@contember/engine-tenant-api 2.1.0-alpha.3 → 2.1.0-alpha.30

package/dist/production/src/model/service/IDPSignInManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"IDPSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/IDPSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries'\nimport { IDPResponse, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema'\nimport { DatabaseContext } from '../utils'\nimport { CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProviderIdentifierCommand } from '../commands'\nimport { TenantRole } from '../authorization'\nimport { NoPassword } from '../dtos'\nimport { IdentityProviderRow } from '../queries/idp/types'\n\nclass IDPSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signInIDP(\n\t\tdbContext: DatabaseContext,\n\t\tidpSlug: string,\n\t\tresponseData: unknown,\n\t\texpiration?: number,\n\t): Promise<IDPSignInManager.SignInIDPResponse> {\n\t\treturn dbContext.transaction(async (db): Promise<IDPSignInManager.SignInIDPResponse> => {\n\t\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\t\tif (!provider || provider.disabledAt) {\n\t\t\t\tthrow new Error('provider not found')\n\t\t\t}\n\t\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\t\tlet claim: IDPResponse\n\t\t\ttry {\n\t\t\t\tclaim = await providerService.processResponse(\n\t\t\t\t\tvalidatedConfig,\n\t\t\t\t\tresponseData,\n\t\t\t\t)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IDPResponseError) {\n\t\t\t\t\treturn new ResponseError('INVALID_IDP_RESPONSE', e.message)\n\t\t\t\t}\n\t\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tconst personRow = await this.resolvePerson(db, claim, provider)\n\n\t\t\tif (!personRow) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`)\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`)\n\t\t\t}\n\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\t\t\treturn new ResponseOk({ person: personRow, token: sessionToken, idpResponse: claim })\n\t\t})\n\t}\n\n\tasync initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse> {\n\t\tconst provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\tif (!provider || provider.disabledAt) {\n\t\t\treturn new ResponseError('PROVIDER_NOT_FOUND', `Identity provider ${idpSlug} not found`)\n\t\t}\n\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\ttry {\n\t\t\tconst initResponse = await providerService.initAuth(validatedConfig, data)\n\n\t\t\tconst publicConfig = providerService.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(validatedConfig)\n\t\t\t\t: validatedConfig\n\n\t\t\treturn new ResponseOk({\n\t\t\t\t...initResponse,\n\t\t\t\tidpConfiguration: provider.initReturnsConfig ? publicConfig : null,\n\t\t\t})\n\t\t} catch (e) {\n\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\t}\n\n\tprivate async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow | null> {\n\t\tconst personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)\n\t\tconst personByIdp = await db.queryHandler.fetch(personByIdPQuery)\n\t\tif (personByIdp) {\n\t\t\treturn personByIdp\n\t\t}\n\n\t\tif (!provider.exclusive) {\n\t\t\tconst personByEmail = claim.email ? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email)) : null\n\t\t\tif (personByEmail) {\n\t\t\t\tawait this.saveIdpIdentifier(db, provider, claim, personByEmail)\n\t\t\t\treturn personByEmail\n\t\t\t}\n\t\t}\n\n\t\tif (provider.autoSignUp) {\n\t\t\tconst signedUpPerson = await this.signUp(db, claim, provider)\n\t\t\tawait this.saveIdpIdentifier(db, provider, claim, signedUpPerson)\n\t\t\treturn signedUpPerson\n\t\t}\n\n\t\treturn null\n\t}\n\n\tprivate async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {\n\t\tconst roles = [TenantRole.PERSON]\n\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))\n\t\tconst newPerson = await db.commandBus.execute(new CreatePersonCommand({\n\t\t\tidentityId,\n\t\t\temail: provider.exclusive ? undefined : email,\n\t\t\tpassword: NoPassword,\n\t\t\tname: name ?? email?.split('@')[0] ?? externalIdentifier,\n\t\t\tidpOnly: provider.exclusive,\n\t\t}))\n\n\t\treturn {\n\t\t\t...newPerson,\n\t\t\troles,\n\t\t}\n\t}\n\n\tprivate async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPResponse, person: PersonRow) {\n\t\tawait db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))\n\t}\n}\n\nnamespace IDPSignInManager {\n\texport type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>\n\n\tinterface SignInIDPResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\treadonly idpResponse?: Record<string, unknown>\n\t}\n\n\texport type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode>\n}\n\nexport { IDPSignInManager }\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,iBAAiB;AAAA,EACtB,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,UACL,WACA,SACA,cACA,YAC8C;AACvC,WAAA,UAAU,YAAY,OAAO,OAAoD;AACjF,YAAA,WAAW,MAAM,GAAG,aAAa,MAAM,IAAI,4BAA4B,OAAO,CAAC;AACjF,UAAA,CAAC,YAAY,SAAS,YAAY;AAC/B,cAAA,IAAI,MAAM,oBAAoB;AAAA,MAAA;AAErC,YAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,YAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AAChF,UAAA;AACA,UAAA;AACH,gBAAQ,MAAM,gBAAgB;AAAA,UAC7B;AAAA,UACA;AAAA,QACD;AAAA,eACQ,GAAG;AACX,YAAI,aAAa,kBAAkB;AAClC,iBAAO,IAAI,cAAc,wBAAwB,EAAE,OAAO;AAAA,QAAA;AAE3D,YAAI,aAAa,oBAAoB;AACpC,iBAAO,IAAI,cAAc,yBAAyB,EAAE,OAAO;AAAA,QAAA;AAEtD,cAAA;AAAA,MAAA;AAEP,YAAM,YAAY,MAAM,KAAK,cAAc,IAAI,OAAO,QAAQ;AAE9D,UAAI,CAAC,WAAW;AACf,eAAO,IAAI,cAAc,oBAAoB,UAAU,MAAM,KAAK,YAAY;AAAA,MAAA;AAG3E,UAAA,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAI,cAAc,mBAAmB,sBAAsB,MAAM,KAAK,cAAc;AAAA,MAAA;AAGtF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoB,IAAI,UAAU,aAAa,UAAU;AAChG,aAAA,IAAI,WAAW,EAAE,QAAQ,WAAW,OAAO,cAAc,aAAa,OAAO;AAAA,IAAA,CACpF;AAAA,EAAA;AAAA,EAGF,MAAM,cAAc,WAA4B,SAAiB,MAAgE;AAC1H,UAAA,WAAW,MAAM,UAAU,aAAa,MAAM,IAAI,4BAA4B,OAAO,CAAC;AACxF,QAAA,CAAC,YAAY,SAAS,YAAY;AACrC,aAAO,IAAI,cAAc,sBAAsB,qBAAqB,OAAO,YAAY;AAAA,IAAA;AAExF,UAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,UAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AAChF,QAAA;AACH,YAAM,eAAe,MAAM,gBAAgB,SAAS,iBAAiB,IAAI;AAEzE,YAAM,eAAe,gBAAgB,yBAClC,gBAAgB,uBAAuB,eAAe,IACtD;AAEH,aAAO,IAAI,WAAW;AAAA,QACrB,GAAG;AAAA,QACH,kBAAkB,SAAS,oBAAoB,eAAe;AAAA,MAAA,CAC9D;AAAA,aACO,GAAG;AACX,UAAI,aAAa,oBAAoB;AACpC,eAAO,IAAI,cAAc,yBAAyB,EAAE,OAAO;AAAA,MAAA;AAEtD,YAAA;AAAA,IAAA;AAAA,EACP;AAAA,EAGD,MAAc,cAAc,IAAqB,OAAoB,UAA0D;AAC9H,UAAM,mBAAmB,IAAI,iBAAiB,SAAS,IAAI,MAAM,kBAAkB;AACnF,UAAM,cAAc,MAAM,GAAG,aAAa,MAAM,gBAAgB;AAChE,QAAI,aAAa;AACT,aAAA;AAAA,IAAA;AAGJ,QAAA,CAAC,SAAS,WAAW;AACxB,YAAM,gBAAgB,MAAM,QAAQ,MAAM,GAAG,aAAa,MAAM,YAAY,QAAQ,MAAM,KAAK,CAAC,IAAI;AACpG,UAAI,eAAe;AAClB,cAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,aAAa;AACxD,eAAA;AAAA,MAAA;AAAA,IACR;AAGD,QAAI,SAAS,YAAY;AACxB,YAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,OAAO,QAAQ;AAC5D,YAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,cAAc;AACzD,aAAA;AAAA,IAAA;AAGD,WAAA;AAAA,EAAA;AAAA,EAGR,MAAc,OAAO,IAAqB,EAAE,OAAO,MAAM,sBAAmC,UAAmD;AACxI,UAAA,QAAQ,CAAC,WAAW,MAAM;AAC1B,UAAA,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAI,sBAAsB,KAAK,CAAC;AAC/E,UAAM,YAAY,MAAM,GAAG,WAAW,QAAQ,IAAI,oBAAoB;AAAA,MACrE;AAAA,MACA,OAAO,SAAS,YAAY,SAAY;AAAA,MACxC,UAAU;AAAA,MACV,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,MACtC,SAAS,SAAS;AAAA,IAAA,CAClB,CAAC;AAEK,WAAA;AAAA,MACN,GAAG;AAAA,MACH;AAAA,IACD;AAAA,EAAA;AAAA,EAGD,MAAc,kBAAkB,IAAqB,UAA+B,OAAoB,QAAmB;AACpH,UAAA,GAAG,WAAW,QAAQ,IAAI,8CAA8C,SAAS,IAAI,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,EAAA;AAEjI;"}
