@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/model/service/OtpManager.js

@@ -4,26 +4,76 @@ import "node:crypto";
 import { ConfirmOtpCommand } from "../commands/otp/ConfirmOtpCommand.js";
 import { DisableOtpCommand } from "../commands/otp/DisableOtpCommand.js";
 import { PrepareOtpCommand } from "../commands/otp/PrepareOtpCommand.js";
+import { ReEncryptOtpSecretCommand } from "../commands/otp/ReEncryptOtpSecretCommand.js";
+import { URI } from "otpauth";
 class OtpManager {
-  constructor(otpAuthenticator) {
+  constructor(otpAuthenticator, providers) {
     this.otpAuthenticator = otpAuthenticator;
+    this.providers = providers;
   }
   async prepareOtp(dbContext, person, label) {
     const otp = await this.otpAuthenticator.create(person.email ?? person.name ?? "unnamed", label);
-    await dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri));
+    if (this.providers.encryptionEnabled) {
+      const encrypted = await this.providers.encrypt(Buffer.from(otp.secret, "utf8"));
+      await dbContext.commandBus.execute(new PrepareOtpCommand(person.id, encrypted.value, encrypted.version));
+    } else {
+      await dbContext.commandBus.execute(new PrepareOtpCommand(person.id, Buffer.from(otp.uri, "utf8"), 0));
+    }
     return otp;
   }
+  /** Promotes the pending TOTP secret to active. Returns false if there was no pending secret to promote (e.g. a lost concurrent confirm). */
   async confirmOtp(dbContext, person) {
-    await dbContext.commandBus.execute(new ConfirmOtpCommand(person.id));
+    return await dbContext.commandBus.execute(new ConfirmOtpCommand(person.id));
   }
   async disableOtp(dbContext, person) {
     await dbContext.commandBus.execute(new DisableOtpCommand(person.id));
   }
-  verifyOtp(person, token) {
-    if (!person.otp_uri) {
+  /** Verifies a token against the person's *active* TOTP secret. */
+  async verifyOtp(dbContext, person, token) {
+    const resolved = await this.resolveSecret(person.otp_secret, person.otp_secret_version);
+    const valid = this.otpAuthenticator.validate(resolved.secretLike, token);
+    if (valid && resolved.reEncrypt) {
+      try {
+        const { oldVersion, base32 } = resolved.reEncrypt;
+        const encrypted = await this.providers.encrypt(Buffer.from(base32, "utf8"));
+        await dbContext.commandBus.execute(
+          new ReEncryptOtpSecretCommand(person.id, encrypted.value, encrypted.version, oldVersion)
+        );
+      } catch {
+      }
+    }
+    return valid;
+  }
+  /** Verifies a token against the person's *pending* TOTP secret (used during enrollment). */
+  async verifyPendingOtp(person, token) {
+    const resolved = await this.resolveSecret(person.otp_pending_secret, person.otp_pending_version);
+    return this.otpAuthenticator.validate(resolved.secretLike, token);
+  }
+  /**
+   * Resolves the stored secret bytes into something the authenticator understands.
+   * Version 0 = legacy plaintext otpauth URI. Version >= 1 = encrypted base32 secret.
+   *
+   * Also surfaces whether the active secret warrants opportunistic re-encryption:
+   * version-0 (legacy plaintext) always does; version>=1 does when the encryption
+   * layer signals the key has rotated (`needsReEncrypt`).
+   */
+  async resolveSecret(secret, version) {
+    if (!secret || version === null) {
       throw new OtpError("not configured");
     }
-    return this.otpAuthenticator.validate({ uri: person.otp_uri }, token);
+    if (version === 0) {
+      const uri = secret.toString("utf8");
+      return {
+        secretLike: { uri },
+        reEncrypt: { oldVersion: 0, base32: URI.parse(uri).secret.base32 }
+      };
+    }
+    const decrypted = await this.providers.decrypt(secret, version);
+    const base32 = decrypted.value.toString("utf8");
+    return {
+      secretLike: { secret: base32 },
+      ...decrypted.needsReEncrypt ? { reEncrypt: { oldVersion: version, base32 } } : {}
+    };
   }
 }
 class OtpError extends Error {

package/dist/production/src/model/service/OtpManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n}\n"],"names":[],"mappings":";;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAChG,UAAM,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AAC9F,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AAC5E,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,UAAU,QAAmB,OAAwB;AACpD,QAAI,CAAC,OAAO,SAAS;AACpB,YAAM,IAAI,SAAS,gBAAgB;AAAA,IACpC;AACA,WAAO,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,QAAA,GAAW,KAAK;AAAA,EACrE;AACD;AAEO,MAAM,iBAAiB,MAAM;AACpC;"}
+{"version":3,"file":"OtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries/index.js'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand, ReEncryptOtpSecretCommand } from '../commands/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator.js'\nimport { Providers } from '../providers.js'\nimport { URI } from 'otpauth'\n\ntype SecretLike = { uri: string } | { secret: string }\n\n/**\n * Result of resolving a stored secret: the material the authenticator can\n * validate against, plus (optionally) the base32 secret and the version it was\n * stored under, so a successful verify can opportunistically re-encrypt it.\n */\ntype ResolvedSecret = {\n\tsecretLike: SecretLike\n\t/** Set when the active secret should be re-encrypted after a successful verify. */\n\treEncrypt?: { oldVersion: number; base32: string }\n}\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t\tprivate readonly providers: Pick<Providers, 'decrypt' | 'encrypt' | 'encryptionEnabled'>,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tif (this.providers.encryptionEnabled) {\n\t\t\t// A key is configured: store the base32 secret encrypted (version >= 1).\n\t\t\tconst encrypted = await this.providers.encrypt(Buffer.from(otp.secret, 'utf8'))\n\t\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, encrypted.value, encrypted.version))\n\t\t} else {\n\t\t\t// No key: store the plaintext otpauth URI as version 0, exactly like legacy\n\t\t\t// (pre-encryption) secrets. Opportunistic re-encryption upgrades it once a key\n\t\t\t// becomes available.\n\t\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, Buffer.from(otp.uri, 'utf8'), 0))\n\t\t}\n\t\treturn otp\n\t}\n\n\t/** Promotes the pending TOTP secret to active. Returns false if there was no pending secret to promote (e.g. a lost concurrent confirm). */\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\t/** Verifies a token against the person's *active* TOTP secret. */\n\tasync verifyOtp(dbContext: DatabaseContext, person: PersonRow, token: string): Promise<boolean> {\n\t\tconst resolved = await this.resolveSecret(person.otp_secret, person.otp_secret_version)\n\t\tconst valid = this.otpAuthenticator.validate(resolved.secretLike, token)\n\t\tif (valid && resolved.reEncrypt) {\n\t\t\t// Best-effort: re-encryption must never affect the verify result and any\n\t\t\t// failure (encrypt or update) is swallowed so the user still signs in.\n\t\t\ttry {\n\t\t\t\tconst { oldVersion, base32 } = resolved.reEncrypt\n\t\t\t\tconst encrypted = await this.providers.encrypt(Buffer.from(base32, 'utf8'))\n\t\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\t\tnew ReEncryptOtpSecretCommand(person.id, encrypted.value, encrypted.version, oldVersion),\n\t\t\t\t)\n\t\t\t} catch {\n\t\t\t\t// ignore — re-encryption is opportunistic\n\t\t\t}\n\t\t}\n\t\treturn valid\n\t}\n\n\t/** Verifies a token against the person's *pending* TOTP secret (used during enrollment). */\n\tasync verifyPendingOtp(person: PersonRow, token: string): Promise<boolean> {\n\t\tconst resolved = await this.resolveSecret(person.otp_pending_secret, person.otp_pending_version)\n\t\treturn this.otpAuthenticator.validate(resolved.secretLike, token)\n\t}\n\n\t/**\n\t * Resolves the stored secret bytes into something the authenticator understands.\n\t * Version 0 = legacy plaintext otpauth URI. Version >= 1 = encrypted base32 secret.\n\t *\n\t * Also surfaces whether the active secret warrants opportunistic re-encryption:\n\t * version-0 (legacy plaintext) always does; version>=1 does when the encryption\n\t * layer signals the key has rotated (`needsReEncrypt`).\n\t */\n\tprivate async resolveSecret(secret: Buffer | null, version: number | null): Promise<ResolvedSecret> {\n\t\tif (!secret || version === null) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\tif (version === 0) {\n\t\t\tconst uri = secret.toString('utf8')\n\t\t\treturn {\n\t\t\t\tsecretLike: { uri },\n\t\t\t\treEncrypt: { oldVersion: 0, base32: URI.parse(uri).secret.base32 },\n\t\t\t}\n\t\t}\n\t\tconst decrypted = await this.providers.decrypt(secret, version)\n\t\tconst base32 = decrypted.value.toString('utf8')\n\t\treturn {\n\t\t\tsecretLike: { secret: base32 },\n\t\t\t...(decrypted.needsReEncrypt ? { reEncrypt: { oldVersion: version, base32 } } : {}),\n\t\t}\n\t}\n}\n\nexport class OtpError extends Error {\n}\n"],"names":[],"mappings":";;;;;;;;AAoBO,MAAM,WAAW;AAAA,EACvB,YACkB,kBACA,WAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAChG,UAAM,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AAC9F,QAAI,KAAK,UAAU,mBAAmB;AAErC,YAAM,YAAY,MAAM,KAAK,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,MAAM,CAAC;AAC9E,YAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,IAAI,UAAU,OAAO,UAAU,OAAO,CAAC;AAAA,IACxG,OAAO;AAIN,YAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,IAAI,OAAO,KAAK,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC;AAAA,IACrG;AACA,WAAO;AAAA,EACR;AAAA;AAAA,EAGA,MAAM,WAAW,WAA4B,QAAqC;AACjF,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EAC3E;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA;AAAA,EAGA,MAAM,UAAU,WAA4B,QAAmB,OAAiC;AAC/F,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,YAAY,OAAO,kBAAkB;AACtF,UAAM,QAAQ,KAAK,iBAAiB,SAAS,SAAS,YAAY,KAAK;AACvE,QAAI,SAAS,SAAS,WAAW;AAGhC,UAAI;AACH,cAAM,EAAE,YAAY,OAAA,IAAW,SAAS;AACxC,cAAM,YAAY,MAAM,KAAK,UAAU,QAAQ,OAAO,KAAK,QAAQ,MAAM,CAAC;AAC1E,cAAM,UAAU,WAAW;AAAA,UAC1B,IAAI,0BAA0B,OAAO,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU;AAAA,QAAA;AAAA,MAEzF,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA;AAAA,EAGA,MAAM,iBAAiB,QAAmB,OAAiC;AAC1E,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,oBAAoB,OAAO,mBAAmB;AAC/F,WAAO,KAAK,iBAAiB,SAAS,SAAS,YAAY,KAAK;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,cAAc,QAAuB,SAAiD;AACnG,QAAI,CAAC,UAAU,YAAY,MAAM;AAChC,YAAM,IAAI,SAAS,gBAAgB;AAAA,IACpC;AACA,QAAI,YAAY,GAAG;AAClB,YAAM,MAAM,OAAO,SAAS,MAAM;AAClC,aAAO;AAAA,QACN,YAAY,EAAE,IAAA;AAAA,QACd,WAAW,EAAE,YAAY,GAAG,QAAQ,IAAI,MAAM,GAAG,EAAE,OAAO,OAAA;AAAA,MAAO;AAAA,IAEnE;AACA,UAAM,YAAY,MAAM,KAAK,UAAU,QAAQ,QAAQ,OAAO;AAC9D,UAAM,SAAS,UAAU,MAAM,SAAS,MAAM;AAC9C,WAAO;AAAA,MACN,YAAY,EAAE,QAAQ,OAAA;AAAA,MACtB,GAAI,UAAU,iBAAiB,EAAE,WAAW,EAAE,YAAY,SAAS,OAAA,MAAa,CAAA;AAAA,IAAC;AAAA,EAEnF;AACD;AAEO,MAAM,iBAAiB,MAAM;AACpC;"}

