@contember/engine-tenant-api 2.1.0-alpha.9 → 2.1.0-beta.2

package/src/model/service/AuthLogService.ts

@@ -0,0 +1,64 @@
+import { DatabaseContext } from '../utils'
+import { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand'
+import { Response } from '../utils/Response'
+import { AuthActionType } from '../type/AuthLog'
+
+class AuthLogService {
+	async logAuthAction(
+		db: DatabaseContext,
+		ctx: { identityId: string; clientIp?: string; userAgent?: string },
+		data: AuthLogService.LogArgs,
+	): Promise<void> {
+		const dataContainer = data.response.ok
+			? data.response.result ?? {}
+			: data.response.metadata ?? {}
+		const authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer
+			? dataContainer[AuthLogService.Key] as AuthLogService.Bag
+			: undefined
+
+		await db.commandBus.execute(
+			new CreateAuthLogEntryCommand({
+				success: data.response.ok,
+				personInputIdentifier: data.personInput ?? authData?.data?.personInput,
+				personId: data.personId ?? authData?.data?.personId,
+				invokedById: ctx.identityId,
+				type: data.type,
+				identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
+				errorCode: data.response.ok ? null : data.response.error,
+				personTokenId: data.tokenId ?? authData?.data?.tokenId,
+				errorMessage: data.response.ok ? undefined : data.response.errorMessage,
+				ipAddress: ctx.clientIp,
+				userAgent: ctx.userAgent,
+				metadata: {},
+			}),
+		)
+	}
+}
+
+namespace AuthLogService {
+	export const Key = Symbol('AuthLogData')
+	type Data = {
+		personId?: string
+		personInput?: string // e.g. email
+		tokenId?: string
+		identityProviderId?: string
+	}
+
+	export type LogArgs = {
+		response: Response<
+			null | { [Key]?: Bag },
+			any,
+			{} | { [Key]?: Bag }
+		>
+		type: AuthActionType
+	} & Data
+
+	export class Bag {
+		constructor(
+			public readonly data: Data,
+		) {
+		}
+	}
+}
+
+export { AuthLogService }

package/src/model/service/ConfigurationManager.ts

@@ -1,13 +1,9 @@
-import { Config, ConfigInput, ConfigureErrorCode } from '../../schema'
+import { ConfigInput, ConfigureErrorCode } from '../../schema'
 import { Response, ResponseOk } from '../utils/Response'
 import { DatabaseContext } from '../utils'
 import { UpdateConfigurationCommand } from '../commands'
-import { ConfigurationQuery } from '../queries'
 
 export class ConfigurationManager {
-	constructor() {
-	}
-
 	public async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {
 		// todo: validate configuration
 
@@ -15,8 +11,4 @@ export class ConfigurationManager {
 
 		return new ResponseOk(null)
 	}
-
-	public async fetchConfiguration(db: DatabaseContext): Promise<Config> {
-		return await db.queryHandler.fetch(new ConfigurationQuery())
-	}
 }

package/src/model/service/EmailValidator.ts

@@ -4,7 +4,6 @@ import { ResponseError } from '../utils/Response'
 import { PersonQuery } from '../queries'
 
 export class EmailValidator {
-
 	public async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {
 		if (!validateEmail(email.trim())) {
 			return new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')

package/src/model/service/IDPSignInManager.ts

@@ -1,6 +1,6 @@
 import { ApiKeyManager } from './apiKey'
 import { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries'
-import { IDPResponse, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'
+import { IDPHandlerRegistry, IDPResponse, IDPResponseError, IDPValidationError } from './idp'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema'
 import { DatabaseContext } from '../utils'
@@ -8,6 +8,7 @@ import { CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProvide
 import { TenantRole } from '../authorization'
 import { NoPassword } from '../dtos'
 import { IdentityProviderRow } from '../queries/idp/types'
+import { AuthLogService } from './AuthLogService'
 
 class IDPSignInManager {
 	constructor(
@@ -36,25 +37,56 @@ class IDPSignInManager {
 				)
 			} catch (e) {
 				if (e instanceof IDPResponseError) {
-					return new ResponseError('INVALID_IDP_RESPONSE', e.message)
+					return new ResponseError('INVALID_IDP_RESPONSE', e.message, {
+						[AuthLogService.Key]: new AuthLogService.Bag({
+							personId: undefined,
+							identityProviderId: provider.id,
+						}),
+					})
 				}
 				if (e instanceof IDPValidationError) {
-					return new ResponseError('IDP_VALIDATION_FAILED', e.message)
+					return new ResponseError('IDP_VALIDATION_FAILED', e.message, {
+						[AuthLogService.Key]: new AuthLogService.Bag({
+							personId: undefined,
+							identityProviderId: provider.id,
+						}),
+					})
 				}
 				throw e
 			}
 			const personRow = await this.resolvePerson(db, claim, provider)
 
 			if (!personRow) {
-				return new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`)
+				return new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						identityProviderId: provider.id,
+						personInput: claim.email,
+						personId: undefined,
+					}),
+				})
 			}
 
 			if (personRow.disabled_at !== null) {
-				return new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`)
+				return new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						identityProviderId: provider.id,
+						personInput: claim.email,
+						personId: personRow.id,
+					}),
+				})
 			}
 
