@drax/identity-back 3.13.0 → 3.15.0

package/test/endpoints/user-route.test.ts

@@ -6,7 +6,7 @@ import {USER1} from "./data/users-data"
 
 describe("User Route Test", async function () {
 
-    let testSetup = new TestSetup()
+    let testSetup = new TestSetup("sqlite")
 
     beforeAll(async () => {
         await testSetup.setup()
@@ -91,7 +91,7 @@ describe("User Route Test", async function () {
 
         const items = await getResp.json();
         expect(getResp.statusCode).toBe(200);
-        expect(items[0].name).toBe(USER1.name);
+        expect(items.some((item) => item._id === result._id && item.name === USER1.name)).toBe(true);
     })
 
 
@@ -123,7 +123,7 @@ describe("User Route Test", async function () {
         const respPassword = await testSetup.fastifyInstance.inject({
             method: 'POST',
             url: '/api/users/password/change',
-            payload: {currentPassword: "basic.123", newPassword: "newpass"},
+            payload: {currentPassword: "Basic1234", newPassword: "Newpass123"},
             headers: {Authorization: `Bearer ${accessToken}`}
         });
 
@@ -141,7 +141,7 @@ describe("User Route Test", async function () {
         const respPassword = await testSetup.fastifyInstance.inject({
             method: 'POST',
             url: '/api/users/password/change/'+testSetup.rootUser._id,
-            payload: {currentPassword: "root.123", newPassword: "newpass"},
+            payload: {currentPassword: "Root1234", newPassword: "Newpass123"},
             headers: {Authorization: `Bearer ${accessToken}`}
         });
 
@@ -152,5 +152,18 @@ describe("User Route Test", async function () {
 
     })
 
+    it("should return effective password policy", async () => {
+        const resp = await testSetup.fastifyInstance.inject({
+            method: 'GET',
+            url: '/api/auth/password-policy',
+        });
+
+        const result = await resp.json();
+        expect(resp.statusCode).toBe(200);
+        expect(result.minLength).toBe(8);
+        expect(result.requireUppercase).toBe(true);
+        expect(result.preventReuse).toBe(3);
+    })
+
 
 })

package/test/security/password-policy-resolver.test.ts

@@ -0,0 +1,55 @@
+import {afterEach, describe, expect, it} from "vitest";
+import {DraxConfig} from "@drax/common-back";
+import PasswordPolicyResolver from "../../src/resolver/PasswordPolicyResolver.js";
+import PasswordPolicyConfig from "../../src/config/PasswordPolicyConfig.js";
+
+describe("PasswordPolicyResolver", () => {
+    afterEach(() => {
+        delete process.env.PASSWORD_POLICY_MIN_LENGTH
+        delete process.env.PASSWORD_POLICY_MAX_LENGTH
+        delete process.env.PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR
+        DraxConfig.set(PasswordPolicyConfig.MinLength, undefined)
+        DraxConfig.set(PasswordPolicyConfig.MaxLength, undefined)
+        DraxConfig.set(PasswordPolicyConfig.RequireSpecialChar, undefined)
+    })
+
+    it("uses default policy when there are no overrides", async () => {
+        const resolver = new PasswordPolicyResolver()
+        const policy = await resolver.resolve()
+
+        expect(policy.minLength).toBe(8)
+        expect(policy.maxLength).toBe(64)
+        expect(policy.requireUppercase).toBe(true)
+    })
+
+    it("project policy overrides default policy", async () => {
+        const resolver = new PasswordPolicyResolver()
+        resolver.setProjectPolicy({minLength: 12, requireUppercase: false, requireSpecialChar: true})
+        const policy = await resolver.resolve()
+
+        expect(policy.minLength).toBe(12)
+        expect(policy.requireSpecialChar).toBe(true)
+        expect(policy.requireUppercase).toBe(false)
+    })
+
+    it("env policy overrides project policy", async () => {
+        process.env.PASSWORD_POLICY_MIN_LENGTH = "16"
+        process.env.PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR = "false"
+
+        const resolver = new PasswordPolicyResolver()
+        const policy = await resolver.resolve()
+
+        expect(policy.minLength).toBe(16)
+        expect(policy.requireSpecialChar).toBe(false)
+    })
+
+    it("ignores undefined env overrides", async () => {
+        process.env.PASSWORD_POLICY_MIN_LENGTH = ""
+
+        const resolver = new PasswordPolicyResolver()
+        resolver.setProjectPolicy({minLength: 14})
+        const policy = await resolver.resolve()
+
+        expect(policy.minLength).toBe(14)
+    })
+})