package/dist/production/src/model/service/PanelAccessResolver.cjs

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../type/ApiKey.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
+const AllProjectRolesByIdentityQuery = require("../queries/membership/AllProjectRolesByIdentityQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+class PanelAccessResolver {
+  constructor(providers) {
+    this.providers = providers;
+  }
+  async isAllowed(db, identityId, globalRoles) {
+    const config = await db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(this.providers));
+    const policy = config.panel;
+    if (policy.globalRoles.some((role) => globalRoles.includes(role))) {
+      return true;
+    }
+    if (policy.projectRoles.length === 0) {
+      return false;
+    }
+    const projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery.AllProjectRolesByIdentityQuery(identityId));
+    return projectRoles.some((it) => policy.projectRoles.includes(it.role));
+  }
+}
+exports.PanelAccessResolver = PanelAccessResolver;
+//# sourceMappingURL=PanelAccessResolver.cjs.map

package/dist/production/src/model/service/PanelAccessResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PanelAccessResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PanelAccessResolver.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { AllProjectRolesByIdentityQuery, ConfigurationQuery } from '../queries/index.js'\nimport { Providers } from '../providers.js'\n\n/**\n * Decides whether an identity may enter the management panel served by the engine.\n *\n * This is an **entry gate for the console, not an authorization system**: everything the panel shows\n * still goes through the tenant ACL, and whoever gets in could equally call `/tenant` directly. Its\n * job is to keep the console door shut for accounts that have no business there, so an admin surface\n * on a public API port does not look like a leak.\n *\n * An identity is allowed when it holds one of `globalRoles`, or a membership with one of\n * `projectRoles` in **any** project. Empty lists mean nobody.\n */\nexport class PanelAccessResolver {\n\tconstructor(private readonly providers: Providers) {}\n\n\tasync isAllowed(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<boolean> {\n\t\tconst config = await db.queryHandler.fetch(new ConfigurationQuery(this.providers))\n\t\tconst policy = config.panel\n\n\t\tif (policy.globalRoles.some(role => globalRoles.includes(role))) {\n\t\t\treturn true\n\t\t}\n\t\tif (policy.projectRoles.length === 0) {\n\t\t\treturn false\n\t\t}\n\t\tconst projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId))\n\t\treturn projectRoles.some(it => policy.projectRoles.includes(it.role))\n\t}\n}\n"],"names":["ConfigurationQuery","AllProjectRolesByIdentityQuery"],"mappings":";;;;;;;;;;;;;AAeO,MAAM,oBAAoB;AAAA,EAChC,YAA6B,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpD,MAAM,UAAU,IAAqB,YAAoB,aAAkD;AAC1G,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,IAAIA,mBAAAA,mBAAmB,KAAK,SAAS,CAAC;AACjF,UAAM,SAAS,OAAO;AAEtB,QAAI,OAAO,YAAY,KAAK,CAAA,SAAQ,YAAY,SAAS,IAAI,CAAC,GAAG;AAChE,aAAO;AAAA,IACR;AACA,QAAI,OAAO,aAAa,WAAW,GAAG;AACrC,aAAO;AAAA,IACR;AACA,UAAM,eAAe,MAAM,GAAG,aAAa,MAAM,IAAIC,+BAAAA,+BAA+B,UAAU,CAAC;AAC/F,WAAO,aAAa,KAAK,CAAA,OAAM,OAAO,aAAa,SAAS,GAAG,IAAI,CAAC;AAAA,EACrE;AACD;;"}

package/dist/production/src/model/service/PanelAccessResolver.js

@@ -0,0 +1,32 @@
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../type/ApiKey.js";
+import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
+import { AllProjectRolesByIdentityQuery } from "../queries/membership/AllProjectRolesByIdentityQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
+import "../authorization/PermissionContext.js";
+import "../authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+class PanelAccessResolver {
+  constructor(providers) {
+    this.providers = providers;
+  }
+  async isAllowed(db, identityId, globalRoles) {
+    const config = await db.queryHandler.fetch(new ConfigurationQuery(this.providers));
+    const policy = config.panel;
+    if (policy.globalRoles.some((role) => globalRoles.includes(role))) {
+      return true;
+    }
+    if (policy.projectRoles.length === 0) {
+      return false;
+    }
+    const projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId));
+    return projectRoles.some((it) => policy.projectRoles.includes(it.role));
+  }
+}
+export {
+  PanelAccessResolver
+};
+//# sourceMappingURL=PanelAccessResolver.js.map