 			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
-			return new ResponseOk({ person: personRow, token: sessionToken, idpResponse: claim })
+			return new ResponseOk({
+				person: personRow,
+				token: sessionToken,
+				idpResponse: claim,
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personId: personRow.id,
+					identityProviderId: provider.id,
+					personInput: claim.email,
+				}),
+			})
 		})
 	}
 
@@ -111,13 +143,15 @@ class IDPSignInManager {
 	private async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {
 		const roles = [TenantRole.PERSON]
 		const identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))
-		const newPerson = await db.commandBus.execute(new CreatePersonCommand({
-			identityId,
-			email: provider.exclusive ? undefined : email,
-			password: NoPassword,
-			name: name ?? email?.split('@')[0] ?? externalIdentifier,
-			idpOnly: provider.exclusive,
-		}))
+		const newPerson = await db.commandBus.execute(
+			new CreatePersonCommand({
+				identityId,
+				email: provider.exclusive ? undefined : email,
+				password: NoPassword,
+				name: name ?? email?.split('@')[0] ?? externalIdentifier,
+				idpOnly: provider.exclusive,
+			}),
+		)
 
 		return {
 			...newPerson,
@@ -137,9 +171,12 @@ namespace IDPSignInManager {
 		readonly person: PersonRow
 		readonly token: string
 		readonly idpResponse?: Record<string, unknown>
+		[AuthLogService.Key]: AuthLogService.Bag
 	}
 
-	export type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode>
+	export type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode, {
+		[AuthLogService.Key]: AuthLogService.Bag
+	}>
 }
 
 export { IDPSignInManager }

package/src/model/service/InviteManager.ts

@@ -36,7 +36,7 @@ export class InviteManager {
 		private readonly providers: Providers,
 		private readonly mailer: UserMailer,
 		private readonly projectSchemaResolver: ProjectSchemaResolver,
-	) { }
+	) {}
 
 	async invite(
 		dbContext: DatabaseContext,
@@ -64,22 +64,28 @@ export class InviteManager {
 			if (!person) {
 				const identityId = await trx.commandBus.execute(new CreateIdentityCommand([TenantRole.PERSON]))
 
-				generatedPassword = password ??
-					(method === 'CREATE_PASSWORD' ? (await this.providers.randomBytes(9)).toString('base64') : null)
+				generatedPassword = password
+					?? (method === 'CREATE_PASSWORD' ? (await this.providers.randomBytes(9)).toString('base64') : null)
 				const passwordWrapper = generatedPassword !== null ? new PasswordPlain(generatedPassword) : NoPassword
 
-				person = await trx.commandBus.execute(new CreatePersonCommand({
-					identityId,
-					email,
-					name,
-					password: passwordWrapper,
-				}))
+				person = await trx.commandBus.execute(
+					new CreatePersonCommand({
+						identityId,
+						email,
+						name,
+						password: passwordWrapper,
+					}),
+				)
 				if (method === 'RESET_PASSWORD') {
-					const result = await trx.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug)))
+					const result = await trx.commandBus.execute(
+						CreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug)),
+					)
 					resetToken = result.token
 				}
 				if (passwordResetTokenHash) {
-					await trx.commandBus.execute(new SavePersonTokenCommand(person.id, passwordResetTokenHash, 'password_reset', await this.getInviteExpiration(project.slug)))
+					await trx.commandBus.execute(
+						new SavePersonTokenCommand(person.id, passwordResetTokenHash, 'password_reset', await this.getInviteExpiration(project.slug)),
+					)
 				}
 			}
 			for (const membershipUpdate of createAppendMembershipVariables(memberships)) {
@@ -114,5 +120,5 @@ export class InviteManager {
 export type InviteResponse = Response<InviteResult, InviteErrorCode>
 
 export class InviteResult {
-	constructor(public readonly person: Omit<PersonRow, 'roles'>, public readonly isNew: boolean) { }
+	constructor(public readonly person: Omit<PersonRow, 'roles'>, public readonly isNew: boolean) {}
 }