+{"version":3,"file":"IDPSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/IDPSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries'\nimport { IDPResponse, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema'\nimport { DatabaseContext } from '../utils'\nimport { CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProviderIdentifierCommand } from '../commands'\nimport { TenantRole } from '../authorization'\nimport { NoPassword } from '../dtos'\nimport { IdentityProviderRow } from '../queries/idp/types'\nimport { AuthLogService } from './AuthLogService'\n\nclass IDPSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signInIDP(\n\t\tdbContext: DatabaseContext,\n\t\tidpSlug: string,\n\t\tresponseData: unknown,\n\t\texpiration?: number,\n\t): Promise<IDPSignInManager.SignInIDPResponse> {\n\t\treturn dbContext.transaction(async (db): Promise<IDPSignInManager.SignInIDPResponse> => {\n\t\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\t\tif (!provider || provider.disabledAt) {\n\t\t\t\tthrow new Error('provider not found')\n\t\t\t}\n\t\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\t\tlet claim: IDPResponse\n\t\t\ttry {\n\t\t\t\tclaim = await providerService.processResponse(\n\t\t\t\t\tvalidatedConfig,\n\t\t\t\t\tresponseData,\n\t\t\t\t)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IDPResponseError) {\n\t\t\t\t\treturn new ResponseError('INVALID_IDP_RESPONSE', e.message, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tconst personRow = await this.resolvePerson(db, claim, provider)\n\n\t\t\tif (!personRow) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\tidpResponse: claim,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse> {\n\t\tconst provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\tif (!provider || provider.disabledAt) {\n\t\t\treturn new ResponseError('PROVIDER_NOT_FOUND', `Identity provider ${idpSlug} not found`)\n\t\t}\n\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\ttry {\n\t\t\tconst initResponse = await providerService.initAuth(validatedConfig, data)\n\n\t\t\tconst publicConfig = providerService.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(validatedConfig)\n\t\t\t\t: validatedConfig\n\n\t\t\treturn new ResponseOk({\n\t\t\t\t...initResponse,\n\t\t\t\tidpConfiguration: provider.initReturnsConfig ? publicConfig : null,\n\t\t\t})\n\t\t} catch (e) {\n\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\t}\n\n\tprivate async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow | null> {\n\t\tconst personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)\n\t\tconst personByIdp = await db.queryHandler.fetch(personByIdPQuery)\n\t\tif (personByIdp) {\n\t\t\treturn personByIdp\n\t\t}\n\n\t\tif (!provider.exclusive) {\n\t\t\tconst personByEmail = claim.email ? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email)) : null\n\t\t\tif (personByEmail) {\n\t\t\t\tawait this.saveIdpIdentifier(db, provider, claim, personByEmail)\n\t\t\t\treturn personByEmail\n\t\t\t}\n\t\t}\n\n\t\tif (provider.autoSignUp) {\n\t\t\tconst signedUpPerson = await this.signUp(db, claim, provider)\n\t\t\tawait this.saveIdpIdentifier(db, provider, claim, signedUpPerson)\n\t\t\treturn signedUpPerson\n\t\t}\n\n\t\treturn null\n\t}\n\n\tprivate async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {\n\t\tconst roles = [TenantRole.PERSON]\n\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))\n\t\tconst newPerson = await db.commandBus.execute(new CreatePersonCommand({\n\t\t\tidentityId,\n\t\t\temail: provider.exclusive ? undefined : email,\n\t\t\tpassword: NoPassword,\n\t\t\tname: name ?? email?.split('@')[0] ?? externalIdentifier,\n\t\t\tidpOnly: provider.exclusive,\n\t\t}))\n\n\t\treturn {\n\t\t\t...newPerson,\n\t\t\troles,\n\t\t}\n\t}\n\n\tprivate async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPResponse, person: PersonRow) {\n\t\tawait db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))\n\t}\n}\n\nnamespace IDPSignInManager {\n\texport type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>\n\n\tinterface SignInIDPResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\treadonly idpResponse?: Record<string, unknown>\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\n\texport type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { IDPSignInManager }\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,MAAM,iBAAiB;AAAA,EACtB,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,UACL,WACA,SACA,cACA,YAC8C;AACvC,WAAA,UAAU,YAAY,OAAO,OAAoD;AACjF,YAAA,WAAW,MAAM,GAAG,aAAa,MAAM,IAAI,4BAA4B,OAAO,CAAC;AACjF,UAAA,CAAC,YAAY,SAAS,YAAY;AAC/B,cAAA,IAAI,MAAM,oBAAoB;AAAA,MAAA;AAErC,YAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,YAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AAChF,UAAA;AACA,UAAA;AACH,gBAAQ,MAAM,gBAAgB;AAAA,UAC7B;AAAA,UACA;AAAA,QACD;AAAA,eACQ,GAAG;AACX,YAAI,aAAa,kBAAkB;AAClC,iBAAO,IAAI,cAAc,wBAAwB,EAAE,SAAS;AAAA,YAC3D,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU;AAAA,cACV,oBAAoB,SAAS;AAAA,YAC7B,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAEF,YAAI,aAAa,oBAAoB;AACpC,iBAAO,IAAI,cAAc,yBAAyB,EAAE,SAAS;AAAA,YAC5D,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU;AAAA,cACV,oBAAoB,SAAS;AAAA,YAC7B,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAEI,cAAA;AAAA,MAAA;AAEP,YAAM,YAAY,MAAM,KAAK,cAAc,IAAI,OAAO,QAAQ;AAE9D,UAAI,CAAC,WAAW;AACf,eAAO,IAAI,cAAc,oBAAoB,UAAU,MAAM,KAAK,cAAc;AAAA,UAC/E,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,oBAAoB,SAAS;AAAA,YAC7B,aAAa,MAAM;AAAA,YACnB,UAAU;AAAA,UACV,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAI,cAAc,mBAAmB,sBAAsB,MAAM,KAAK,gBAAgB;AAAA,UAC5F,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,oBAAoB,SAAS;AAAA,YAC7B,aAAa,MAAM;AAAA,YACnB,UAAU,UAAU;AAAA,UACpB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoB,IAAI,UAAU,aAAa,UAAU;AACvG,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,aAAa;AAAA,QACb,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,oBAAoB,SAAS;AAAA,UAC7B,aAAa,MAAM;AAAA,QACnB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,cAAc,WAA4B,SAAiB,MAAgE;AAC1H,UAAA,WAAW,MAAM,UAAU,aAAa,MAAM,IAAI,4BAA4B,OAAO,CAAC;AACxF,QAAA,CAAC,YAAY,SAAS,YAAY;AACrC,aAAO,IAAI,cAAc,sBAAsB,qBAAqB,OAAO,YAAY;AAAA,IAAA;AAExF,UAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,UAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AAChF,QAAA;AACH,YAAM,eAAe,MAAM,gBAAgB,SAAS,iBAAiB,IAAI;AAEzE,YAAM,eAAe,gBAAgB,yBAClC,gBAAgB,uBAAuB,eAAe,IACtD;AAEH,aAAO,IAAI,WAAW;AAAA,QACrB,GAAG;AAAA,QACH,kBAAkB,SAAS,oBAAoB,eAAe;AAAA,MAAA,CAC9D;AAAA,aACO,GAAG;AACX,UAAI,aAAa,oBAAoB;AACpC,eAAO,IAAI,cAAc,yBAAyB,EAAE,OAAO;AAAA,MAAA;AAEtD,YAAA;AAAA,IAAA;AAAA,EACP;AAAA,EAGD,MAAc,cAAc,IAAqB,OAAoB,UAA0D;AAC9H,UAAM,mBAAmB,IAAI,iBAAiB,SAAS,IAAI,MAAM,kBAAkB;AACnF,UAAM,cAAc,MAAM,GAAG,aAAa,MAAM,gBAAgB;AAChE,QAAI,aAAa;AACT,aAAA;AAAA,IAAA;AAGJ,QAAA,CAAC,SAAS,WAAW;AACxB,YAAM,gBAAgB,MAAM,QAAQ,MAAM,GAAG,aAAa,MAAM,YAAY,QAAQ,MAAM,KAAK,CAAC,IAAI;AACpG,UAAI,eAAe;AAClB,cAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,aAAa;AACxD,eAAA;AAAA,MAAA;AAAA,IACR;AAGD,QAAI,SAAS,YAAY;AACxB,YAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,OAAO,QAAQ;AAC5D,YAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,cAAc;AACzD,aAAA;AAAA,IAAA;AAGD,WAAA;AAAA,EAAA;AAAA,EAGR,MAAc,OAAO,IAAqB,EAAE,OAAO,MAAM,sBAAmC,UAAmD;AACxI,UAAA,QAAQ,CAAC,WAAW,MAAM;AAC1B,UAAA,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAI,sBAAsB,KAAK,CAAC;AAC/E,UAAM,YAAY,MAAM,GAAG,WAAW,QAAQ,IAAI,oBAAoB;AAAA,MACrE;AAAA,MACA,OAAO,SAAS,YAAY,SAAY;AAAA,MACxC,UAAU;AAAA,MACV,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,MACtC,SAAS,SAAS;AAAA,IAAA,CAClB,CAAC;AAEK,WAAA;AAAA,MACN,GAAG;AAAA,MACH;AAAA,IACD;AAAA,EAAA;AAAA,EAGD,MAAc,kBAAkB,IAAqB,UAA+B,OAAoB,QAAmB;AACpH,UAAA,GAAG,WAAW,QAAQ,IAAI,8CAA8C,SAAS,IAAI,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,EAAA;AAEjI;"}