package/dist/production/src/model/service/PanelAccessResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PanelAccessResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PanelAccessResolver.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { AllProjectRolesByIdentityQuery, ConfigurationQuery } from '../queries/index.js'\nimport { Providers } from '../providers.js'\n\n/**\n * Decides whether an identity may enter the management panel served by the engine.\n *\n * This is an **entry gate for the console, not an authorization system**: everything the panel shows\n * still goes through the tenant ACL, and whoever gets in could equally call `/tenant` directly. Its\n * job is to keep the console door shut for accounts that have no business there, so an admin surface\n * on a public API port does not look like a leak.\n *\n * An identity is allowed when it holds one of `globalRoles`, or a membership with one of\n * `projectRoles` in **any** project. Empty lists mean nobody.\n */\nexport class PanelAccessResolver {\n\tconstructor(private readonly providers: Providers) {}\n\n\tasync isAllowed(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<boolean> {\n\t\tconst config = await db.queryHandler.fetch(new ConfigurationQuery(this.providers))\n\t\tconst policy = config.panel\n\n\t\tif (policy.globalRoles.some(role => globalRoles.includes(role))) {\n\t\t\treturn true\n\t\t}\n\t\tif (policy.projectRoles.length === 0) {\n\t\t\treturn false\n\t\t}\n\t\tconst projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId))\n\t\treturn projectRoles.some(it => policy.projectRoles.includes(it.role))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AAeO,MAAM,oBAAoB;AAAA,EAChC,YAA6B,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpD,MAAM,UAAU,IAAqB,YAAoB,aAAkD;AAC1G,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,IAAI,mBAAmB,KAAK,SAAS,CAAC;AACjF,UAAM,SAAS,OAAO;AAEtB,QAAI,OAAO,YAAY,KAAK,CAAA,SAAQ,YAAY,SAAS,IAAI,CAAC,GAAG;AAChE,aAAO;AAAA,IACR;AACA,QAAI,OAAO,aAAa,WAAW,GAAG;AACrC,aAAO;AAAA,IACR;AACA,UAAM,eAAe,MAAM,GAAG,aAAa,MAAM,IAAI,+BAA+B,UAAU,CAAC;AAC/F,WAAO,aAAa,KAAK,CAAA,OAAM,OAAO,aAAa,SAAS,GAAG,IAAI,CAAC;AAAA,EACrE;AACD;"}

package/dist/production/src/model/service/PasswordChangeManager.cjs

@@ -9,8 +9,9 @@ require("../queries/apiKey/ApiKeyQuery.cjs");
 const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 class PasswordChangeManager {
   constructor(providers, passwordStrengthVerifier) {
@@ -18,7 +19,7 @@ class PasswordChangeManager {
     this.passwordStrengthVerifier = passwordStrengthVerifier;
   }
   async changePassword(dbContext, person, password) {
-    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(dbContext.providers));
     const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
     if (!passwordVerifyResult.ok) {
       return passwordVerifyResult;
@@ -27,7 +28,7 @@ class PasswordChangeManager {
     return new Response.ResponseOk(null);
   }
   async changeMyPassword(dbContext, person, currentPassword, password) {
-    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(dbContext.providers));
     const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
     if (!passwordVerifyResult.ok) {
       return passwordVerifyResult;

package/dist/production/src/model/service/PasswordChangeManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tcurrentPassword: string,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":["ConfigurationQuery","ChangePasswordCommand","ResponseOk","ResponseError"],"mappings":";;;;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,WACA,QACA,UACiF;AACjF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,mBAAAA,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBACL,WACA,QACA,iBACA,UACmF;AACnF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIF,mBAAAA,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAIG,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACA,QAAI,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AACjF,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEA,UAAM,UAAU,WAAW,QAAQ,IAAIF,sBAAAA,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}
+{"version":3,"file":"PasswordChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema/index.js'\nimport { ChangePasswordCommand } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ConfigurationQuery, PersonRow } from '../queries/index.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tcurrentPassword: string,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":["ConfigurationQuery","ChangePasswordCommand","ResponseOk","ResponseError"],"mappings":";;;;;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,WACA,QACA,UACiF;AACjF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AAC7F,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBACL,WACA,QACA,iBACA,UACmF;AACnF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIF,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AAC7F,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAIG,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACA,QAAI,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AACjF,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEA,UAAM,UAAU,WAAW,QAAQ,IAAIF,sBAAAA,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}

package/dist/production/src/model/service/PasswordChangeManager.js

@@ -7,8 +7,9 @@ import "../queries/apiKey/ApiKeyQuery.js";
 import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 class PasswordChangeManager {
   constructor(providers, passwordStrengthVerifier) {
@@ -16,7 +17,7 @@ class PasswordChangeManager {
     this.passwordStrengthVerifier = passwordStrengthVerifier;
   }
   async changePassword(dbContext, person, password) {
-    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers));
     const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
     if (!passwordVerifyResult.ok) {
       return passwordVerifyResult;
@@ -25,7 +26,7 @@ class PasswordChangeManager {
     return new ResponseOk(null);
   }
   async changeMyPassword(dbContext, person, currentPassword, password) {
-    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers));
     const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
     if (!passwordVerifyResult.ok) {
       return passwordVerifyResult;

package/dist/production/src/model/service/PasswordChangeManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tcurrentPassword: string,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":[],"mappings":";;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,WACA,QACA,UACiF;AACjF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBACL,WACA,QACA,iBACA,UACmF;AACnF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACA,QAAI,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AACjF,aAAO,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"PasswordChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema/index.js'\nimport { ChangePasswordCommand } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ConfigurationQuery, PersonRow } from '../queries/index.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tcurrentPassword: string,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":[],"mappings":";;;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,WACA,QACA,UACiF;AACjF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AAC7F,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBACL,WACA,QACA,iBACA,UACmF;AACnF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AAC7F,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACA,QAAI,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AACjF,aAAO,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/production/src/model/service/PasswordResetManager.cjs

@@ -2,19 +2,24 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Response = require("../utils/Response.cjs");
 require("../queries/apiKey/ApiKeyQuery.cjs");
-const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
 require("@contember/database");
+require("../type/ApiKey.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
 const exceptions = require("../../exceptions.cjs");
+const LocalAuthDisablingIdpsQuery = require("../queries/idp/LocalAuthDisablingIdpsQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 const getPreferredProject = require("./helpers/getPreferredProject.cjs");
 const CreatePersonTokenCommand = require("../commands/personToken/CreatePersonTokenCommand.cjs");
 const ResetPasswordCommand = require("../commands/personToken/ResetPasswordCommand.cjs");
+require("node:crypto");
 const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
 const AuthLogService = require("./AuthLogService.cjs");
+const NextMailAttemptQuery = require("../queries/authLog/NextMailAttemptQuery.cjs");
 class PasswordResetManager {
   constructor(mailer, projectManager, passwordStrengthValidator) {
     this.mailer = mailer;
@@ -22,12 +27,22 @@ class PasswordResetManager {
     this.passwordStrengthValidator = passwordStrengthValidator;
   }
   async createPasswordResetRequest(dbContext, permissionContext, person, mailOptions = {}) {
-    const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.CreatePersonTokenCommand.createPasswordResetRequest(person.id));
-    const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
-    const project = getPreferredProject.getPreferredProject(projects, mailOptions.project ?? null);
     if (!person.email) {
       throw new exceptions.ImplementationException();
     }
+    const exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery.LocalAuthDisablingIdpsQuery(person.id));
+    if (exclusiveIdps.length > 0) {
+      return;
+    }
+    const retryAfter = await dbContext.queryHandler.fetch(
+      new NextMailAttemptQuery.NextMailAttemptQuery(person.email, "password_reset_init", "password_reset")
+    );
+    if (retryAfter > 0) {
+      return;
+    }
+    const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.CreatePersonTokenCommand.createPasswordResetRequest(person.id));
+    const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+    const project = getPreferredProject.getPreferredProject(projects, mailOptions.project ?? null);
     await this.mailer.sendPasswordResetEmail(
       dbContext,
       {
@@ -43,7 +58,7 @@ class PasswordResetManager {
     );
   }
   async resetPassword(dbContext, token, password) {
-    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(dbContext.providers));
     const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byToken(token, "password_reset"));
     if (!tokenRow) {
       return new Response.ResponseError("TOKEN_NOT_FOUND", "Token not found", {