package/src/model/service/MembershipValidator.ts

@@ -1,5 +1,5 @@
 import { ProjectSchemaResolver } from '../type'
-import { MembershipValidationError, MembershipValidationErrorType, MembershipResolver } from '@contember/schema-utils'
+import { MembershipResolver, MembershipValidationError, MembershipValidationErrorType } from '@contember/schema-utils'
 import { Acl } from '@contember/schema'
 
 export class MembershipValidator {
@@ -13,7 +13,7 @@ export class MembershipValidator {
 		if (!schema) {
 			throw new Error()
 		}
-		return this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity).errors
+		return this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors
 	}
 }
 

package/src/model/service/OtpAuthenticator.ts

@@ -47,6 +47,6 @@ export class OtpAuthenticator {
 }
 
 type SecretLike = { uri: string } | { secret: string }
-const getSecret = function (otp: SecretLike): Secret {
+const getSecret = function(otp: SecretLike): Secret {
 	return 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)
 }

package/src/model/service/OtpManager.ts

@@ -31,7 +31,4 @@ export class OtpManager {
 }
 
 export class OtpError extends Error {
-	constructor(message?: string) {
-		super(message)
-	}
 }

package/src/model/service/PasswordChangeManager.ts

@@ -1,29 +1,41 @@
-import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode } from '../../schema'
+import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema'
 import { ChangePasswordCommand } from '../commands'
-import { getPasswordWeaknessMessage } from '../utils/password'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
-import { PersonRow } from '../queries'
+import { ConfigurationQuery, PersonRow } from '../queries'
 import { Providers } from '../providers'
 import { DatabaseContext } from '../utils'
+import { PasswordStrengthValidator } from './PasswordStrengthValidator'
 
 class PasswordChangeManager {
 	constructor(
 		private readonly providers: Providers,
+		private readonly passwordStrengthVerifier: PasswordStrengthValidator,
 	) {}
 
-	async changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {
-		const weakPassword = getPasswordWeaknessMessage(password)
-		if (weakPassword) {
-			return new ResponseError('TOO_WEAK', weakPassword)
+	async changePassword(
+		dbContext: DatabaseContext,
+		person: PersonRow,
+		password: string,
+	): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {
+		const config = await dbContext.queryHandler.fetch(new ConfigurationQuery())
+		const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')
+		if (!passwordVerifyResult.ok) {
+			return passwordVerifyResult
 		}
-		await dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))
+		await dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))
 		return new ResponseOk(null)
 	}
 
-	async changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {
-		const weakPassword = getPasswordWeaknessMessage(password)
-		if (weakPassword) {
-			return new ResponseError('TOO_WEAK', weakPassword)
+	async changeMyPassword(
+		dbContext: DatabaseContext,
+		person: PersonRow,
+		currentPassword: string,
+		password: string,
+	): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {
+		const config = await dbContext.queryHandler.fetch(new ConfigurationQuery())
+		const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')
+		if (!passwordVerifyResult.ok) {
+			return passwordVerifyResult
 		}
 		if (!person.password_hash) {
 			return new ResponseError('NO_PASSWORD_SET', 'No password set')
@@ -38,7 +50,9 @@ class PasswordChangeManager {
 }
 
 namespace PasswordChangeManager {
-	export type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T>
+	export type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {
+		weakPasswordReasons?: WeakPasswordReason[]
+	}>
 }
 
 export { PasswordChangeManager }

package/src/model/service/PasswordResetManager.ts

@@ -1,13 +1,16 @@
-import { Response, ResponseError } from '../utils/Response'
-import { getPasswordWeaknessMessage } from '../utils/password'
+import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { UserMailer } from '../mailing'
-import { PersonRow } from '../queries'
+import { ConfigurationQuery, PersonRow } from '../queries'
 import { PermissionContext } from '../authorization'
 import { ProjectManager } from './ProjectManager'
 import { DatabaseContext } from '../utils'
 import { ImplementationException } from '../../exceptions'
 import { getPreferredProject } from './helpers/getPreferredProject'
-import { CreatePersonTokenCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands/personToken'
+import { CreatePersonTokenCommand, ResetPasswordCommand } from '../commands/personToken'
+import { PasswordStrengthValidator } from './PasswordStrengthValidator'
+import { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema'
+import { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'
+import { AuthLogService } from './AuthLogService'
 
 interface MailOptions {
 	project?: string
@@ -18,7 +21,8 @@ export class PasswordResetManager {
 	constructor(
 		private readonly mailer: UserMailer,
 		private readonly projectManager: ProjectManager,
-	) { }
+		private readonly passwordStrengthValidator: PasswordStrengthValidator,
+	) {}
 
 	public async createPasswordResetRequest(
 		dbContext: DatabaseContext,
@@ -49,14 +53,45 @@ export class PasswordResetManager {
 	}
 