package/dist/production/src/model/service/MembershipValidator.cjs

@@ -11,7 +11,7 @@ class MembershipValidator {
     if (!schema) {
       throw new Error();
     }
-    return this.resolver.resolve(schema.acl, memberships, schemaUtils.MembershipResolver.UnknownIdentity).errors;
+    return this.resolver.resolve(schema.acl, memberships, schemaUtils.MembershipResolver.UnknownIdentity, false).errors;
   }
 }
 Object.defineProperty(exports, "MembershipValidationError", {

package/dist/production/src/model/service/MembershipValidator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type'\nimport { MembershipValidationError, MembershipValidationErrorType, MembershipResolver } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":["MembershipResolver"],"mappings":";;;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAIA,kCACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM;AAAA,IAAA;AAEV,WAAA,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAaA,YAAAA,mBAAmB,eAAe,EAAE;AAAA,EAAA;AAE5F;;;;;;;;;;"}
+{"version":3,"file":"MembershipValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type'\nimport { MembershipValidationError, MembershipValidationErrorType, MembershipResolver } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":["MembershipResolver"],"mappings":";;;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAIA,kCACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM;AAAA,IAAA;AAEV,WAAA,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAaA,+BAAmB,iBAAiB,KAAK,EAAE;AAAA,EAAA;AAEnG;;;;;;;;;;"}

package/dist/production/src/model/service/MembershipValidator.js

@@ -10,7 +10,7 @@ class MembershipValidator {
     if (!schema) {
       throw new Error();
     }
-    return this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity).errors;
+    return this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors;
   }
 }
 export {

package/dist/production/src/model/service/MembershipValidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type'\nimport { MembershipValidationError, MembershipValidationErrorType, MembershipResolver } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":[],"mappings":";;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAI,sBACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM;AAAA,IAAA;AAEV,WAAA,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAa,mBAAmB,eAAe,EAAE;AAAA,EAAA;AAE5F;"}
+{"version":3,"file":"MembershipValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type'\nimport { MembershipValidationError, MembershipValidationErrorType, MembershipResolver } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":[],"mappings":";;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAI,sBACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM;AAAA,IAAA;AAEV,WAAA,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAa,mBAAmB,iBAAiB,KAAK,EAAE;AAAA,EAAA;AAEnG;"}

package/dist/production/src/model/service/PasswordChangeManager.cjs

@@ -5,23 +5,32 @@ require("@contember/database");
 require("node:crypto");
 const Response = require("../utils/Response.cjs");
 const ChangePasswordCommand = require("../commands/person/ChangePasswordCommand.cjs");
-const password = require("../utils/password.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
 class PasswordChangeManager {
-  constructor(providers) {
+  constructor(providers, passwordStrengthVerifier) {
     this.providers = providers;
+    this.passwordStrengthVerifier = passwordStrengthVerifier;
   }
-  async changePassword(dbContext, personId, password$1) {
-    const weakPassword = password.getPasswordWeaknessMessage(password$1);
-    if (weakPassword) {
-      return new Response.ResponseError("TOO_WEAK", weakPassword);
+  async changePassword(dbContext, person, password) {
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
+    if (!passwordVerifyResult.ok) {
+      return passwordVerifyResult;
     }
-    await dbContext.commandBus.execute(new ChangePasswordCommand.ChangePasswordCommand(personId, password$1));
+    await dbContext.commandBus.execute(new ChangePasswordCommand.ChangePasswordCommand(person.id, password));
     return new Response.ResponseOk(null);
   }
-  async changeMyPassword(dbContext, person, currentPassword, password$1) {
-    const weakPassword = password.getPasswordWeaknessMessage(password$1);
-    if (weakPassword) {
-      return new Response.ResponseError("TOO_WEAK", weakPassword);
+  async changeMyPassword(dbContext, person, currentPassword, password) {
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
+    if (!passwordVerifyResult.ok) {
+      return passwordVerifyResult;
     }
     if (!person.password_hash) {
       return new Response.ResponseError("NO_PASSWORD_SET", "No password set");
@@ -29,7 +38,7 @@ class PasswordChangeManager {
     if (!await this.providers.bcryptCompare(currentPassword, person.password_hash)) {
       return new Response.ResponseError("INVALID_PASSWORD", "Password does not match");
     }
-    await dbContext.commandBus.execute(new ChangePasswordCommand.ChangePasswordCommand(person.id, password$1));
+    await dbContext.commandBus.execute(new ChangePasswordCommand.ChangePasswordCommand(person.id, password));
     return new Response.ResponseOk(null);
   }
 }