package/dist/production/src/model/service/PasswordResetManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { UserMailer } from '../mailing'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { CreatePersonTokenCommand, ResetPasswordCommand } from '../commands/personToken'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\nimport { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { AuthLogService } from './AuthLogService'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {}\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'password_reset'))\n\t\tif (!tokenRow) {\n\t\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found', {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: tokenRow.person_id,\n\t\t\ttokenId: tokenRow.id,\n\t\t})\n\t\tconst weakPassword = await this.passwordStrengthValidator.verify(password, config.password, 'PASSWORD_TOO_WEAK')\n\t\tif (!weakPassword.ok) {\n\t\t\treturn new ResponseError(weakPassword.error, weakPassword.errorMessage, {\n\t\t\t\t...weakPassword.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\tconst resetPasswordResult = await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t\tif (!resetPasswordResult.ok) {\n\t\t\treturn new ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {\n\t\t\t\t...resetPasswordResult.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\t[AuthLogService.Key]: authLogData,\n\t\t})\n\t}\n}\n\nexport type ResetPasswordResponse = Response<\n\t{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t},\n\tResetPasswordErrorCode,\n\t{\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n>\n"],"names":["CreatePersonTokenCommand","getPreferredProject","ImplementationException","ConfigurationQuery","PersonTokenQuery","ResponseError","AuthLogService","ResetPasswordCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;AAmBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBACA,2BAChB;AAHgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EACf;AAAA,EAEH,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AAChB,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQA,yBAAAA,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAChH,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUC,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AACzE,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AAEA,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAAA,EAEF;AAAA,EAEA,MAAa,cAAc,WAA4B,OAAe,UAAkD;AACvH,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAC1E,UAAM,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQ,OAAO,gBAAgB,CAAC;AACrG,QAAI,CAAC,UAAU;AACd,aAAO,IAAIC,SAAAA,cAAc,mBAAmB,mBAAmB;AAAA,QAC9D,CAACC,eAAAA,eAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI,CAAA,CAAE;AAAA,MAAA,CAC/C;AAAA,IACF;AAEA,UAAM,cAAc,IAAIA,eAAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,SAAS;AAAA,MACnB,SAAS,SAAS;AAAA,IAAA,CAClB;AACD,UAAM,eAAe,MAAM,KAAK,0BAA0B,OAAO,UAAU,OAAO,UAAU,mBAAmB;AAC/G,QAAI,CAAC,aAAa,IAAI;AACrB,aAAO,IAAID,SAAAA,cAAc,aAAa,OAAO,aAAa,cAAc;AAAA,QACvE,GAAG,aAAa,YAAY,CAAA;AAAA,QAC5B,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,UAAM,sBAAsB,MAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,OAAO,QAAQ,CAAC;AACxG,QAAI,CAAC,oBAAoB,IAAI;AAC5B,aAAO,IAAIF,SAAAA,cAAc,oBAAoB,OAAO,oBAAoB,cAAc;AAAA,QACrF,GAAG,oBAAoB,YAAY,CAAA;AAAA,QACnC,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB,CAACF,eAAAA,eAAe,GAAG,GAAG;AAAA,IAAA,CACtB;AAAA,EACF;AACD;;"}
+{"version":3,"file":"PasswordResetManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, ResetPasswordCommand } from '../commands/personToken/index.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\nimport { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {}\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// A person federated through a provider with `disableLocalAuthentication`\n\t\t// cannot sign in with a password, so a reset mail would only offer them a\n\t\t// credential the tenant refuses — and one more link worth phishing.\n\t\tconst exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))\n\t\tif (exclusiveIdps.length > 0) {\n\t\t\treturn\n\t\t}\n\n\t\t// Per-email exponential backoff on outbound mails — don't spam a real\n\t\t// user with reset mails just because attackers keep poking the\n\t\t// endpoint. Reuses login_* backoff config against person_auth_log.\n\t\tconst retryAfter = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(person.email, 'password_reset_init', 'password_reset'),\n\t\t)\n\t\tif (retryAfter > 0) {\n\t\t\treturn\n\t\t}\n\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'password_reset'))\n\t\tif (!tokenRow) {\n\t\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found', {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: tokenRow.person_id,\n\t\t\ttokenId: tokenRow.id,\n\t\t})\n\t\tconst weakPassword = await this.passwordStrengthValidator.verify(password, config.password, 'PASSWORD_TOO_WEAK')\n\t\tif (!weakPassword.ok) {\n\t\t\treturn new ResponseError(weakPassword.error, weakPassword.errorMessage, {\n\t\t\t\t...weakPassword.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\tconst resetPasswordResult = await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t\tif (!resetPasswordResult.ok) {\n\t\t\treturn new ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {\n\t\t\t\t...resetPasswordResult.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\t[AuthLogService.Key]: authLogData,\n\t\t})\n\t}\n}\n\nexport type ResetPasswordResponse = Response<\n\t{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t},\n\tResetPasswordErrorCode,\n\t{\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n>\n"],"names":["ImplementationException","LocalAuthDisablingIdpsQuery","NextMailAttemptQuery","CreatePersonTokenCommand","getPreferredProject","ConfigurationQuery","PersonTokenQuery","ResponseError","AuthLogService","ResetPasswordCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAoBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBACA,2BAChB;AAHgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EACf;AAAA,EAEH,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AAChB,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIA,WAAAA,wBAAA;AAAA,IACX;AAKA,UAAM,gBAAgB,MAAM,UAAU,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,OAAO,EAAE,CAAC;AACnG,QAAI,cAAc,SAAS,GAAG;AAC7B;AAAA,IACD;AAKA,UAAM,aAAa,MAAM,UAAU,aAAa;AAAA,MAC/C,IAAIC,0CAAqB,OAAO,OAAO,uBAAuB,gBAAgB;AAAA,IAAA;AAE/E,QAAI,aAAa,GAAG;AACnB;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQC,yBAAAA,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAChH,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUC,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAAA,EAEF;AAAA,EAEA,MAAa,cAAc,WAA4B,OAAe,UAAkD;AACvH,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIC,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AAC7F,UAAM,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQ,OAAO,gBAAgB,CAAC;AACrG,QAAI,CAAC,UAAU;AACd,aAAO,IAAIC,SAAAA,cAAc,mBAAmB,mBAAmB;AAAA,QAC9D,CAACC,eAAAA,eAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI,CAAA,CAAE;AAAA,MAAA,CAC/C;AAAA,IACF;AAEA,UAAM,cAAc,IAAIA,eAAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,SAAS;AAAA,MACnB,SAAS,SAAS;AAAA,IAAA,CAClB;AACD,UAAM,eAAe,MAAM,KAAK,0BAA0B,OAAO,UAAU,OAAO,UAAU,mBAAmB;AAC/G,QAAI,CAAC,aAAa,IAAI;AACrB,aAAO,IAAID,SAAAA,cAAc,aAAa,OAAO,aAAa,cAAc;AAAA,QACvE,GAAG,aAAa,YAAY,CAAA;AAAA,QAC5B,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,UAAM,sBAAsB,MAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,OAAO,QAAQ,CAAC;AACxG,QAAI,CAAC,oBAAoB,IAAI;AAC5B,aAAO,IAAIF,SAAAA,cAAc,oBAAoB,OAAO,oBAAoB,cAAc;AAAA,QACrF,GAAG,oBAAoB,YAAY,CAAA;AAAA,QACnC,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB,CAACF,eAAAA,eAAe,GAAG,GAAG;AAAA,IAAA,CACtB;AAAA,EACF;AACD;;"}

package/dist/production/src/model/service/PasswordResetManager.js

@@ -1,18 +1,23 @@
 import { ResponseError, ResponseOk } from "../utils/Response.js";
 import "../queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
 import "@contember/database";
+import "../type/ApiKey.js";
+import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
 import { ImplementationException } from "../../exceptions.js";
+import { LocalAuthDisablingIdpsQuery } from "../queries/idp/LocalAuthDisablingIdpsQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 import { getPreferredProject } from "./helpers/getPreferredProject.js";
 import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
 import { ResetPasswordCommand } from "../commands/personToken/ResetPasswordCommand.js";
+import "node:crypto";
 import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
 import { AuthLogService } from "./AuthLogService.js";
+import { NextMailAttemptQuery } from "../queries/authLog/NextMailAttemptQuery.js";
 class PasswordResetManager {
   constructor(mailer, projectManager, passwordStrengthValidator) {
     this.mailer = mailer;
@@ -20,12 +25,22 @@ class PasswordResetManager {
     this.passwordStrengthValidator = passwordStrengthValidator;
   }
   async createPasswordResetRequest(dbContext, permissionContext, person, mailOptions = {}) {
-    const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id));
-    const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
-    const project = getPreferredProject(projects, mailOptions.project ?? null);
     if (!person.email) {
       throw new ImplementationException();
     }
+    const exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id));
+    if (exclusiveIdps.length > 0) {
+      return;
+    }
+    const retryAfter = await dbContext.queryHandler.fetch(
+      new NextMailAttemptQuery(person.email, "password_reset_init", "password_reset")
+    );
+    if (retryAfter > 0) {
+      return;
+    }
+    const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id));
+    const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+    const project = getPreferredProject(projects, mailOptions.project ?? null);
     await this.mailer.sendPasswordResetEmail(
       dbContext,
       {
@@ -41,7 +56,7 @@ class PasswordResetManager {
     );
   }
   async resetPassword(dbContext, token, password) {
-    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers));
     const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, "password_reset"));
     if (!tokenRow) {
       return new ResponseError("TOKEN_NOT_FOUND", "Token not found", {