 	public async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {
-		const weakPassword = getPasswordWeaknessMessage(password)
-		if (weakPassword) {
-			return new ResponseError('PASSWORD_TOO_WEAK', weakPassword)
+		const config = await dbContext.queryHandler.fetch(new ConfigurationQuery())
+		const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'password_reset'))
+		if (!tokenRow) {
+			return new ResponseError('TOKEN_NOT_FOUND', 'Token not found', {
+				[AuthLogService.Key]: new AuthLogService.Bag({}),
+			})
 		}
-		return await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))
+
+		const authLogData = new AuthLogService.Bag({
+			personId: tokenRow.person_id,
+			tokenId: tokenRow.id,
+		})
+		const weakPassword = await this.passwordStrengthValidator.verify(password, config.password, 'PASSWORD_TOO_WEAK')
+		if (!weakPassword.ok) {
+			return new ResponseError(weakPassword.error, weakPassword.errorMessage, {
+				...weakPassword.metadata ?? {},
+				[AuthLogService.Key]: authLogData,
+			})
+		}
+		const resetPasswordResult = await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))
+		if (!resetPasswordResult.ok) {
+			return new ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {
+				...resetPasswordResult.metadata ?? {},
+				[AuthLogService.Key]: authLogData,
+			})
+		}
+		return new ResponseOk({
+			[AuthLogService.Key]: authLogData,
+		})
 	}
 }
 
-export type ResetPasswordErrorCode = 'PASSWORD_TOO_WEAK'
-
-export type ResetPasswordResponse = Response<null, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>
+export type ResetPasswordResponse = Response<
+	{
+		[AuthLogService.Key]: AuthLogService.Bag
+	},
+	ResetPasswordErrorCode,
+	{
+		weakPasswordReasons?: WeakPasswordReason[]
+		[AuthLogService.Key]: AuthLogService.Bag
+	}
+>

package/src/model/service/PasswordStrengthValidator.ts

@@ -0,0 +1,96 @@
+import { Config } from '../type/Config'
+import { blacklist } from '../utils/blacklist'
+import { WeakPasswordReason } from '../../schema'
+import { Response, ResponseError, ResponseOk } from '../utils/Response'
+
+export class PasswordStrengthValidator {
+	public async verify<const Code extends string>(
+		password: string,
+		passwordConfig: Config['password'],
+		errorCode: Code,
+	): Promise<
+		| ResponseOk<null>
+		| ResponseError<Code, {
+			weakPasswordReasons: WeakPasswordReason[]
+		}>
+	> {
+		const failureReasons: WeakPasswordReason[] = []
+		const developerMessage: string[] = []
+
+		if (password.length < passwordConfig.minLength) {
+			failureReasons.push('TOO_SHORT')
+			developerMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`)
+		}
+
+		if (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {
+			failureReasons.push('MISSING_UPPERCASE')
+			developerMessage.push(
+				`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? 's' : ''}.`,
+			)
+		}
+
+		if (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {
+			failureReasons.push('MISSING_LOWERCASE')
+			developerMessage.push(
+				`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? 's' : ''}.`,
+			)
+		}
+
+		if (passwordConfig.requireDigit > 0 && (password.match(/\d/g) || []).length < passwordConfig.requireDigit) {
+			failureReasons.push('MISSING_DIGIT')
+			developerMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? 's' : ''}.`)
+		}
+
+		if (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {
+			failureReasons.push('MISSING_SPECIAL')
+			developerMessage.push(
+				`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? 's' : ''}.`,
+			)
+		}
+
+		if (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {
+			failureReasons.push('INVALID_PATTERN')
+			developerMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`)
+		}
+
+		if (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {
+			failureReasons.push('BLACKLISTED')
+			developerMessage.push(`Password is blacklisted.`)
+		}
+
+		if (failureReasons.length > 0) {
+			return new ResponseError(errorCode as any, developerMessage.join(' '), {
+				weakPasswordReasons: failureReasons,
+			})
+		}
+		return new ResponseOk(null)
+	}
+
+	private isBlacklisted(password: string): boolean {
+		return blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password))
+	}
+
+	private decodeLeetspeak(input: string): string {
+		const leetspeakMap: { [key: string]: string } = {
+			'@': 'a',
+			'$': 's',
+			'0': 'o',
+			'1': 'l',
+			'3': 'e',
+			'7': 't',
+			'!': 'i',
+		}
+		return input
+			.split('')
+			.map(char => {
+				return leetspeakMap[char] || char
+			})
+			.join('')
+	}
+}
+
+namespace PasswordStrengthValidator {
+	export type Result =
+		| { ok: true }
+		| { ok: false; reasons: WeakPasswordReason[]; message: string }
+}