package/dist/production/src/model/service/PasswordChangeManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tasync changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T>\n}\n\nexport { PasswordChangeManager }\n"],"names":["password","getPasswordWeaknessMessage","ResponseError","ChangePasswordCommand","ResponseOk"],"mappings":";;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,eAAe,WAA4B,UAAkBA,YAAkG;AAC9J,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAAA,cAAc,YAAY,YAAY;AAAA,IAAA;AAElD,UAAM,UAAU,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,UAAUH,UAAQ,CAAC;AACzE,WAAA,IAAII,oBAAW,IAAI;AAAA,EAAA;AAAA,EAG3B,MAAM,iBAAiB,WAA4B,QAAmB,iBAAyBJ,YAAoG;AAC5L,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAAA,cAAc,YAAY,YAAY;AAAA,IAAA;AAE9C,QAAA,CAAC,OAAO,eAAe;AACnB,aAAA,IAAIA,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,IAAA;AAE1D,QAAA,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AAC1E,aAAA,IAAIA,SAAAA,cAAc,oBAAoB,yBAAyB;AAAA,IAAA;AAGjE,UAAA,UAAU,WAAW,QAAQ,IAAIC,4CAAsB,OAAO,IAAIH,UAAQ,CAAC;AAC1E,WAAA,IAAII,oBAAW,IAAI;AAAA,EAAA;AAE5B;;"}
+{"version":3,"file":"PasswordChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(dbContext: DatabaseContext, person: PersonRow, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":["ConfigurationQuery","ChangePasswordCommand","ResponseOk","ResponseError"],"mappings":";;;;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,eAAe,WAA4B,QAAmB,UAAkG;AACrK,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,mBAAAA,oBAAoB;AACpE,UAAA,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AACzG,QAAA,CAAC,qBAAqB,IAAI;AACtB,aAAA;AAAA,IAAA;AAEF,UAAA,UAAU,WAAW,QAAQ,IAAIC,4CAAsB,OAAO,IAAI,QAAQ,CAAC;AAC1E,WAAA,IAAIC,oBAAW,IAAI;AAAA,EAAA;AAAA,EAG3B,MAAM,iBAAiB,WAA4B,QAAmB,iBAAyB,UAAoG;AAClM,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIF,mBAAAA,oBAAoB;AACpE,UAAA,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AACzG,QAAA,CAAC,qBAAqB,IAAI;AACtB,aAAA;AAAA,IAAA;AAEJ,QAAA,CAAC,OAAO,eAAe;AACnB,aAAA,IAAIG,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,IAAA;AAE1D,QAAA,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AAC1E,aAAA,IAAIA,SAAAA,cAAc,oBAAoB,yBAAyB;AAAA,IAAA;AAGjE,UAAA,UAAU,WAAW,QAAQ,IAAIF,4CAAsB,OAAO,IAAI,QAAQ,CAAC;AAC1E,WAAA,IAAIC,oBAAW,IAAI;AAAA,EAAA;AAE5B;;"}

package/dist/production/src/model/service/PasswordChangeManager.js

@@ -1,25 +1,34 @@
 import "../type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
-import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { ResponseOk, ResponseError } from "../utils/Response.js";
 import { ChangePasswordCommand } from "../commands/person/ChangePasswordCommand.js";
-import { getPasswordWeaknessMessage } from "../utils/password.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
 class PasswordChangeManager {
-  constructor(providers) {
+  constructor(providers, passwordStrengthVerifier) {
     this.providers = providers;
+    this.passwordStrengthVerifier = passwordStrengthVerifier;
   }
-  async changePassword(dbContext, personId, password) {
-    const weakPassword = getPasswordWeaknessMessage(password);
-    if (weakPassword) {
-      return new ResponseError("TOO_WEAK", weakPassword);
+  async changePassword(dbContext, person, password) {
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
+    if (!passwordVerifyResult.ok) {
+      return passwordVerifyResult;
     }
-    await dbContext.commandBus.execute(new ChangePasswordCommand(personId, password));
+    await dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password));
     return new ResponseOk(null);
   }
   async changeMyPassword(dbContext, person, currentPassword, password) {
-    const weakPassword = getPasswordWeaknessMessage(password);
-    if (weakPassword) {
-      return new ResponseError("TOO_WEAK", weakPassword);
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
+    if (!passwordVerifyResult.ok) {
+      return passwordVerifyResult;
     }
     if (!person.password_hash) {
       return new ResponseError("NO_PASSWORD_SET", "No password set");

package/dist/production/src/model/service/PasswordChangeManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tasync changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T>\n}\n\nexport { PasswordChangeManager }\n"],"names":[],"mappings":";;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,eAAe,WAA4B,UAAkB,UAAkG;AAC9J,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,YAAY,YAAY;AAAA,IAAA;AAElD,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,UAAU,QAAQ,CAAC;AACzE,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAAA,EAG3B,MAAM,iBAAiB,WAA4B,QAAmB,iBAAyB,UAAoG;AAC5L,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,YAAY,YAAY;AAAA,IAAA;AAE9C,QAAA,CAAC,OAAO,eAAe;AACnB,aAAA,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAAA;AAE1D,QAAA,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AAC1E,aAAA,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IAAA;AAGjE,UAAA,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAC1E,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAE5B;"}
+{"version":3,"file":"PasswordChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(dbContext: DatabaseContext, person: PersonRow, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":[],"mappings":";;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,eAAe,WAA4B,QAAmB,UAAkG;AACrK,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AACpE,UAAA,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AACzG,QAAA,CAAC,qBAAqB,IAAI;AACtB,aAAA;AAAA,IAAA;AAEF,UAAA,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAC1E,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAAA,EAG3B,MAAM,iBAAiB,WAA4B,QAAmB,iBAAyB,UAAoG;AAClM,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AACpE,UAAA,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AACzG,QAAA,CAAC,qBAAqB,IAAI;AACtB,aAAA;AAAA,IAAA;AAEJ,QAAA,CAAC,OAAO,eAAe;AACnB,aAAA,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAAA;AAE1D,QAAA,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AAC1E,aAAA,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IAAA;AAGjE,UAAA,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAC1E,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAE5B;"}