package/dist/production/src/model/service/PasswordResetManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { UserMailer } from '../mailing'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { CreatePersonTokenCommand, ResetPasswordCommand } from '../commands/personToken'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\nimport { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { AuthLogService } from './AuthLogService'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {}\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'password_reset'))\n\t\tif (!tokenRow) {\n\t\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found', {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: tokenRow.person_id,\n\t\t\ttokenId: tokenRow.id,\n\t\t})\n\t\tconst weakPassword = await this.passwordStrengthValidator.verify(password, config.password, 'PASSWORD_TOO_WEAK')\n\t\tif (!weakPassword.ok) {\n\t\t\treturn new ResponseError(weakPassword.error, weakPassword.errorMessage, {\n\t\t\t\t...weakPassword.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\tconst resetPasswordResult = await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t\tif (!resetPasswordResult.ok) {\n\t\t\treturn new ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {\n\t\t\t\t...resetPasswordResult.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\t[AuthLogService.Key]: authLogData,\n\t\t})\n\t}\n}\n\nexport type ResetPasswordResponse = Response<\n\t{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t},\n\tResetPasswordErrorCode,\n\t{\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n>\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAmBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBACA,2BAChB;AAHgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EACf;AAAA,EAEH,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AAChB,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAChH,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AACzE,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAI,wBAAA;AAAA,IACX;AAEA,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAAA,EAEF;AAAA,EAEA,MAAa,cAAc,WAA4B,OAAe,UAAkD;AACvH,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AAC1E,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,iBAAiB,QAAQ,OAAO,gBAAgB,CAAC;AACrG,QAAI,CAAC,UAAU;AACd,aAAO,IAAI,cAAc,mBAAmB,mBAAmB;AAAA,QAC9D,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAA,CAAE;AAAA,MAAA,CAC/C;AAAA,IACF;AAEA,UAAM,cAAc,IAAI,eAAe,IAAI;AAAA,MAC1C,UAAU,SAAS;AAAA,MACnB,SAAS,SAAS;AAAA,IAAA,CAClB;AACD,UAAM,eAAe,MAAM,KAAK,0BAA0B,OAAO,UAAU,OAAO,UAAU,mBAAmB;AAC/G,QAAI,CAAC,aAAa,IAAI;AACrB,aAAO,IAAI,cAAc,aAAa,OAAO,aAAa,cAAc;AAAA,QACvE,GAAG,aAAa,YAAY,CAAA;AAAA,QAC5B,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,UAAM,sBAAsB,MAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,CAAC;AACxG,QAAI,CAAC,oBAAoB,IAAI;AAC5B,aAAO,IAAI,cAAc,oBAAoB,OAAO,oBAAoB,cAAc;AAAA,QACrF,GAAG,oBAAoB,YAAY,CAAA;AAAA,QACnC,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,IAAI,WAAW;AAAA,MACrB,CAAC,eAAe,GAAG,GAAG;AAAA,IAAA,CACtB;AAAA,EACF;AACD;"}
+{"version":3,"file":"PasswordResetManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, ResetPasswordCommand } from '../commands/personToken/index.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\nimport { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {}\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// A person federated through a provider with `disableLocalAuthentication`\n\t\t// cannot sign in with a password, so a reset mail would only offer them a\n\t\t// credential the tenant refuses — and one more link worth phishing.\n\t\tconst exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))\n\t\tif (exclusiveIdps.length > 0) {\n\t\t\treturn\n\t\t}\n\n\t\t// Per-email exponential backoff on outbound mails — don't spam a real\n\t\t// user with reset mails just because attackers keep poking the\n\t\t// endpoint. Reuses login_* backoff config against person_auth_log.\n\t\tconst retryAfter = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(person.email, 'password_reset_init', 'password_reset'),\n\t\t)\n\t\tif (retryAfter > 0) {\n\t\t\treturn\n\t\t}\n\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'password_reset'))\n\t\tif (!tokenRow) {\n\t\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found', {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: tokenRow.person_id,\n\t\t\ttokenId: tokenRow.id,\n\t\t})\n\t\tconst weakPassword = await this.passwordStrengthValidator.verify(password, config.password, 'PASSWORD_TOO_WEAK')\n\t\tif (!weakPassword.ok) {\n\t\t\treturn new ResponseError(weakPassword.error, weakPassword.errorMessage, {\n\t\t\t\t...weakPassword.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\tconst resetPasswordResult = await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t\tif (!resetPasswordResult.ok) {\n\t\t\treturn new ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {\n\t\t\t\t...resetPasswordResult.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\t[AuthLogService.Key]: authLogData,\n\t\t})\n\t}\n}\n\nexport type ResetPasswordResponse = Response<\n\t{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t},\n\tResetPasswordErrorCode,\n\t{\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n>\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBACA,2BAChB;AAHgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EACf;AAAA,EAEH,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AAChB,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAI,wBAAA;AAAA,IACX;AAKA,UAAM,gBAAgB,MAAM,UAAU,aAAa,MAAM,IAAI,4BAA4B,OAAO,EAAE,CAAC;AACnG,QAAI,cAAc,SAAS,GAAG;AAC7B;AAAA,IACD;AAKA,UAAM,aAAa,MAAM,UAAU,aAAa;AAAA,MAC/C,IAAI,qBAAqB,OAAO,OAAO,uBAAuB,gBAAgB;AAAA,IAAA;AAE/E,QAAI,aAAa,GAAG;AACnB;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAChH,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAAA,EAEF;AAAA,EAEA,MAAa,cAAc,WAA4B,OAAe,UAAkD;AACvH,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AAC7F,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,iBAAiB,QAAQ,OAAO,gBAAgB,CAAC;AACrG,QAAI,CAAC,UAAU;AACd,aAAO,IAAI,cAAc,mBAAmB,mBAAmB;AAAA,QAC9D,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAA,CAAE;AAAA,MAAA,CAC/C;AAAA,IACF;AAEA,UAAM,cAAc,IAAI,eAAe,IAAI;AAAA,MAC1C,UAAU,SAAS;AAAA,MACnB,SAAS,SAAS;AAAA,IAAA,CAClB;AACD,UAAM,eAAe,MAAM,KAAK,0BAA0B,OAAO,UAAU,OAAO,UAAU,mBAAmB;AAC/G,QAAI,CAAC,aAAa,IAAI;AACrB,aAAO,IAAI,cAAc,aAAa,OAAO,aAAa,cAAc;AAAA,QACvE,GAAG,aAAa,YAAY,CAAA;AAAA,QAC5B,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,UAAM,sBAAsB,MAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,CAAC;AACxG,QAAI,CAAC,oBAAoB,IAAI;AAC5B,aAAO,IAAI,cAAc,oBAAoB,OAAO,oBAAoB,cAAc;AAAA,QACrF,GAAG,oBAAoB,YAAY,CAAA;AAAA,QACnC,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,IAAI,WAAW;AAAA,MACrB,CAAC,eAAe,GAAG,GAAG;AAAA,IAAA,CACtB;AAAA,EACF;AACD;"}

