessiAuditQuery): boolean {\n  if (query.event && record.event !== query.event) return false;\n  if (query.codiceUtente !== undefined && Number(record.codiceUtente) !== query.codiceUtente) return false;\n  const time = recordTime(record);\n  if (query.from) {\n    const from = Date.parse(query.from);\n    if (Number.isFinite(from) && time < from) return false;\n  }\n  if (query.to) {\n    const to = Date.parse(query.to);\n    if (Number.isFinite(to) && time > to) return false;\n  }\n  return true;\n}\n\nfunction paginate(records: AccessiAuditRecord[], query: AccessiAuditQuery): AccessiAuditPage {\n  const { limit, offset, order } = normalizeQuery(query);\n  const filtered = records.filter((record) => matches(record, query));\n  const ordered = order === 'asc' ? filtered : [...filtered].reverse();\n  return {\n    records: ordered.slice(offset, offset + limit),\n    total: filtered.length,\n    limit,\n    offset,\n  };\n}\n\nfunction cloneRecord(record: AccessiAuditRecord): AccessiAuditRecord {\n  return JSON.parse(JSON.stringify(record)) as AccessiAuditRecord;\n}\n\n/** Opzioni del sink in memoria. */\nexport interface MemoryAccessiAuditSinkOptions {\n  name?: string;\n  /** Numero massimo di record conservati. Default: 10000. */\n  maxRecords?: number;\n  /** Retention in millisecondi. Default: nessuna scadenza. */\n  retentionMs?: number;\n  /** Orologio iniettabile per i test. */\n  now?: () => number;\n}\n\nexport interface MemoryAccessiAuditSink extends AccessiAuditQueryableSink {\n  all(): AccessiAuditRecord[];\n  clear(): void;\n}\n\n/**\n * Sink in memoria con query e retention.\n *\n * Adatto a sviluppo, test e singola istanza. Per piu istanze usare\n * `createRedisAccessiAuditSink` o un sink esterno.\n */\nexport function createMemoryAccessiAuditSink(\n  options: MemoryAccessiAuditSinkOptions = {},\n): MemoryAccessiAuditSink {\n  const maxRecords = Math.max(1, Math.trunc(options.maxRecords ?? 10_000));\n  const retentionMs = Math.max(0, Number(options.retentionMs ?? 0));\n  const now = options.now ?? Date.now;\n  let records: AccessiAuditRecord[] = [];\n\n  const purgeExpired = (): void => {\n    if (!retentionMs) return;\n    const threshold = now() - retentionMs;\n    records = records.filter((record) => recordTime(record) >= threshold);\n  };\n\n  return {\n    name: options.name ?? 'memory',\n    write(record) {\n      records.push(cloneRecord(record));\n      if (records.length > maxRecords) records = records.slice(records.length - maxRecords);\n      purgeExpired();\n    },\n    async query(query = {}) {\n      purgeExpired();\n      return paginate(records, query);\n    },\n    async purge(before: Date) {\n      const threshold = before.getTime();\n      const beforeCount = records.length;\n      records = records.filter((record) => recordTime(record) >= threshold);\n      return beforeCount - records.length;\n    },\n    all() {\n      return records.map(cloneRecord);\n    },\n    clear() {\n      records = [];\n    },\n  };\n}\n\n/** Sink HTTP: inoltra ogni record a un endpoint esterno (SIEM, collector). */\nexport interface HttpAccessiAuditSinkOptions {\n  name?: string;\n  url: string;\n  headers?: Record<string, string>;\n  fetch?: typeof fetch;\n  timeoutMs?: number;\n}\n\nexport function createHttpAccessiAuditSink(\n  options: HttpAccessiAuditSinkOptions,\n): AccessiAuditSink {\n  if (!options?.url) throw new Error('Audit sink HTTP: url obbligatoria.');\n  return {\n    name: options.name ?? 'http',\n    async write(record) {\n      const fetchImpl = options.fetch ?? globalThis.fetch;\n      if (typeof fetchImpl !== 'function') {\n        throw new Error('Audit sink HTTP: fetch non disponibile.');\n      }\n      const controller = new AbortController();\n      const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 3000);\n      try {\n        const response = await fetchImpl(options.url, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            ...