@carecard/validate 3.23.0 → 3.25.0

package/index.d.ts

@@ -6,9 +6,16 @@
 export type ValidatePropertiesInput = Record<string, unknown> | null | undefined;
 export type ValidatePropertiesResult = Record<string, unknown>;
 export type BoolValidator = (input: unknown) => boolean;
-export type FailureMessageValidator = (input: unknown) => string | null;
 export type InStringArrayValidator = (stringArray: readonly string[], input: unknown) => boolean;
 
+export type PasswordValidationFailureReason =
+  'invalid_type' | 'invalid_unicode' | 'too_short' | 'too_long' | 'blocked';
+export type PasswordValidationResult =
+  { isValid: true; value: string } | { isValid: false; reason: PasswordValidationFailureReason };
+
+/** Validates and NFC-normalizes a new password using the CareCard password policy. */
+export function validatePassword(input: unknown): PasswordValidationResult;
+
 /**
  * Utility function to validate multiple properties of an object at once.
  */
@@ -145,24 +152,12 @@ export const isSafeSearchString: BoolValidator;
 export const isEmailString: BoolValidator;
 /** Checks if the string is a valid JWT format. */
 export const isJwtString: BoolValidator;
-/** Checks if the string is a valid strong password. */
-export const isPasswordString: BoolValidator;
-/** Checks if the string is a valid simple password. */
-export const isSimplePasswordString: BoolValidator;
-/** Returns a failure message if the password is not strong enough. */
-export const isPasswordStringFailureMessage: FailureMessageValidator;
-/** Returns a failure message if the password is not valid as a simple password. */
-export const isSimplePasswordStringFailureMessage: FailureMessageValidator;
 /** Checks if the string is a valid username. */
 export const isUsernameString: BoolValidator;
 /** Checks if the string is a valid phone number. */
 export const isPhoneNumber: BoolValidator;
 /** Checks if the string is URL-safe. */
 export const isUrlSafeString: BoolValidator;
-/** Checks if the string length is between 6 and 24 characters. */
-export const isString6To24CharacterLong: BoolValidator;
-/** Checks if the string length is between 6 and 16 characters. */
-export const isString6To16CharacterLong: BoolValidator;
 /** Checks if the string is a valid Canadian province abbreviation (ON, QC). */
 export const isProvinceString: BoolValidator;
 /** Checks if the value is a boolean. */
@@ -211,15 +206,9 @@ export const validate: {
   isSafeSearchString: typeof isSafeSearchString;
   isEmailString: typeof isEmailString;
   isJwtString: typeof isJwtString;
-  isPasswordString: typeof isPasswordString;
-  isSimplePasswordString: typeof isSimplePasswordString;
-  isPasswordStringFailureMessage: typeof isPasswordStringFailureMessage;
-  isSimplePasswordStringFailureMessage: typeof isSimplePasswordStringFailureMessage;
   isUsernameString: typeof isUsernameString;
   isPhoneNumber: typeof isPhoneNumber;
   isUrlSafeString: typeof isUrlSafeString;
-  isString6To24CharacterLong: typeof isString6To24CharacterLong;
-  isString6To16CharacterLong: typeof isString6To16CharacterLong;
   isProvinceString: typeof isProvinceString;
   isBoolValue: typeof isBoolValue;
   isPostalCodeString: typeof isPostalCodeString;

package/index.js

@@ -1,13 +1,15 @@
 const validate = require('./lib/validate');
+const { validatePassword, ...legacyValidate } = validate;
 const validateProperties = require('./lib/validateProperties');
 const validateWhitelistProperties = require('./lib/validateWhitelistProperties');
 const validateNewUserRoleRequest = require('./lib/validateNewUserRoleRequest');
 
 module.exports = {
-  validate,
+  validate: legacyValidate,
+  validatePassword,
   validateProperties,
   validateWhitelistProperties,
   ...validateNewUserRoleRequest,
-  ...validate,
+  ...legacyValidate,
   ...validateProperties,
 };

package/lib/validate.js

@@ -100,36 +100,26 @@ const isJwtString = jwt => {
   return jwtRegex.test(jwt);
 };
 