package/dist/production/src/model/service/PasswordResetManager.cjs

@@ -1,16 +1,25 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Response = require("../utils/Response.cjs");
-const password = require("../utils/password.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
+require("@contember/database");
 const exceptions = require("../../exceptions.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
 const getPreferredProject = require("./helpers/getPreferredProject.cjs");
-require("@contember/database");
 const CreatePersonTokenCommand = require("../commands/personToken/CreatePersonTokenCommand.cjs");
 const ResetPasswordCommand = require("../commands/personToken/ResetPasswordCommand.cjs");
+const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
+const AuthLogService = require("./AuthLogService.cjs");
 class PasswordResetManager {
-  constructor(mailer, projectManager) {
+  constructor(mailer, projectManager, passwordStrengthValidator) {
     this.mailer = mailer;
     this.projectManager = projectManager;
+    this.passwordStrengthValidator = passwordStrengthValidator;
   }
   async createPasswordResetRequest(dbContext, permissionContext, person, mailOptions = {}) {
     const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.CreatePersonTokenCommand.createPasswordResetRequest(person.id));
@@ -33,12 +42,35 @@ class PasswordResetManager {
       }
     );
   }
-  async resetPassword(dbContext, token, password$1) {
-    const weakPassword = password.getPasswordWeaknessMessage(password$1);
-    if (weakPassword) {
-      return new Response.ResponseError("PASSWORD_TOO_WEAK", weakPassword);
+  async resetPassword(dbContext, token, password) {
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byToken(token, "password_reset"));
+    if (!tokenRow) {
+      return new Response.ResponseError("TOKEN_NOT_FOUND", "Token not found", {
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({})
+      });
+    }
+    const authLogData = new AuthLogService.AuthLogService.Bag({
+      personId: tokenRow.person_id,
+      tokenId: tokenRow.id
+    });
+    const weakPassword = await this.passwordStrengthValidator.verify(password, config.password, "PASSWORD_TOO_WEAK");
+    if (!weakPassword.ok) {
+      return new Response.ResponseError(weakPassword.error, weakPassword.errorMessage, {
+        ...weakPassword.metadata ?? {},
+        [AuthLogService.AuthLogService.Key]: authLogData
+      });
+    }
+    const resetPasswordResult = await dbContext.commandBus.execute(new ResetPasswordCommand.ResetPasswordCommand(token, password));
+    if (!resetPasswordResult.ok) {
+      return new Response.ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {
+        ...resetPasswordResult.metadata ?? {},
+        [AuthLogService.AuthLogService.Key]: authLogData
+      });
     }
-    return await dbContext.commandBus.execute(new ResetPasswordCommand.ResetPasswordCommand(token, password$1));
+    return new Response.ResponseOk({
+      [AuthLogService.AuthLogService.Key]: authLogData
+    });
   }
 }
 exports.PasswordResetManager = PasswordResetManager;

package/dist/production/src/model/service/PasswordResetManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError } from '../utils/Response'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { UserMailer } from '../mailing'\nimport { PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { CreatePersonTokenCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands/personToken'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) { }\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('PASSWORD_TOO_WEAK', weakPassword)\n\t\t}\n\t\treturn await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t}\n}\n\nexport type ResetPasswordErrorCode = 'PASSWORD_TOO_WEAK'\n\nexport type ResetPasswordResponse = Response<null, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>\n"],"names":["CreatePersonTokenCommand","getPreferredProject","ImplementationException","password","getPasswordWeaknessMessage","ResponseError","ResetPasswordCommand"],"mappings":";;;;;;;;;AAgBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EAAA;AAAA,EAGlB,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AACV,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQA,yBAAAA,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAC1G,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUC,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AACrE,QAAA,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIC,WAAAA,wBAAwB;AAAA,IAAA;AAGnC,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MACvB;AAAA,MACA;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAE5B;AAAA,EAAA;AAAA,EAGD,MAAa,cAAc,WAA4B,OAAeC,YAAkD;AACjH,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAAA,cAAc,qBAAqB,YAAY;AAAA,IAAA;AAEpD,WAAA,MAAM,UAAU,WAAW,QAAQ,IAAIC,0CAAqB,OAAOH,UAAQ,CAAC;AAAA,EAAA;AAErF;;"}
+{"version":3,"file":"PasswordResetManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { UserMailer } from '../mailing'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { CreatePersonTokenCommand, ResetPasswordCommand } from '../commands/personToken'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\nimport { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { AuthLogService } from './AuthLogService'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) { }\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'password_reset'))\n\t\tif (!tokenRow) {\n\t\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found', {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: tokenRow.person_id,\n\t\t\ttokenId: tokenRow.id,\n\t\t})\n\t\tconst weakPassword = await this.passwordStrengthValidator.verify(password, config.password, 'PASSWORD_TOO_WEAK')\n\t\tif (!weakPassword.ok) {\n\t\t\treturn new ResponseError(weakPassword.error, weakPassword.errorMessage, {\n\t\t\t\t...weakPassword.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\tconst resetPasswordResult =  await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t\tif (!resetPasswordResult.ok) {\n\t\t\treturn new ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {\n\t\t\t\t...resetPasswordResult.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\t[AuthLogService.Key]: authLogData,\n\t\t})\n\t}\n}\n\nexport type ResetPasswordResponse = Response<{\n\t[AuthLogService.Key]: AuthLogService.Bag\n}, ResetPasswordErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n"],"names":["CreatePersonTokenCommand","getPreferredProject","ImplementationException","ConfigurationQuery","PersonTokenQuery","ResponseError","AuthLogService","ResetPasswordCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;AAmBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBACA,2BAChB;AAHgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EAAA;AAAA,EAGlB,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AACV,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQA,yBAAAA,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAC1G,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUC,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AACrE,QAAA,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIC,WAAAA,wBAAwB;AAAA,IAAA;AAGnC,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MACvB;AAAA,MACA;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAE5B;AAAA,EAAA;AAAA,EAGD,MAAa,cAAc,WAA4B,OAAe,UAAkD;AACvH,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AACpE,UAAA,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQ,OAAO,gBAAgB,CAAC;AACrG,QAAI,CAAC,UAAU;AACP,aAAA,IAAIC,SAAAA,cAAc,mBAAmB,mBAAmB;AAAA,QAC9D,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAe,eAAA,IAAI,CAAE,CAAA;AAAA,MAAA,CAC/C;AAAA,IAAA;AAGI,UAAA,cAAc,IAAIA,eAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,SAAS;AAAA,MACnB,SAAS,SAAS;AAAA,IAAA,CAClB;AACK,UAAA,eAAe,MAAM,KAAK,0BAA0B,OAAO,UAAU,OAAO,UAAU,mBAAmB;AAC3G,QAAA,CAAC,aAAa,IAAI;AACrB,aAAO,IAAID,SAAAA,cAAc,aAAa,OAAO,aAAa,cAAc;AAAA,QACvE,GAAG,aAAa,YAAY,CAAC;AAAA,QAC7B,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IAAA;AAEI,UAAA,sBAAuB,MAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAA,qBAAqB,OAAO,QAAQ,CAAC;AACrG,QAAA,CAAC,oBAAoB,IAAI;AAC5B,aAAO,IAAIF,SAAAA,cAAc,oBAAoB,OAAO,oBAAoB,cAAc;AAAA,QACrF,GAAG,oBAAoB,YAAY,CAAC;AAAA,QACpC,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IAAA;AAEF,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB,CAACF,eAAAA,eAAe,GAAG,GAAG;AAAA,IAAA,CACtB;AAAA,EAAA;AAEH;;"}