package/test/security/password-policy-schema-factory.test.ts

@@ -0,0 +1,40 @@
+import {describe, expect, it} from "vitest";
+import PasswordPolicySchemaFactory from "../../src/utils/PasswordPolicySchemaFactory.js";
+import {defaultPasswordPolicy} from "../../src/policies/defaultPasswordPolicy.js";
+
+describe("PasswordPolicySchemaFactory", () => {
+    it("validates minLength", async () => {
+        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        await expect(schema.parseAsync("Abc1234")).rejects.toThrow()
+    })
+
+    it("validates maxLength", async () => {
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, maxLength: 8})
+        await expect(schema.parseAsync("Abcd12345")).rejects.toThrow()
+    })
+
+    it("validates uppercase", async () => {
+        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        await expect(schema.parseAsync("lowercase1")).rejects.toThrow()
+    })
+
+    it("validates lowercase", async () => {
+        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        await expect(schema.parseAsync("UPPERCASE1")).rejects.toThrow()
+    })
+
+    it("validates number", async () => {
+        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        await expect(schema.parseAsync("NoNumbers")).rejects.toThrow()
+    })
+
+    it("validates specialChar", async () => {
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireSpecialChar: true})
+        await expect(schema.parseAsync("NoSpecial1")).rejects.toThrow()
+    })
+
+    it("validates disallowSpaces", async () => {
+        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        await expect(schema.parseAsync("Space 123A")).rejects.toThrow()
+    })
+})