-const isPasswordString = password => {
-  if (typeof password !== 'string' || password.length === 0 || password.length > 128) {
-    return false;
+// Pattern: Policy Function - owns normalization, length, and blocklist decisions for passwords.
+const validatePassword = password => {
+  if (typeof password !== 'string') {
+    return { isValid: false, reason: 'invalid_type' };
   }
-  const regExPassword = /^(?=.*[a-zA-Z0-9])(?=.*[!@#$%^&*_-])[a-zA-Z0-9!@#$%^&*_-]{6,32}$/;
-  return regExPassword.test(String(password));
-};
-
-const isSimplePasswordString = password => {
-  if (typeof password !== 'string' || password.length === 0 || password.length > 128) {
-    return false;
+  if (!password.isWellFormed()) {
+    return { isValid: false, reason: 'invalid_unicode' };
   }
-  const regExPassword = /^[a-zA-Z0-9!@#$%^&*_-]{6,32}$/;
-  return regExPassword.test(String(password));
-};
-
-const isPasswordStringFailureMessage = password => {
-  if (!isPasswordString(password)) {
-    return 'Total 6 to 32 characters, numbers and one of !@#$%^&*_-';
-  } else {
-    return null;
+  const normalizedPassword = password.normalize('NFC');
+  const passwordLength = [...normalizedPassword].length;
+  if (passwordLength < MINIMUM_PASSWORD_LENGTH) {
+    return { isValid: false, reason: 'too_short' };
   }
-};
-
-const isSimplePasswordStringFailureMessage = password => {
-  if (!isSimplePasswordString(password)) {
-    return 'Total 6 to 32 characters, numbers or !@#$%^&*_-';
-  } else {
-    return null;
+  if (passwordLength > MAXIMUM_PASSWORD_LENGTH) {
+    return { isValid: false, reason: 'too_long' };
+  }
+  if (commonPasswords.has(normalizedPassword)) {
+    return { isValid: false, reason: 'blocked' };
   }
+  return { isValid: true, value: normalizedPassword };
 };
 
 const isUsernameString = str => {
@@ -159,20 +149,6 @@ const isUrlSafeString = inputString => {
   return urlSafeRegex.test(inputString);
 };
 
-const isString6To24CharacterLong = password => {
-  if (typeof password !== 'string' || password.length === 0) {
-    return false;
-  }
-  return 6 <= password.length && password.length <= 24;
-};
-
-const isString6To16CharacterLong = password => {
-  if (typeof password !== 'string' || password.length === 0) {
-    return false;
-  }
-  return 6 <= password.length && password.length <= 16;
-};
-
 const isProvinceString = inputString => {
   const provinces = ['on', 'qc'];
 
@@ -356,15 +332,10 @@ module.exports = {
   isSafeSearchString,
   isEmailString,
   isJwtString,
-  isPasswordString,
-  isSimplePasswordString,
-  isPasswordStringFailureMessage,
-  isSimplePasswordStringFailureMessage,
+  validatePassword,
   isUsernameString,
   isPhoneNumber,
   isUrlSafeString,
-  isString6To24CharacterLong,
-  isString6To16CharacterLong,
   isProvinceString,
   isBoolValue,
   isPostalCodeString,
@@ -381,3 +352,7 @@ module.exports = {
   isValidUrl,
   isValidArrayOfStrings,
 };
+const commonPasswords = new Set(require('../data/commonPasswords.json'));
+
+const MINIMUM_PASSWORD_LENGTH = 15;
+const MAXIMUM_PASSWORD_LENGTH = 128;

package/lib/validateProperties.js

@@ -5,9 +5,7 @@ const {
   isUrlSafeString,
   isValidUuidString,
   isCcIdString,
-  isSimplePasswordString,
-  isPasswordString,
-  isString6To16CharacterLong,
+  validatePassword,
   isNameString,
   isSafeSearchString,
   isCharactersString,
@@ -110,14 +108,11 @@ function validateProperties(obj = {}) {
       case 'password':
       case 'new_password':
       case 'newPassword':
-        if (isString6To16CharacterLong(value) && isSimplePasswordString(value)) {
-          returnObj[key] = value;
-        }
-        break;
-      case 'strong_password':
-      case 'strongPassword':
-        if (isString6To16CharacterLong(value) && isPasswordString(value)) {
-          returnObj[key] = value;
+        {
+          const passwordResult = validatePassword(value);
+          if (passwordResult.isValid) {
+            returnObj[key] = passwordResult.value;
+          }
         }
         break;
       case 'email':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/validate",
-  "version": "3.23.0",
+  "version": "3.25.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/CareCard-ca/pkg-validate.git"
@@ -8,6 +8,9 @@
   "description": "Validate data",
   "main": "index.js",
   "types": "index.d.ts",
+  "engines": {
+    "node": ">=24.20.0 <25"
+  },
   "scripts": {
     "test": "node scripts/runPackageTask.mjs test",
     "test:order": "node --test scripts/testOrder/randomizeTestOrder.test.mjs scripts/testParallel/runIndexedMochaTests.test.mjs scripts/packageTaskRunner.test.mjs scripts/canonicalTestCommand.test.mjs",
@@ -44,7 +47,7 @@
     "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/common-util": "3.23.0"
+    "@carecard/common-util": "3.25.0"
   },
   "nyc": {
     "all": true,