package/dist/production/src/model/service/PasswordStrengthValidator.cjs

@@ -2,7 +2,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const blacklist = require("../utils/blacklist.cjs");
 const Response = require("../utils/Response.cjs");
+const HibpChecker = require("./HibpChecker.cjs");
 class PasswordStrengthValidator {
+  constructor(hibpChecker = new HibpChecker.NoopHibpChecker()) {
+    this.hibpChecker = hibpChecker;
+  }
   async verify(password, passwordConfig, errorCode) {
     const failureReasons = [];
     const developerMessage = [];
@@ -40,6 +44,10 @@ class PasswordStrengthValidator {
       failureReasons.push("BLACKLISTED");
       developerMessage.push(`Password is blacklisted.`);
     }
+    if (passwordConfig.checkHibp && await this.hibpChecker.isCompromised(password)) {
+      failureReasons.push("COMPROMISED");
+      developerMessage.push(`Password has appeared in a known data breach.`);
+    }
     if (failureReasons.length > 0) {
       return new Response.ResponseError(errorCode, developerMessage.join(" "), {
         weakPasswordReasons: failureReasons

package/dist/production/src/model/service/PasswordStrengthValidator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordStrengthValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordStrengthValidator.ts"],"sourcesContent":["import { Config } from '../type/Config'\nimport { blacklist } from '../utils/blacklist'\nimport { WeakPasswordReason } from '../../schema'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\n\nexport class PasswordStrengthValidator {\n\tpublic async verify<const Code extends string>(\n\t\tpassword: string,\n\t\tpasswordConfig: Config['password'],\n\t\terrorCode: Code,\n\t): Promise<\n\t\t| ResponseOk<null>\n\t\t| ResponseError<Code, {\n\t\t\tweakPasswordReasons: WeakPasswordReason[]\n\t\t}>\n\t> {\n\t\tconst failureReasons: WeakPasswordReason[] = []\n\t\tconst developerMessage: string[] = []\n\n\t\tif (password.length < passwordConfig.minLength) {\n\t\t\tfailureReasons.push('TOO_SHORT')\n\t\t\tdeveloperMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {\n\t\t\tfailureReasons.push('MISSING_UPPERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {\n\t\t\tfailureReasons.push('MISSING_LOWERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireDigit > 0 && (password.match(/\\d/g) || []).length < passwordConfig.requireDigit) {\n\t\t\tfailureReasons.push('MISSING_DIGIT')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?\":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {\n\t\t\tfailureReasons.push('MISSING_SPECIAL')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {\n\t\t\tfailureReasons.push('INVALID_PATTERN')\n\t\t\tdeveloperMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`)\n\t\t}\n\n\t\tif (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {\n\t\t\tfailureReasons.push('BLACKLISTED')\n\t\t\tdeveloperMessage.push(`Password is blacklisted.`)\n\t\t}\n\n\t\tif (failureReasons.length > 0) {\n\t\t\treturn new ResponseError(errorCode as any, developerMessage.join(' '), {\n\t\t\t\tweakPasswordReasons: failureReasons,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate isBlacklisted(password: string): boolean {\n\t\treturn blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password))\n\t}\n\n\tprivate decodeLeetspeak(input: string): string {\n\t\tconst leetspeakMap: { [key: string]: string } = {\n\t\t\t'@': 'a',\n\t\t\t'$': 's',\n\t\t\t'0': 'o',\n\t\t\t'1': 'l',\n\t\t\t'3': 'e',\n\t\t\t'7': 't',\n\t\t\t'!': 'i',\n\t\t}\n\t\treturn input\n\t\t\t.split('')\n\t\t\t.map(char => {\n\t\t\t\treturn leetspeakMap[char] || char\n\t\t\t})\n\t\t\t.join('')\n\t}\n}\n\nnamespace PasswordStrengthValidator {\n\texport type Result =\n\t\t| { ok: true }\n\t\t| { ok: false; reasons: WeakPasswordReason[]; message: string }\n}\n"],"names":["ResponseError","ResponseOk","blacklist"],"mappings":";;;;AAKO,MAAM,0BAA0B;AAAA,EACtC,MAAa,OACZ,UACA,gBACA,WAMC;AACD,UAAM,iBAAuC,CAAA;AAC7C,UAAM,mBAA6B,CAAA;AAEnC,QAAI,SAAS,SAAS,eAAe,WAAW;AAC/C,qBAAe,KAAK,WAAW;AAC/B,uBAAiB,KAAK,4CAA4C,eAAe,SAAS,GAAG;AAAA,IAC9F;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,eAAe,MAAM,SAAS,MAAM,KAAK,KAAK,CAAA,GAAI,SAAS,eAAe,cAAc;AAC1G,qBAAe,KAAK,eAAe;AACnC,uBAAiB,KAAK,kCAAkC,eAAe,YAAY,SAAS,eAAe,eAAe,IAAI,MAAM,EAAE,GAAG;AAAA,IAC1I;AAEA,QAAI,eAAe,iBAAiB,MAAM,SAAS,MAAM,yBAAyB,KAAK,CAAA,GAAI,SAAS,eAAe,gBAAgB;AAClI,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,cAAc,qBAAqB,eAAe,iBAAiB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAElI;AAEA,QAAI,eAAe,WAAW,CAAC,IAAI,OAAO,eAAe,OAAO,EAAE,KAAK,QAAQ,GAAG;AACjF,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB,KAAK,iDAAiD,eAAe,OAAO,GAAG;AAAA,IACjG;AAEA,QAAI,eAAe,kBAAkB,KAAK,cAAc,SAAS,YAAA,CAAa,GAAG;AAChF,qBAAe,KAAK,aAAa;AACjC,uBAAiB,KAAK,0BAA0B;AAAA,IACjD;AAEA,QAAI,eAAe,SAAS,GAAG;AAC9B,aAAO,IAAIA,SAAAA,cAAc,WAAkB,iBAAiB,KAAK,GAAG,GAAG;AAAA,QACtE,qBAAqB;AAAA,MAAA,CACrB;AAAA,IACF;AACA,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,UAA2B;AAChD,WAAOC,UAAAA,UAAU,IAAI,QAAQ,KAAKA,UAAAA,UAAU,IAAI,KAAK,gBAAgB,QAAQ,CAAC;AAAA,EAC/E;AAAA,EAEQ,gBAAgB,OAAuB;AAC9C,UAAM,eAA0C;AAAA,MAC/C,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,MACL,MAAM,EAAE,EACR,IAAI,CAAA,SAAQ;AACZ,aAAO,aAAa,IAAI,KAAK;AAAA,IAC9B,CAAC,EACA,KAAK,EAAE;AAAA,EACV;AACD;;"}