package/dist/production/src/model/service/PasswordResetManager.js

@@ -1,14 +1,23 @@
-import { ResponseError } from "../utils/Response.js";
-import { getPasswordWeaknessMessage } from "../utils/password.js";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
+import "@contember/database";
 import { ImplementationException } from "../../exceptions.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
 import { getPreferredProject } from "./helpers/getPreferredProject.js";
-import "@contember/database";
 import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
 import { ResetPasswordCommand } from "../commands/personToken/ResetPasswordCommand.js";
+import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
+import { AuthLogService } from "./AuthLogService.js";
 class PasswordResetManager {
-  constructor(mailer, projectManager) {
+  constructor(mailer, projectManager, passwordStrengthValidator) {
     this.mailer = mailer;
     this.projectManager = projectManager;
+    this.passwordStrengthValidator = passwordStrengthValidator;
   }
   async createPasswordResetRequest(dbContext, permissionContext, person, mailOptions = {}) {
     const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id));
@@ -32,11 +41,34 @@ class PasswordResetManager {
     );
   }
   async resetPassword(dbContext, token, password) {
-    const weakPassword = getPasswordWeaknessMessage(password);
-    if (weakPassword) {
-      return new ResponseError("PASSWORD_TOO_WEAK", weakPassword);
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, "password_reset"));
+    if (!tokenRow) {
+      return new ResponseError("TOKEN_NOT_FOUND", "Token not found", {
+        [AuthLogService.Key]: new AuthLogService.Bag({})
+      });
+    }
+    const authLogData = new AuthLogService.Bag({
+      personId: tokenRow.person_id,
+      tokenId: tokenRow.id
+    });
+    const weakPassword = await this.passwordStrengthValidator.verify(password, config.password, "PASSWORD_TOO_WEAK");
+    if (!weakPassword.ok) {
+      return new ResponseError(weakPassword.error, weakPassword.errorMessage, {
+        ...weakPassword.metadata ?? {},
+        [AuthLogService.Key]: authLogData
+      });
+    }
+    const resetPasswordResult = await dbContext.commandBus.execute(new ResetPasswordCommand(token, password));
+    if (!resetPasswordResult.ok) {
+      return new ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {
+        ...resetPasswordResult.metadata ?? {},
+        [AuthLogService.Key]: authLogData
+      });
     }
-    return await dbContext.commandBus.execute(new ResetPasswordCommand(token, password));
+    return new ResponseOk({
+      [AuthLogService.Key]: authLogData
+    });
   }
 }
 export {

package/dist/production/src/model/service/PasswordResetManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError } from '../utils/Response'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { UserMailer } from '../mailing'\nimport { PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { CreatePersonTokenCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands/personToken'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) { }\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('PASSWORD_TOO_WEAK', weakPassword)\n\t\t}\n\t\treturn await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t}\n}\n\nexport type ResetPasswordErrorCode = 'PASSWORD_TOO_WEAK'\n\nexport type ResetPasswordResponse = Response<null, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>\n"],"names":[],"mappings":";;;;;;;AAgBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EAAA;AAAA,EAGlB,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AACV,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQ,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAC1G,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AACrE,QAAA,CAAC,OAAO,OAAO;AAClB,YAAM,IAAI,wBAAwB;AAAA,IAAA;AAGnC,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MACvB;AAAA,MACA;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAE5B;AAAA,EAAA;AAAA,EAGD,MAAa,cAAc,WAA4B,OAAe,UAAkD;AACjH,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,qBAAqB,YAAY;AAAA,IAAA;AAEpD,WAAA,MAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,CAAC;AAAA,EAAA;AAErF;"}
+{"version":3,"file":"PasswordResetManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { UserMailer } from '../mailing'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { CreatePersonTokenCommand, ResetPasswordCommand } from '../commands/personToken'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\nimport { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { AuthLogService } from './AuthLogService'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) { }\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'password_reset'))\n\t\tif (!tokenRow) {\n\t\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found', {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: tokenRow.person_id,\n\t\t\ttokenId: tokenRow.id,\n\t\t})\n\t\tconst weakPassword = await this.passwordStrengthValidator.verify(password, config.password, 'PASSWORD_TOO_WEAK')\n\t\tif (!weakPassword.ok) {\n\t\t\treturn new ResponseError(weakPassword.error, weakPassword.errorMessage, {\n\t\t\t\t...weakPassword.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\tconst resetPasswordResult =  await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t\tif (!resetPasswordResult.ok) {\n\t\t\treturn new ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {\n\t\t\t\t...resetPasswordResult.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\t[AuthLogService.Key]: authLogData,\n\t\t})\n\t}\n}\n\nexport type ResetPasswordResponse = Response<{\n\t[AuthLogService.Key]: AuthLogService.Bag\n}, ResetPasswordErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAmBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBACA,2BAChB;AAHgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EAAA;AAAA,EAGlB,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AACV,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQ,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAC1G,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AACrE,QAAA,CAAC,OAAO,OAAO;AAClB,YAAM,IAAI,wBAAwB;AAAA,IAAA;AAGnC,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MACvB;AAAA,MACA;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAE5B;AAAA,EAAA;AAAA,EAGD,MAAa,cAAc,WAA4B,OAAe,UAAkD;AACvH,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AACpE,UAAA,WAAW,MAAM,UAAU,aAAa,MAAM,iBAAiB,QAAQ,OAAO,gBAAgB,CAAC;AACrG,QAAI,CAAC,UAAU;AACP,aAAA,IAAI,cAAc,mBAAmB,mBAAmB;AAAA,QAC9D,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAE,CAAA;AAAA,MAAA,CAC/C;AAAA,IAAA;AAGI,UAAA,cAAc,IAAI,eAAe,IAAI;AAAA,MAC1C,UAAU,SAAS;AAAA,MACnB,SAAS,SAAS;AAAA,IAAA,CAClB;AACK,UAAA,eAAe,MAAM,KAAK,0BAA0B,OAAO,UAAU,OAAO,UAAU,mBAAmB;AAC3G,QAAA,CAAC,aAAa,IAAI;AACrB,aAAO,IAAI,cAAc,aAAa,OAAO,aAAa,cAAc;AAAA,QACvE,GAAG,aAAa,YAAY,CAAC;AAAA,QAC7B,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IAAA;AAEI,UAAA,sBAAuB,MAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,CAAC;AACrG,QAAA,CAAC,oBAAoB,IAAI;AAC5B,aAAO,IAAI,cAAc,oBAAoB,OAAO,oBAAoB,cAAc;AAAA,QACrF,GAAG,oBAAoB,YAAY,CAAC;AAAA,QACpC,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IAAA;AAEF,WAAO,IAAI,WAAW;AAAA,MACrB,CAAC,eAAe,GAAG,GAAG;AAAA,IAAA,CACtB;AAAA,EAAA;AAEH;"}

package/dist/production/src/model/service/PasswordStrengthValidator.cjs

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const blacklist = require("../utils/blacklist.cjs");
+const Response = require("../utils/Response.cjs");
+class PasswordStrengthValidator {
+  async verify(password, passwordConfig, errorCode) {
+    const failureReasons = [];
+    const developerMessage = [];
+    if (password.length < passwordConfig.minLength) {
+      failureReasons.push("TOO_SHORT");
+      developerMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`);
+    }
+    if (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {
+      failureReasons.push("MISSING_UPPERCASE");
+      developerMessage.push(`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? "s" : ""}.`);
+    }
+    if (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {
+      failureReasons.push("MISSING_LOWERCASE");
+      developerMessage.push(`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? "s" : ""}.`);
+    }
+    if (passwordConfig.requireDigit > 0 && (password.match(/\d/g) || []).length < passwordConfig.requireDigit) {
+      failureReasons.push("MISSING_DIGIT");
+      developerMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? "s" : ""}.`);
+    }
+    if (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {
+      failureReasons.push("MISSING_SPECIAL");
+      developerMessage.push(`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? "s" : ""}.`);
+    }
+    if (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {
+      failureReasons.push("INVALID_PATTERN");
+      developerMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`);
+    }
+    if (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {
+      failureReasons.push("BLACKLISTED");
+      developerMessage.push(`Password is blacklisted.`);
+    }
+    if (failureReasons.length > 0) {
+      return new Response.ResponseError(errorCode, developerMessage.join(" "), {
+        weakPasswordReasons: failureReasons
+      });
+    }
+    return new Response.ResponseOk(null);
+  }
+  isBlacklisted(password) {
+    return blacklist.blacklist.has(password) || blacklist.blacklist.has(this.decodeLeetspeak(password));
+  }
+  decodeLeetspeak(input) {
+    const leetspeakMap = {
+      "@": "a",
+      "$": "s",
+      "0": "o",
+      "1": "l",
+      "3": "e",
+      "7": "t",
+      "!": "i"
+    };
+    return input.split("").map((char) => {
+      return leetspeakMap[char] || char;
+    }).join("");
+  }
+}
+exports.PasswordStrengthValidator = PasswordStrengthValidator;
+//# sourceMappingURL=PasswordStrengthValidator.cjs.map