(options.headers ?? {}),\n          },\n          body: JSON.stringify(record),\n          signal: controller.signal,\n        });\n        if (!response.ok) {\n          throw new Error(`Audit sink HTTP: risposta ${response.status}.`);\n        }\n      } finally {\n        clearTimeout(timeout);\n      }\n    },\n  };\n}\n\n/**\n * Adattatore per database, OpenTelemetry o qualunque destinazione custom.\n *\n * La callback riceve un record gia redatto e serializzabile.\n */\nexport function createCallbackAccessiAuditSink(\n  write: (record: AccessiAuditRecord) => void | Promise<void>,\n  name = 'callback',\n): AccessiAuditSink {\n  return { name, write };\n}\n\nexport interface RedisAccessiAuditSinkOptions {\n  client: AccessiRedisEvalClient;\n  name?: string;\n  /** Default: `accessi:audit:`. */\n  keyPrefix?: string;\n  /** Numero massimo di record. Default: 10000. */\n  maxRecords?: number;\n  /** Retention Redis in millisecondi. Default: 30 giorni. */\n  retentionMs?: number;\n}\n\nconst REDIS_WRITE_SCRIPT = `\nlocal key = KEYS[1]\nredis.call('RPUSH', key, ARGV[1])\nredis.call('LTRIM', key, -tonumber(ARGV[2]), -1)\nredis.call('PEXPIRE', key, ARGV[3])\nreturn 1\n`;\n\nconst REDIS_READ_SCRIPT = `return redis.call('LRANGE', KEYS[1], 0, -1)`;\n\nconst REDIS_REWRITE_SCRIPT = `\nlocal key = KEYS[1]\nredis.call('DEL', key)\nfor i = 2, #ARGV do\n  redis.call('RPUSH', key, ARGV[i])\nend\nredis.call('PEXPIRE', key, ARGV[1])\nreturn #ARGV - 1\n`;\n\nfunction parseRedisRecords(value: unknown): AccessiAuditRecord[] {\n  if (!Array.isArray(value)) return [];\n  const records: AccessiAuditRecord[] = [];\n  for (const entry of value) {\n    if (typeof entry !== 'string') continue;\n    try {\n      const parsed = JSON.parse(entry) as AccessiAuditRecord;\n      if (parsed && typeof parsed.event === 'string' && typeof parsed.timestamp === 'string') {\n        records.push(parsed);\n      }\n    } catch {\n      // Un record corrotto non deve bloccare query ed export.\n    }\n  }\n  return records;\n}\n\n/**\n * Sink Redis persistente, condiviso tra istanze e interrogabile.\n *\n * Usa una lista con `LTRIM` per limitare i record e `PEXPIRE` per la retention.\n * Le query leggono la lista e filtrano lato applicazione.\n */\nexport function createRedisAccessiAuditSink(\n  options: RedisAccessiAuditSinkOptions,\n): AccessiAuditQueryableSink {\n  if (!options?.client || typeof options.client.eval !== 'function') {\n    throw new Error('Audit sink Redis: client.eval non configurato.');\n  }\n  const client = instrumentAccessiRedisClient('audit', options.client);\n  const key = `${(options.keyPrefix ?? 'accessi:audit:').replace(/:*$/, ':')}events`;\n  const maxRecords = Math.max(1, Math.trunc(options.maxRecords ?? 10_000));\n  const retentionMs = Math.max(1_000, Math.trunc(options.retentionMs ?? 30 * 24 * 60 * 60 * 1000));\n\n  const readAll = async (): Promise<AccessiAuditRecord[]> =>\n    parseRedisRecords(await client.eval(REDIS_READ_SCRIPT, 1, key));\n\n  return {\n    name: options.name ?? 'redis',\n    async write(record) {\n      await client.eval(REDIS_WRITE_SCRIPT, 1, key, JSON.stringify(record), maxRecords, retentionMs);\n    },\n    async query(query = {}) {\n      return paginate(await readAll(), query);\n    },\n    async purge(before: Date) {\n      const records = await readAll();\n      const kept = records.filter((record) => recordTime(record) >= before.getTime());\n      const removed = records.length - kept.length;\n      if (removed === 0) return 0;\n      await client.eval(\n        REDIS_REWRITE_SCRIPT,\n        1,\n        key,\n        retentionMs,\n        ...kept.map((record) => JSON.stringify(record)),\n      );\n      return removed;\n    },\n  };\n}\n"]}