+{"version":3,"file":"PasswordStrengthValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordStrengthValidator.ts"],"sourcesContent":["import { Config } from '../type/Config.js'\nimport { blacklist } from '../utils/blacklist.js'\nimport { WeakPasswordReason } from '../../schema/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { HibpChecker, NoopHibpChecker } from './HibpChecker.js'\n\nexport class PasswordStrengthValidator {\n\tconstructor(\n\t\tprivate readonly hibpChecker: HibpChecker = new NoopHibpChecker(),\n\t) {}\n\n\tpublic async verify<const Code extends string>(\n\t\tpassword: string,\n\t\tpasswordConfig: Config['password'],\n\t\terrorCode: Code,\n\t): Promise<\n\t\t| ResponseOk<null>\n\t\t| ResponseError<Code, {\n\t\t\tweakPasswordReasons: WeakPasswordReason[]\n\t\t}>\n\t> {\n\t\tconst failureReasons: WeakPasswordReason[] = []\n\t\tconst developerMessage: string[] = []\n\n\t\tif (password.length < passwordConfig.minLength) {\n\t\t\tfailureReasons.push('TOO_SHORT')\n\t\t\tdeveloperMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {\n\t\t\tfailureReasons.push('MISSING_UPPERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {\n\t\t\tfailureReasons.push('MISSING_LOWERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireDigit > 0 && (password.match(/\\d/g) || []).length < passwordConfig.requireDigit) {\n\t\t\tfailureReasons.push('MISSING_DIGIT')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?\":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {\n\t\t\tfailureReasons.push('MISSING_SPECIAL')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {\n\t\t\tfailureReasons.push('INVALID_PATTERN')\n\t\t\tdeveloperMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`)\n\t\t}\n\n\t\tif (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {\n\t\t\tfailureReasons.push('BLACKLISTED')\n\t\t\tdeveloperMessage.push(`Password is blacklisted.`)\n\t\t}\n\n\t\tif (passwordConfig.checkHibp && await this.hibpChecker.isCompromised(password)) {\n\t\t\tfailureReasons.push('COMPROMISED')\n\t\t\tdeveloperMessage.push(`Password has appeared in a known data breach.`)\n\t\t}\n\n\t\tif (failureReasons.length > 0) {\n\t\t\treturn new ResponseError(errorCode as any, developerMessage.join(' '), {\n\t\t\t\tweakPasswordReasons: failureReasons,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate isBlacklisted(password: string): boolean {\n\t\treturn blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password))\n\t}\n\n\tprivate decodeLeetspeak(input: string): string {\n\t\tconst leetspeakMap: { [key: string]: string } = {\n\t\t\t'@': 'a',\n\t\t\t'$': 's',\n\t\t\t'0': 'o',\n\t\t\t'1': 'l',\n\t\t\t'3': 'e',\n\t\t\t'7': 't',\n\t\t\t'!': 'i',\n\t\t}\n\t\treturn input\n\t\t\t.split('')\n\t\t\t.map(char => {\n\t\t\t\treturn leetspeakMap[char] || char\n\t\t\t})\n\t\t\t.join('')\n\t}\n}\n\nnamespace PasswordStrengthValidator {\n\texport type Result =\n\t\t| { ok: true }\n\t\t| { ok: false; reasons: WeakPasswordReason[]; message: string }\n}\n"],"names":["NoopHibpChecker","ResponseError","ResponseOk","blacklist"],"mappings":";;;;;AAMO,MAAM,0BAA0B;AAAA,EACtC,YACkB,cAA2B,IAAIA,YAAAA,mBAC/C;AADgB,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAa,OACZ,UACA,gBACA,WAMC;AACD,UAAM,iBAAuC,CAAA;AAC7C,UAAM,mBAA6B,CAAA;AAEnC,QAAI,SAAS,SAAS,eAAe,WAAW;AAC/C,qBAAe,KAAK,WAAW;AAC/B,uBAAiB,KAAK,4CAA4C,eAAe,SAAS,GAAG;AAAA,IAC9F;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,eAAe,MAAM,SAAS,MAAM,KAAK,KAAK,CAAA,GAAI,SAAS,eAAe,cAAc;AAC1G,qBAAe,KAAK,eAAe;AACnC,uBAAiB,KAAK,kCAAkC,eAAe,YAAY,SAAS,eAAe,eAAe,IAAI,MAAM,EAAE,GAAG;AAAA,IAC1I;AAEA,QAAI,eAAe,iBAAiB,MAAM,SAAS,MAAM,yBAAyB,KAAK,CAAA,GAAI,SAAS,eAAe,gBAAgB;AAClI,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,cAAc,qBAAqB,eAAe,iBAAiB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAElI;AAEA,QAAI,eAAe,WAAW,CAAC,IAAI,OAAO,eAAe,OAAO,EAAE,KAAK,QAAQ,GAAG;AACjF,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB,KAAK,iDAAiD,eAAe,OAAO,GAAG;AAAA,IACjG;AAEA,QAAI,eAAe,kBAAkB,KAAK,cAAc,SAAS,YAAA,CAAa,GAAG;AAChF,qBAAe,KAAK,aAAa;AACjC,uBAAiB,KAAK,0BAA0B;AAAA,IACjD;AAEA,QAAI,eAAe,aAAa,MAAM,KAAK,YAAY,cAAc,QAAQ,GAAG;AAC/E,qBAAe,KAAK,aAAa;AACjC,uBAAiB,KAAK,+CAA+C;AAAA,IACtE;AAEA,QAAI,eAAe,SAAS,GAAG;AAC9B,aAAO,IAAIC,SAAAA,cAAc,WAAkB,iBAAiB,KAAK,GAAG,GAAG;AAAA,QACtE,qBAAqB;AAAA,MAAA,CACrB;AAAA,IACF;AACA,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,UAA2B;AAChD,WAAOC,UAAAA,UAAU,IAAI,QAAQ,KAAKA,UAAAA,UAAU,IAAI,KAAK,gBAAgB,QAAQ,CAAC;AAAA,EAC/E;AAAA,EAEQ,gBAAgB,OAAuB;AAC9C,UAAM,eAA0C;AAAA,MAC/C,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,MACL,MAAM,EAAE,EACR,IAAI,CAAA,SAAQ;AACZ,aAAO,aAAa,IAAI,KAAK;AAAA,IAC9B,CAAC,EACA,KAAK,EAAE;AAAA,EACV;AACD;;"}