package/test/services/user-service.test.ts

@@ -1,38 +1,173 @@
-import { beforeAll, afterAll, describe, it, expect } from "vitest"
+import {beforeEach, describe, expect, it} from "vitest"
 import UserService from "../../src/services/UserService";
-import MongoInMemory from "../setup/MongoInMemory";
-import RoleMongoInitializer from "../initializers/RoleMongoInitializer";
-import {IRole} from "../../../identity-share/src/interfaces/IRole";
-import UserMongoRepository from "../../src/repository/mongo/UserMongoRepository";
-import {IUserRepository} from "../../src/interfaces/IUserRepository";
+import type {IUserRepository} from "../../src/interfaces/IUserRepository";
+import type {IUser, IUserCreate, IUserUpdate} from "@drax/identity-share";
 import {ValidationError} from "@drax/common-back";
+import PasswordPolicyResolver from "../../src/resolver/PasswordPolicyResolver";
+import PasswordPolicyService from "../../src/services/PasswordPolicyService";
+import type {IUserPasswordHistory} from "../../src/interfaces/IUserPasswordHistory";
+import type {IUserPasswordHistoryRepository} from "../../src/interfaces/IUserPasswordHistoryRepository";
+import UserPasswordHistoryService from "../../src/services/UserPasswordHistoryService";
+
+class InMemoryUserRepository implements IUserRepository {
+    private items = new Map<string, IUser>()
+
+    async create(data: IUserCreate): Promise<IUser> {
+        const user: IUser = {...data, _id: data._id || "user-1", role: data.role as any, tenant: data.tenant as any} as IUser
+        this.items.set(user._id.toString(), user)
+        return {...user}
+    }
+
+    async update(id: string, data: IUserUpdate): Promise<IUser> {
+        const current = this.items.get(id)
+        const updated = {...current, ...data, _id: id} as IUser
+        this.items.set(id, updated)
+        return {...updated}
+    }
+
+    async updatePartial(id: string, data: Partial<IUserUpdate & IUser>): Promise<IUser> {
+        const current = this.items.get(id)
+        const updated = {...current, ...data, _id: id} as IUser
+        this.items.set(id, updated)
+        return {...updated}
+    }
+
+    async delete(id: string): Promise<boolean> {
+        return this.items.delete(id)
+    }
+
+    async findById(id: string): Promise<IUser | null> {
+        const user = this.items.get(id)
+        if (!user) {
+            return null
+        }
+        const safeUser = {...user}
+        delete safeUser.password
+        return safeUser
+    }
+
+    async findByIdWithPassword(id: string): Promise<IUser | null> {
+        const user = this.items.get(id)
+        return user ? {...user} : null
+    }
+
+    async findByUsername(username: string): Promise<IUser | null> {
+        const user = [...this.items.values()].find((item) => item.username === username)
+        if (!user) {
+            return null
+        }
+        const safeUser = {...user}
+        delete safeUser.password
+        return safeUser
+    }
+
+    async findByUsernameWithPassword(username: string): Promise<IUser | null> {
+        const user = [...this.items.values()].find((item) => item.username === username)
+        return user ? {...user} : null
+    }
+
+    async findByEmail(email: string): Promise<IUser | null> {
+        const user = [...this.items.values()].find((item) => item.email === email)
+        return user ? {...user} : null
+    }
+
+    async changePassword(id: string, password: string): Promise<Boolean> {
+        const current = this.items.get(id)
+        this.items.set(id, {...current, password} as IUser)
+        return true
+    }
+
+    async changeAvatar(id: string, avatarUrl: string): Promise<Boolean> {
+        const current = this.items.get(id)
+        this.items.set(id, {...current, avatar: avatarUrl} as IUser)
+        return true
+    }
+
+    async findByEmailCode(code: string): Promise<IUser | null> {
+        const user = [...this.items.values()].find((item) => item.emailCode === code)
+        return user ? {...user} : null
+    }
+
+    async findByPhoneCode(code: string): Promise<IUser | null> {
+        const user = [...this.items.values()].find((item) => item.phoneCode === code)
+        return user ? {...user} : null
+    }
+
+    async findByRecoveryCode(code: string): Promise<IUser | null> {
+        const user = [...this.items.values()].find((item) => item.recoveryCode === code)
+        return user ? {...user} : null
+    }
+
+    async paginate(): Promise<any> {
+        return {items: [...this.items.values()], page: 1, limit: 10, total: this.items.size}
+    }
+
+    async search(): Promise<IUser[]> {
+        return [...this.items.values()]
+    }
+
+    async groupBy(): Promise<any[]> {
+        return []
+    }
+
+    async export(): Promise<IUser[]> {
+        return [...this.items.values()]
+    }
+
+    async count(): Promise<number> {
+        return this.items.size
+    }
+
+    build(): void {
+    }
+}
+
+class InMemoryUserPasswordHistoryRepository implements IUserPasswordHistoryRepository {
+    private items: IUserPasswordHistory[] = []
+
+    async create(data: IUserPasswordHistory): Promise<IUserPasswordHistory> {
+        const created = {...data, _id: `${this.items.length + 1}`, createdAt: new Date()}
+        this.items.unshift(created)
+        return created
+    }
+
+    async findLatestByUserId(userId: string, limit: number): Promise<IUserPasswordHistory[]> {
+        return this.items.filter((item) => item.user === userId).slice(0, limit)
+    }
+}
 
 describe("UserServiceTest", function () {
-    let userRepository: IUserRepository = new UserMongoRepository()
-    let userService = new UserService(userRepository)
-    let adminRole: IRole
-    let userAdminData: any
-    let mongoInMemory: MongoInMemory = new MongoInMemory()
-
-    beforeAll(async () => {
-        await mongoInMemory.connect()
-        adminRole = await RoleMongoInitializer.initAdminRole()
-        userAdminData = (await import("../data-obj/users/root-mongo-user")).default
-        return
-    })
+    let userRepository: IUserRepository
+    let userService: UserService
+    let userAdminData: IUserCreate
+
+    beforeEach(async () => {
+        userRepository = new InMemoryUserRepository()
+        const userPasswordHistoryService = new UserPasswordHistoryService(new InMemoryUserPasswordHistoryRepository())
+        const passwordPolicyService = new PasswordPolicyService(new PasswordPolicyResolver(), userRepository, userPasswordHistoryService)
+        userService = new UserService(userRepository, passwordPolicyService, userPasswordHistoryService)
 