package/dist/production/src/model/service/PasswordStrengthValidator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordStrengthValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordStrengthValidator.ts"],"sourcesContent":["import { Config } from '../type/Config'\nimport { blacklist } from '../utils/blacklist'\nimport { WeakPasswordReason } from '../../schema'\nimport { ResponseError, Response, ResponseOk } from '../utils/Response'\n\nexport class PasswordStrengthValidator {\n\tpublic async verify<const Code extends string>(password: string, passwordConfig: Config['password'], errorCode: Code): Promise<ResponseOk<null> | ResponseError<Code, {\n\t\tweakPasswordReasons: WeakPasswordReason[]\n\t}>> {\n\t\tconst failureReasons: WeakPasswordReason[] = []\n\t\tconst developerMessage: string[] = []\n\n\t\tif (password.length < passwordConfig.minLength) {\n\t\t\tfailureReasons.push('TOO_SHORT')\n\t\t\tdeveloperMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {\n\t\t\tfailureReasons.push('MISSING_UPPERCASE')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {\n\t\t\tfailureReasons.push('MISSING_LOWERCASE')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireDigit > 0 && (password.match(/\\d/g) || []).length < passwordConfig.requireDigit) {\n\t\t\tfailureReasons.push('MISSING_DIGIT')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?\":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {\n\t\t\tfailureReasons.push('MISSING_SPECIAL')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {\n\t\t\tfailureReasons.push('INVALID_PATTERN')\n\t\t\tdeveloperMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`)\n\t\t}\n\n\t\tif (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {\n\t\t\tfailureReasons.push('BLACKLISTED')\n\t\t\tdeveloperMessage.push(`Password is blacklisted.`)\n\t\t}\n\n\t\tif (failureReasons.length > 0) {\n\t\t\treturn new ResponseError(errorCode as any, developerMessage.join(' '), {\n\t\t\t\tweakPasswordReasons: failureReasons,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\n\tprivate isBlacklisted(password: string): boolean {\n\t\treturn blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password))\n\t}\n\n\tprivate decodeLeetspeak(input: string): string {\n\t\tconst leetspeakMap: { [key: string]: string } = {\n\t\t\t'@': 'a',\n\t\t\t'$': 's',\n\t\t\t'0': 'o',\n\t\t\t'1': 'l',\n\t\t\t'3': 'e',\n\t\t\t'7': 't',\n\t\t\t'!': 'i',\n\t\t}\n\t\treturn input\n\t\t\t.split('')\n\t\t\t.map(char => {\n\t\t\t\treturn leetspeakMap[char] || char\n\t\t\t})\n\t\t\t.join('')\n\t}\n}\n\nnamespace PasswordStrengthValidator {\n\texport type Result =\n\t\t| { ok: true }\n\t\t| { ok: false; reasons: WeakPasswordReason[]; message: string }\n}\n\n"],"names":["ResponseError","ResponseOk","blacklist"],"mappings":";;;;AAKO,MAAM,0BAA0B;AAAA,EACtC,MAAa,OAAkC,UAAkB,gBAAoC,WAEjG;AACH,UAAM,iBAAuC,CAAC;AAC9C,UAAM,mBAA6B,CAAC;AAEhC,QAAA,SAAS,SAAS,eAAe,WAAW;AAC/C,qBAAe,KAAK,WAAW;AAC/B,uBAAiB,KAAK,4CAA4C,eAAe,SAAS,GAAG;AAAA,IAAA;AAG1F,QAAA,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,GAAG,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACtB,uBAAA,KAAK,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE,GAAG;AAAA,IAAA;AAGzJ,QAAA,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,GAAG,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACtB,uBAAA,KAAK,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE,GAAG;AAAA,IAAA;AAGzJ,QAAA,eAAe,eAAe,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC,GAAG,SAAS,eAAe,cAAc;AAC1G,qBAAe,KAAK,eAAe;AAClB,uBAAA,KAAK,kCAAkC,eAAe,YAAY,SAAS,eAAe,eAAe,IAAI,MAAM,EAAE,GAAG;AAAA,IAAA;AAGtI,QAAA,eAAe,iBAAiB,MAAM,SAAS,MAAM,yBAAyB,KAAK,CAAC,GAAG,SAAS,eAAe,gBAAgB;AAClI,qBAAe,KAAK,iBAAiB;AACpB,uBAAA,KAAK,kCAAkC,eAAe,cAAc,qBAAqB,eAAe,iBAAiB,IAAI,MAAM,EAAE,GAAG;AAAA,IAAA;AAGtJ,QAAA,eAAe,WAAW,CAAC,IAAI,OAAO,eAAe,OAAO,EAAE,KAAK,QAAQ,GAAG;AACjF,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB,KAAK,iDAAiD,eAAe,OAAO,GAAG;AAAA,IAAA;AAGjG,QAAI,eAAe,kBAAkB,KAAK,cAAc,SAAS,YAAA,CAAa,GAAG;AAChF,qBAAe,KAAK,aAAa;AACjC,uBAAiB,KAAK,0BAA0B;AAAA,IAAA;AAG7C,QAAA,eAAe,SAAS,GAAG;AAC9B,aAAO,IAAIA,SAAc,cAAA,WAAkB,iBAAiB,KAAK,GAAG,GAAG;AAAA,QACtE,qBAAqB;AAAA,MAAA,CACrB;AAAA,IAAA;AAEK,WAAA,IAAIC,oBAAW,IAAI;AAAA,EAAA;AAAA,EAInB,cAAc,UAA2B;AACzC,WAAAC,UAAA,UAAU,IAAI,QAAQ,KAAKA,UAAAA,UAAU,IAAI,KAAK,gBAAgB,QAAQ,CAAC;AAAA,EAAA;AAAA,EAGvE,gBAAgB,OAAuB;AAC9C,UAAM,eAA0C;AAAA,MAC/C,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACN;AACA,WAAO,MACL,MAAM,EAAE,EACR,IAAI,CAAQ,SAAA;AACL,aAAA,aAAa,IAAI,KAAK;AAAA,IAAA,CAC7B,EACA,KAAK,EAAE;AAAA,EAAA;AAEX;;"}