package/dist/production/src/model/service/PasswordStrengthValidator.js

@@ -1,6 +1,10 @@
 import { blacklist } from "../utils/blacklist.js";
 import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { NoopHibpChecker } from "./HibpChecker.js";
 class PasswordStrengthValidator {
+  constructor(hibpChecker = new NoopHibpChecker()) {
+    this.hibpChecker = hibpChecker;
+  }
   async verify(password, passwordConfig, errorCode) {
     const failureReasons = [];
     const developerMessage = [];
@@ -38,6 +42,10 @@ class PasswordStrengthValidator {
       failureReasons.push("BLACKLISTED");
       developerMessage.push(`Password is blacklisted.`);
     }
+    if (passwordConfig.checkHibp && await this.hibpChecker.isCompromised(password)) {
+      failureReasons.push("COMPROMISED");
+      developerMessage.push(`Password has appeared in a known data breach.`);
+    }
     if (failureReasons.length > 0) {
       return new ResponseError(errorCode, developerMessage.join(" "), {
         weakPasswordReasons: failureReasons

package/dist/production/src/model/service/PasswordStrengthValidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordStrengthValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordStrengthValidator.ts"],"sourcesContent":["import { Config } from '../type/Config'\nimport { blacklist } from '../utils/blacklist'\nimport { WeakPasswordReason } from '../../schema'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\n\nexport class PasswordStrengthValidator {\n\tpublic async verify<const Code extends string>(\n\t\tpassword: string,\n\t\tpasswordConfig: Config['password'],\n\t\terrorCode: Code,\n\t): Promise<\n\t\t| ResponseOk<null>\n\t\t| ResponseError<Code, {\n\t\t\tweakPasswordReasons: WeakPasswordReason[]\n\t\t}>\n\t> {\n\t\tconst failureReasons: WeakPasswordReason[] = []\n\t\tconst developerMessage: string[] = []\n\n\t\tif (password.length < passwordConfig.minLength) {\n\t\t\tfailureReasons.push('TOO_SHORT')\n\t\t\tdeveloperMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {\n\t\t\tfailureReasons.push('MISSING_UPPERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {\n\t\t\tfailureReasons.push('MISSING_LOWERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireDigit > 0 && (password.match(/\\d/g) || []).length < passwordConfig.requireDigit) {\n\t\t\tfailureReasons.push('MISSING_DIGIT')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?\":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {\n\t\t\tfailureReasons.push('MISSING_SPECIAL')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {\n\t\t\tfailureReasons.push('INVALID_PATTERN')\n\t\t\tdeveloperMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`)\n\t\t}\n\n\t\tif (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {\n\t\t\tfailureReasons.push('BLACKLISTED')\n\t\t\tdeveloperMessage.push(`Password is blacklisted.`)\n\t\t}\n\n\t\tif (failureReasons.length > 0) {\n\t\t\treturn new ResponseError(errorCode as any, developerMessage.join(' '), {\n\t\t\t\tweakPasswordReasons: failureReasons,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate isBlacklisted(password: string): boolean {\n\t\treturn blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password))\n\t}\n\n\tprivate decodeLeetspeak(input: string): string {\n\t\tconst leetspeakMap: { [key: string]: string } = {\n\t\t\t'@': 'a',\n\t\t\t'$': 's',\n\t\t\t'0': 'o',\n\t\t\t'1': 'l',\n\t\t\t'3': 'e',\n\t\t\t'7': 't',\n\t\t\t'!': 'i',\n\t\t}\n\t\treturn input\n\t\t\t.split('')\n\t\t\t.map(char => {\n\t\t\t\treturn leetspeakMap[char] || char\n\t\t\t})\n\t\t\t.join('')\n\t}\n}\n\nnamespace PasswordStrengthValidator {\n\texport type Result =\n\t\t| { ok: true }\n\t\t| { ok: false; reasons: WeakPasswordReason[]; message: string }\n}\n"],"names":[],"mappings":";;AAKO,MAAM,0BAA0B;AAAA,EACtC,MAAa,OACZ,UACA,gBACA,WAMC;AACD,UAAM,iBAAuC,CAAA;AAC7C,UAAM,mBAA6B,CAAA;AAEnC,QAAI,SAAS,SAAS,eAAe,WAAW;AAC/C,qBAAe,KAAK,WAAW;AAC/B,uBAAiB,KAAK,4CAA4C,eAAe,SAAS,GAAG;AAAA,IAC9F;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,eAAe,MAAM,SAAS,MAAM,KAAK,KAAK,CAAA,GAAI,SAAS,eAAe,cAAc;AAC1G,qBAAe,KAAK,eAAe;AACnC,uBAAiB,KAAK,kCAAkC,eAAe,YAAY,SAAS,eAAe,eAAe,IAAI,MAAM,EAAE,GAAG;AAAA,IAC1I;AAEA,QAAI,eAAe,iBAAiB,MAAM,SAAS,MAAM,yBAAyB,KAAK,CAAA,GAAI,SAAS,eAAe,gBAAgB;AAClI,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,cAAc,qBAAqB,eAAe,iBAAiB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAElI;AAEA,QAAI,eAAe,WAAW,CAAC,IAAI,OAAO,eAAe,OAAO,EAAE,KAAK,QAAQ,GAAG;AACjF,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB,KAAK,iDAAiD,eAAe,OAAO,GAAG;AAAA,IACjG;AAEA,QAAI,eAAe,kBAAkB,KAAK,cAAc,SAAS,YAAA,CAAa,GAAG;AAChF,qBAAe,KAAK,aAAa;AACjC,uBAAiB,KAAK,0BAA0B;AAAA,IACjD;AAEA,QAAI,eAAe,SAAS,GAAG;AAC9B,aAAO,IAAI,cAAc,WAAkB,iBAAiB,KAAK,GAAG,GAAG;AAAA,QACtE,qBAAqB;AAAA,MAAA,CACrB;AAAA,IACF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,UAA2B;AAChD,WAAO,UAAU,IAAI,QAAQ,KAAK,UAAU,IAAI,KAAK,gBAAgB,QAAQ,CAAC;AAAA,EAC/E;AAAA,EAEQ,gBAAgB,OAAuB;AAC9C,UAAM,eAA0C;AAAA,MAC/C,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,MACL,MAAM,EAAE,EACR,IAAI,CAAA,SAAQ;AACZ,aAAO,aAAa,IAAI,KAAK;AAAA,IAC9B,CAAC,EACA,KAAK,EAAE;AAAA,EACV;AACD;"}
+{"version":3,"file":"PasswordStrengthValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordStrengthValidator.ts"],"sourcesContent":["import { Config } from '../type/Config.js'\nimport { blacklist } from '../utils/blacklist.js'\nimport { WeakPasswordReason } from '../../schema/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { HibpChecker, NoopHibpChecker } from './HibpChecker.js'\n\nexport class PasswordStrengthValidator {\n\tconstructor(\n\t\tprivate readonly hibpChecker: HibpChecker = new NoopHibpChecker(),\n\t) {}\n\n\tpublic async verify<const Code extends string>(\n\t\tpassword: string,\n\t\tpasswordConfig: Config['password'],\n\t\terrorCode: Code,\n\t): Promise<\n\t\t| ResponseOk<null>\n\t\t| ResponseError<Code, {\n\t\t\tweakPasswordReasons: WeakPasswordReason[]\n\t\t}>\n\t> {\n\t\tconst failureReasons: WeakPasswordReason[] = []\n\t\tconst developerMessage: string[] = []\n\n\t\tif (password.length < passwordConfig.minLength) {\n\t\t\tfailureReasons.push('TOO_SHORT')\n\t\t\tdeveloperMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {\n\t\t\tfailureReasons.push('MISSING_UPPERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {\n\t\t\tfailureReasons.push('MISSING_LOWERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireDigit > 0 && (password.match(/\\d/g) || []).length < passwordConfig.requireDigit) {\n\t\t\tfailureReasons.push('MISSING_DIGIT')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?\":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {\n\t\t\tfailureReasons.push('MISSING_SPECIAL')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {\n\t\t\tfailureReasons.push('INVALID_PATTERN')\n\t\t\tdeveloperMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`)\n\t\t}\n\n\t\tif (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {\n\t\t\tfailureReasons.push('BLACKLISTED')\n\t\t\tdeveloperMessage.push(`Password is blacklisted.`)\n\t\t}\n\n\t\tif (passwordConfig.checkHibp && await this.hibpChecker.isCompromised(password)) {\n\t\t\tfailureReasons.push('COMPROMISED')\n\t\t\tdeveloperMessage.push(`Password has appeared in a known data breach.`)\n\t\t}\n\n\t\tif (failureReasons.length > 0) {\n\t\t\treturn new ResponseError(errorCode as any, developerMessage.join(' '), {\n\t\t\t\tweakPasswordReasons: failureReasons,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate isBlacklisted(password: string): boolean {\n\t\treturn blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password))\n\t}\n\n\tprivate decodeLeetspeak(input: string): string {\n\t\tconst leetspeakMap: { [key: string]: string } = {\n\t\t\t'@': 'a',\n\t\t\t'$': 's',\n\t\t\t'0': 'o',\n\t\t\t'1': 'l',\n\t\t\t'3': 'e',\n\t\t\t'7': 't',\n\t\t\t'!': 'i',\n\t\t}\n\t\treturn input\n\t\t\t.split('')\n\t\t\t.map(char => {\n\t\t\t\treturn leetspeakMap[char] || char\n\t\t\t})\n\t\t\t.join('')\n\t}\n}\n\nnamespace PasswordStrengthValidator {\n\texport type Result =\n\t\t| { ok: true }\n\t\t| { ok: false; reasons: WeakPasswordReason[]; message: string }\n}\n"],"names":[],"mappings":";;;AAMO,MAAM,0BAA0B;AAAA,EACtC,YACkB,cAA2B,IAAI,mBAC/C;AADgB,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAa,OACZ,UACA,gBACA,WAMC;AACD,UAAM,iBAAuC,CAAA;AAC7C,UAAM,mBAA6B,CAAA;AAEnC,QAAI,SAAS,SAAS,eAAe,WAAW;AAC/C,qBAAe,KAAK,WAAW;AAC/B,uBAAiB,KAAK,4CAA4C,eAAe,SAAS,GAAG;AAAA,IAC9F;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,eAAe,MAAM,SAAS,MAAM,KAAK,KAAK,CAAA,GAAI,SAAS,eAAe,cAAc;AAC1G,qBAAe,KAAK,eAAe;AACnC,uBAAiB,KAAK,kCAAkC,eAAe,YAAY,SAAS,eAAe,eAAe,IAAI,MAAM,EAAE,GAAG;AAAA,IAC1I;AAEA,QAAI,eAAe,iBAAiB,MAAM,SAAS,MAAM,yBAAyB,KAAK,CAAA,GAAI,SAAS,eAAe,gBAAgB;AAClI,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,cAAc,qBAAqB,eAAe,iBAAiB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAElI;AAEA,QAAI,eAAe,WAAW,CAAC,IAAI,OAAO,eAAe,OAAO,EAAE,KAAK,QAAQ,GAAG;AACjF,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB,KAAK,iDAAiD,eAAe,OAAO,GAAG;AAAA,IACjG;AAEA,QAAI,eAAe,kBAAkB,KAAK,cAAc,SAAS,YAAA,CAAa,GAAG;AAChF,qBAAe,KAAK,aAAa;AACjC,uBAAiB,KAAK,0BAA0B;AAAA,IACjD;AAEA,QAAI,eAAe,aAAa,MAAM,KAAK,YAAY,cAAc,QAAQ,GAAG;AAC/E,qBAAe,KAAK,aAAa;AACjC,uBAAiB,KAAK,+CAA+C;AAAA,IACtE;AAEA,QAAI,eAAe,SAAS,GAAG;AAC9B,aAAO,IAAI,cAAc,WAAkB,iBAAiB,KAAK,GAAG,GAAG;AAAA,QACtE,qBAAqB;AAAA,MAAA,CACrB;AAAA,IACF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,UAA2B;AAChD,WAAO,UAAU,IAAI,QAAQ,KAAK,UAAU,IAAI,KAAK,gBAAgB,QAAQ,CAAC;AAAA,EAC/E;AAAA,EAEQ,gBAAgB,OAAuB;AAC9C,UAAM,eAA0C;AAAA,MAC/C,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,MACL,MAAM,EAAE,EACR,IAAI,CAAA,SAAQ;AACZ,aAAO,aAAa,IAAI,KAAK;AAAA,IAC9B,CAAC,EACA,KAAK,EAAE;AAAA,EACV;AACD;"}