-    afterAll(async () => {
-        await mongoInMemory.dropAndClose()
-        return
+        userAdminData = {
+            _id: "user-1",
+            active: true,
+            groups: [],
+            username: "root",
+            email: "root@example.com",
+            password: "Root1234",
+            name: "root",
+            phone: "123456789",
+            role: "role-1",
+        }
+
+        await userService.create({...userAdminData})
     })
 
     it("should create user", async function () {
-        const userData = {...userAdminData}
+        const userData = {...userAdminData, _id: "user-2", username: "admin2", email: "admin2@example.com"}
         let userCreated = await userService.create(userData)
-        expect(userCreated.username).toBe(userAdminData.username)
+        expect(userCreated.username).toBe(userData.username)
     })
 
-
     it("should find one user", async function () {
         let user = await userService.findById(userAdminData._id)
         expect(user.username).toBe(userAdminData.username)
@@ -42,31 +177,83 @@ describe("UserServiceTest", function () {
         const userData = {...userAdminData}
         const newName = "AdminUpdated"
         userData.name = newName
-        let userUpdated = await userService.update(userAdminData._id, userData)
+        let userUpdated = await userService.update(userAdminData._id, userData as any)
         expect(userUpdated.name).toBe(newName)
     })
 
     it("should fail create user with short password", async function () {
-        let userData = {...userAdminData, password: "123"}
+        let userData = {...userAdminData, _id: "user-3", username: "shortpass", email: "shortpass@example.com", password: "123"}
+
+        await expect(async () => {
+            await userService.create(userData)
+        }).rejects.toSatisfy((err) => {
+            expect(err).toBeInstanceOf(ValidationError)
+            expect(err.errors[0].field).toBe('password')
+            expect(err.errors[0].reason).toBe('validation.password.minLength')
+            return true;
+        });
+    })
+
+    it("create rejects password without uppercase according to policy", async function () {
+        let userData = {...userAdminData, _id: "user-4", username: "no-uppercase", email: "nouppercase@example.com", password: "lowercase1"}
 
         await expect(async () => {
             await userService.create(userData)
         }).rejects.toSatisfy((err) => {
             expect(err).toBeInstanceOf(ValidationError)
             expect(err.errors[0].field).toBe('password')
-            expect(err.errors[0].reason).toBe('validation.password.min8')
+            expect(err.errors[0].reason).toBe('validation.password.requireUppercase')
             return true;
         });
     })
 
+    it("changeUserPassword rejects password that does not meet policy", async function () {
+        const userId = userAdminData._id
+        await expect(async () => {
+            await userService.changeUserPassword(userId, "lowercase1")
+        }).rejects.toSatisfy((err) => {
+            expect(err).toBeInstanceOf(ValidationError)
+            expect(err.errors[0].field).toBe('newPassword')
+            expect(err.errors[0].reason).toBe('validation.password.requireUppercase')
+            return true;
+        });
+    })
 
-    it("should changeUserPassword user", async function () {
+    it("changeOwnPassword rejects password that does not meet policy", async function () {
         const userId = userAdminData._id
-        const newPassword = "123"
-        let userPasswordChanged = await userService.changeUserPassword(userId, newPassword)
-        expect(userPasswordChanged._id.toString()).toBe(userId)
+        await expect(async () => {
+            await userService.changeOwnPassword(userId, "Root1234", "short1A")
+        }).rejects.toSatisfy((err) => {
+            expect(err).toBeInstanceOf(ValidationError)
+            expect(err.errors[0].field).toBe('newPassword')
+            expect(err.errors[0].reason).toBe('validation.password.minLength')
+            return true;
+        });
     })
 