package/dist/production/src/model/service/PasswordStrengthValidator.js

@@ -0,0 +1,63 @@
+import { blacklist } from "../utils/blacklist.js";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+class PasswordStrengthValidator {
+  async verify(password, passwordConfig, errorCode) {
+    const failureReasons = [];
+    const developerMessage = [];
+    if (password.length < passwordConfig.minLength) {
+      failureReasons.push("TOO_SHORT");
+      developerMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`);
+    }
+    if (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {
+      failureReasons.push("MISSING_UPPERCASE");
+      developerMessage.push(`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? "s" : ""}.`);
+    }
+    if (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {
+      failureReasons.push("MISSING_LOWERCASE");
+      developerMessage.push(`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? "s" : ""}.`);
+    }
+    if (passwordConfig.requireDigit > 0 && (password.match(/\d/g) || []).length < passwordConfig.requireDigit) {
+      failureReasons.push("MISSING_DIGIT");
+      developerMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? "s" : ""}.`);
+    }
+    if (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {
+      failureReasons.push("MISSING_SPECIAL");
+      developerMessage.push(`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? "s" : ""}.`);
+    }
+    if (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {
+      failureReasons.push("INVALID_PATTERN");
+      developerMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`);
+    }
+    if (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {
+      failureReasons.push("BLACKLISTED");
+      developerMessage.push(`Password is blacklisted.`);
+    }
+    if (failureReasons.length > 0) {
+      return new ResponseError(errorCode, developerMessage.join(" "), {
+        weakPasswordReasons: failureReasons
+      });
+    }
+    return new ResponseOk(null);
+  }
+  isBlacklisted(password) {
+    return blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password));
+  }
+  decodeLeetspeak(input) {
+    const leetspeakMap = {
+      "@": "a",
+      "$": "s",
+      "0": "o",
+      "1": "l",
+      "3": "e",
+      "7": "t",
+      "!": "i"
+    };
+    return input.split("").map((char) => {
+      return leetspeakMap[char] || char;
+    }).join("");
+  }
+}
+export {
+  PasswordStrengthValidator
+};
+//# sourceMappingURL=PasswordStrengthValidator.js.map

package/dist/production/src/model/service/PasswordStrengthValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordStrengthValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordStrengthValidator.ts"],"sourcesContent":["import { Config } from '../type/Config'\nimport { blacklist } from '../utils/blacklist'\nimport { WeakPasswordReason } from '../../schema'\nimport { ResponseError, Response, ResponseOk } from '../utils/Response'\n\nexport class PasswordStrengthValidator {\n\tpublic async verify<const Code extends string>(password: string, passwordConfig: Config['password'], errorCode: Code): Promise<ResponseOk<null> | ResponseError<Code, {\n\t\tweakPasswordReasons: WeakPasswordReason[]\n\t}>> {\n\t\tconst failureReasons: WeakPasswordReason[] = []\n\t\tconst developerMessage: string[] = []\n\n\t\tif (password.length < passwordConfig.minLength) {\n\t\t\tfailureReasons.push('TOO_SHORT')\n\t\t\tdeveloperMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {\n\t\t\tfailureReasons.push('MISSING_UPPERCASE')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {\n\t\t\tfailureReasons.push('MISSING_LOWERCASE')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireDigit > 0 && (password.match(/\\d/g) || []).length < passwordConfig.requireDigit) {\n\t\t\tfailureReasons.push('MISSING_DIGIT')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?\":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {\n\t\t\tfailureReasons.push('MISSING_SPECIAL')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {\n\t\t\tfailureReasons.push('INVALID_PATTERN')\n\t\t\tdeveloperMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`)\n\t\t}\n\n\t\tif (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {\n\t\t\tfailureReasons.push('BLACKLISTED')\n\t\t\tdeveloperMessage.push(`Password is blacklisted.`)\n\t\t}\n\n\t\tif (failureReasons.length > 0) {\n\t\t\treturn new ResponseError(errorCode as any, developerMessage.join(' '), {\n\t\t\t\tweakPasswordReasons: failureReasons,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\n\tprivate isBlacklisted(password: string): boolean {\n\t\treturn blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password))\n\t}\n\n\tprivate decodeLeetspeak(input: string): string {\n\t\tconst leetspeakMap: { [key: string]: string } = {\n\t\t\t'@': 'a',\n\t\t\t'$': 's',\n\t\t\t'0': 'o',\n\t\t\t'1': 'l',\n\t\t\t'3': 'e',\n\t\t\t'7': 't',\n\t\t\t'!': 'i',\n\t\t}\n\t\treturn input\n\t\t\t.split('')\n\t\t\t.map(char => {\n\t\t\t\treturn leetspeakMap[char] || char\n\t\t\t})\n\t\t\t.join('')\n\t}\n}\n\nnamespace PasswordStrengthValidator {\n\texport type Result =\n\t\t| { ok: true }\n\t\t| { ok: false; reasons: WeakPasswordReason[]; message: string }\n}\n\n"],"names":[],"mappings":";;AAKO,MAAM,0BAA0B;AAAA,EACtC,MAAa,OAAkC,UAAkB,gBAAoC,WAEjG;AACH,UAAM,iBAAuC,CAAC;AAC9C,UAAM,mBAA6B,CAAC;AAEhC,QAAA,SAAS,SAAS,eAAe,WAAW;AAC/C,qBAAe,KAAK,WAAW;AAC/B,uBAAiB,KAAK,4CAA4C,eAAe,SAAS,GAAG;AAAA,IAAA;AAG1F,QAAA,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,GAAG,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACtB,uBAAA,KAAK,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE,GAAG;AAAA,IAAA;AAGzJ,QAAA,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,GAAG,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACtB,uBAAA,KAAK,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE,GAAG;AAAA,IAAA;AAGzJ,QAAA,eAAe,eAAe,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC,GAAG,SAAS,eAAe,cAAc;AAC1G,qBAAe,KAAK,eAAe;AAClB,uBAAA,KAAK,kCAAkC,eAAe,YAAY,SAAS,eAAe,eAAe,IAAI,MAAM,EAAE,GAAG;AAAA,IAAA;AAGtI,QAAA,eAAe,iBAAiB,MAAM,SAAS,MAAM,yBAAyB,KAAK,CAAC,GAAG,SAAS,eAAe,gBAAgB;AAClI,qBAAe,KAAK,iBAAiB;AACpB,uBAAA,KAAK,kCAAkC,eAAe,cAAc,qBAAqB,eAAe,iBAAiB,IAAI,MAAM,EAAE,GAAG;AAAA,IAAA;AAGtJ,QAAA,eAAe,WAAW,CAAC,IAAI,OAAO,eAAe,OAAO,EAAE,KAAK,QAAQ,GAAG;AACjF,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB,KAAK,iDAAiD,eAAe,OAAO,GAAG;AAAA,IAAA;AAGjG,QAAI,eAAe,kBAAkB,KAAK,cAAc,SAAS,YAAA,CAAa,GAAG;AAChF,qBAAe,KAAK,aAAa;AACjC,uBAAiB,KAAK,0BAA0B;AAAA,IAAA;AAG7C,QAAA,eAAe,SAAS,GAAG;AAC9B,aAAO,IAAI,cAAc,WAAkB,iBAAiB,KAAK,GAAG,GAAG;AAAA,QACtE,qBAAqB;AAAA,MAAA,CACrB;AAAA,IAAA;AAEK,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAAA,EAInB,cAAc,UAA2B;AACzC,WAAA,UAAU,IAAI,QAAQ,KAAK,UAAU,IAAI,KAAK,gBAAgB,QAAQ,CAAC;AAAA,EAAA;AAAA,EAGvE,gBAAgB,OAAuB;AAC9C,UAAM,eAA0C;AAAA,MAC/C,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACN;AACA,WAAO,MACL,MAAM,EAAE,EACR,IAAI,CAAQ,SAAA;AACL,aAAA,aAAa,IAAI,KAAK;AAAA,IAAA,CAC7B,EACA,KAAK,EAAE;AAAA,EAAA;AAEX;"}