@ackplus/nest-auth 2.7.6 → 2.8.0

package/dist/lib/utils/password-policy.util.d.ts

@@ -0,0 +1,11 @@
+export interface PasswordPolicyContext {
+    email?: string;
+}
+export declare function assertPasswordPolicy(password: string, ctx?: PasswordPolicyContext): Promise<void>;
+export interface HibpOptions {
+    baseUrl?: string;
+    timeoutMs?: number;
+    failOpen?: boolean;
+}
+export declare function isPasswordBreached(password: string, hibp?: HibpOptions): Promise<boolean>;
+//# sourceMappingURL=password-policy.util.d.ts.map

package/dist/lib/utils/password-policy.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.util.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/password-policy.util.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,qBAAqB;IAElC,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAYD,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC3G;AAED,MAAM,WAAW,WAAW;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB;AAQD,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CA8B/F"}

package/dist/lib/utils/password-policy.util.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertPasswordPolicy = assertPasswordPolicy;
+exports.isPasswordBreached = isPasswordBreached;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const auth_config_service_1 = require("../core/services/auth-config.service");
+const auth_constants_1 = require("../auth.constants");
+const common_passwords_1 = require("./common-passwords");
+function reject(message, code) {
+    throw new common_1.BadRequestException({ message, code });
+}
+async function assertPasswordPolicy(password, ctx = {}) {
+    const policy = auth_config_service_1.AuthConfigService.getOptions().password?.policy;
+    if (!policy?.enabled)
+        return;
+    if (typeof password !== 'string' || password.length === 0) {
+        reject('Password is required', auth_constants_1.ERROR_CODES.PASSWORD_TOO_SHORT);
+    }
+    const minLength = policy.minLength ?? 8;
+    const maxLength = policy.maxLength ?? 128;
+    if (password.length < minLength) {
+        reject(`Password must be at least ${minLength} characters`, auth_constants_1.ERROR_CODES.PASSWORD_TOO_SHORT);
+    }
+    if (password.length > maxLength) {
+        reject(`Password must be at most ${maxLength} characters`, auth_constants_1.ERROR_CODES.PASSWORD_TOO_LONG);
+    }
+    const lower = password.toLowerCase();
+    if (policy.blockCommonPasswords !== false && common_passwords_1.COMMON_PASSWORDS.has(lower)) {
+        reject('This password is too common', auth_constants_1.ERROR_CODES.PASSWORD_TOO_COMMON);
+    }
+    if (Array.isArray(policy.blocklist) && policy.blocklist.some((p) => typeof p === 'string' && p.toLowerCase() === lower)) {
+        reject('This password is not allowed', auth_constants_1.ERROR_CODES.PASSWORD_TOO_COMMON);
+    }
+    if (policy.blockContainsIdentifier !== false && ctx.email) {
+        const local = ctx.email.split('@')[0]?.toLowerCase();
+        if (local && local.length >= 3 && lower.includes(local)) {
+            reject('Password must not contain your email address', auth_constants_1.ERROR_CODES.PASSWORD_CONTAINS_IDENTIFIER);
+        }
+    }
+    if (policy.checkBreached && (await isPasswordBreached(password, policy.hibp))) {
+        reject('This password has appeared in a known data breach — please choose a different one', auth_constants_1.ERROR_CODES.PASSWORD_BREACHED);
+    }
+}
+async function isPasswordBreached(password, hibp) {
+    const baseUrl = (hibp?.baseUrl || 'https://api.pwnedpasswords.com/range').replace(/\/$/, '');
+    const timeoutMs = hibp?.timeoutMs ?? 2000;
+    const failOpen = hibp?.failOpen !== false;
+    try {
+        const sha1 = (0, crypto_1.createHash)('sha1').update(password, 'utf8').digest('hex').toUpperCase();
+        const prefix = sha1.slice(0, 5);
+        const suffix = sha1.slice(5);
+        const res = await fetch(`${baseUrl}/${prefix}`, {
+            headers: { 'Add-Padding': 'true' },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (!res.ok)
+            return !failOpen;
+        const body = await res.text();
+        for (const line of body.split('\n')) {
+            const idx = line.indexOf(':');
+            if (idx === -1)
+                continue;
+            const suf = line.slice(0, idx).trim().toUpperCase();
+            if (suf === suffix) {
+                const count = parseInt(line.slice(idx + 1).trim(), 10);
+                return Number.isFinite(count) && count > 0;
+            }
+        }
+        return false;
+    }
+    catch {
+        return !failOpen;
+    }
+}
+//# sourceMappingURL=password-policy.util.js.map

package/dist/lib/utils/password-policy.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.util.js","sourceRoot":"","sources":["../../../src/lib/utils/password-policy.util.ts"],"names":[],"mappings":";;AAqBA,oDAyCC;AAiBD,gDA8BC;AA7GD,2CAAqD;AACrD,mCAAoC;AACpC,8EAAyE;AACzE,sDAAgD;AAChD,yDAAsD;AAOtD,SAAS,MAAM,CAAC,OAAe,EAAE,IAAY;IACzC,MAAM,IAAI,4BAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAQM,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,MAA6B,EAAE;IACxF,MAAM,MAAM,GAAG,uCAAiB,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO;IAE7B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,sBAAsB,EAAE,4BAAW,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,6BAA6B,SAAS,aAAa,EAAE,4BAAW,CAAC,kBAAkB,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,4BAA4B,SAAS,aAAa,EAAE,4BAAW,CAAC,iBAAiB,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAGrC,IAAI,MAAM,CAAC,oBAAoB,KAAK,KAAK,IAAI,mCAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,6BAA6B,EAAE,4BAAW,CAAC,mBAAmB,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QACtH,MAAM,CAAC,8BAA8B,EAAE,4BAAW,CAAC,mBAAmB,CAAC,CAAC;IAC5E,CAAC;IAGD,IAAI,MAAM,CAAC,uBAAuB,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,8CAA8C,EAAE,4BAAW,CAAC,4BAA4B,CAAC,CAAC;QACrG,CAAC;IACL,CAAC;IAKD,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,mFAAmF,EAAE,4BAAW,CAAC,iBAAiB,CAAC,CAAC;IAC/H,CAAC;AACL,CAAC;AAiBM,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,IAAkB;IACzE,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,sCAAsC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,KAAK,KAAK,CAAC;IAE1C,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,EAAE;YAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE;YAClC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,CAAC,QAAQ,CAAC;QAE9B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,SAAS;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YAC/C,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC,QAAQ,CAAC;IACrB,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ackplus/nest-auth",
-  "version": "2.7.6",
+  "version": "2.8.0",
   "description": "Authentication & authorization for NestJS — JWT/cookie sessions, refresh-token rotation, RBAC, multi-tenancy, MFA, OAuth/social login, passwordless, API keys, and a built-in admin console.",
   "type": "commonjs",
   "main": "./dist/index.js",
@@ -49,7 +49,7 @@
     "qrcode": "^1.5.0",
     "qs": "^6.11.2",
     "speakeasy": "^2.0.0",
-    "@ackplus/nest-auth-contracts": "2.7.6"
+    "@ackplus/nest-auth-contracts": "2.8.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^10 || ^11",
@@ -111,7 +111,7 @@
     "@types/supertest": "^6.0.2",
     "unplugin-swc": "^1.5.0",
     "@swc/core": "^1.7.0",
-    "@ackplus/vitest-preset": "2.7.6"
+    "@ackplus/vitest-preset": "2.8.0"
   },
   "scripts": {
     "clean": "rm -rf dist tsconfig.build.tsbuildinfo",