+    it("changeUserPasswordByCode rejects password that does not meet policy", async function () {
+        const code = await userService.recoveryCode(userAdminData.email)
+        await expect(async () => {
+            await userService.changeUserPasswordByCode(code, "lowercase1")
+        }).rejects.toSatisfy((err) => {
+            expect(err).toBeInstanceOf(ValidationError)
+            expect(err.errors[0].field).toBe('newPassword')
+            expect(err.errors[0].reason).toBe('validation.password.requireUppercase')
+            return true;
+        });
+    })
 
+    it("preventReuse rejects a recently used password", async function () {
+        const userId = userAdminData._id
+        await userService.changeUserPassword(userId, "SecondPass1")
 
+        await expect(async () => {
+            await userService.changeUserPassword(userId, "Root1234")
+        }).rejects.toSatisfy((err) => {
+            expect(err).toBeInstanceOf(ValidationError)
+            expect(err.errors[0].field).toBe('newPassword')
+            expect(err.errors[0].reason).toBe('validation.password.preventReuse')
+            return true;
+        });
+    })
 })

package/test/setup/TestSetup.ts

@@ -20,6 +20,7 @@ import basicUserData from "./data/basic-user";
 
 import {IUser, IRole} from "@drax/identity-share";
 import MongoInMemory from "./MongoInMemory";
+import {randomUUID} from "crypto";
 
 class TestSetup {
 
@@ -29,8 +30,12 @@ class TestSetup {
     private _basicUser: IUser;
     private _adminRole: IRole;
     private _restrictedRole: IRole;
+    private readonly dbEngine: "mongo" | "sqlite";
+    private readonly sqliteFile: string;
 
-    constructor() {
+    constructor(dbEngine: "mongo" | "sqlite" = "mongo", sqliteFile?: string) {
+        this.dbEngine = dbEngine
+        this.sqliteFile = sqliteFile || `/tmp/drax-identity-back-${randomUUID()}.sqlite`
     }
 
     async setup() {
@@ -45,8 +50,11 @@ class TestSetup {
 
     setupEnvironmentVariables() {
         // Define environment variables
-        process.env.DRAX_DB_ENGINE = "mongo";
+        process.env.DRAX_DB_ENGINE = this.dbEngine;
         process.env.DRAX_JWT_SECRET = "xxx";
+        if (this.dbEngine === "sqlite") {
+            process.env.DRAX_SQLITE_FILE = this.sqliteFile;
+        }
     }
 
     setupConfig() {
@@ -80,6 +88,9 @@ class TestSetup {
     }
 
     async setupMongoInMemoryAndConnect() {
+        if (this.dbEngine !== "mongo") {
+            return
+        }
         this._mongoInMemory = new MongoInMemory();
         await this._mongoInMemory.connect();
     }
@@ -95,11 +106,18 @@ class TestSetup {
     }
 
     async dropData() {
-        await this._mongoInMemory.dropData()
+        if (this._mongoInMemory) {
+            await this._mongoInMemory.dropData()
+        }
     }
 
     async dropAndClose() {
-        await this._mongoInMemory.dropAndClose()
+        if (this._fastifyInstance) {
+            await this._fastifyInstance.close()
+        }
+        if (this._mongoInMemory) {
+            await this._mongoInMemory.dropAndClose()
+        }
     }
 
     async login(username: string, password: string): Promise<{accessToken: string}> {

package/test/setup/data/basic-user.ts

@@ -4,7 +4,7 @@ const basicUser = {
   groups: [],
   name: "Basic User",
   username:  "basicUser",
-  password: "basic.123",
+  password: "Basic1234",
   email: "basic@example.com",
   phone: "123456789",
   role: "Restricted"

package/test/setup/data/root-user.ts

@@ -4,7 +4,7 @@ const rootUser = {
   groups: [],
   name: "Root",
   username:  "root",
-  password: "root.123",
+  password: "Root1234",
   email: "root@example.com",
   phone: "123456789",
   role: "Admin"