@drax/identity-back 3.20.0 → 3.21.0

package/dist/constants/PasswordSpecialChars.js

@@ -0,0 +1,4 @@
+//Lista hardcodeada en i18n. Si se modifica aca, se tiene que cambiar en i18n
+const allowedSpecialChars = "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";
+export default allowedSpecialChars;
+export { allowedSpecialChars };

package/dist/controllers/UserController.js

@@ -10,6 +10,7 @@ import { IdentityConfig } from "../config/IdentityConfig.js";
 import UserEmailService from "../services/UserEmailService.js";
 import TenantServiceFactory from "../factory/TenantServiceFactory.js";
 import PasswordPolicyServiceFactory from "../factory/PasswordPolicyServiceFactory.js";
+import { allowedSpecialChars } from "../constants/PasswordSpecialChars.js";
 const BASE_FILE_DIR = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
 const AVATAR_DIR = DraxConfig.getOrLoad(IdentityConfig.AvatarDir) || 'avatar';
 const BASE_URL = DraxConfig.getOrLoad(CommonConfig.BaseUrl) ? DraxConfig.get(CommonConfig.BaseUrl).replace(/\/$/, '') : '';
@@ -76,7 +77,11 @@ class UserController extends AbstractFastifyController {
     async passwordPolicy(request, reply) {
         try {
             const passwordPolicyService = PasswordPolicyServiceFactory();
-            return await passwordPolicyService.getFinalPolicy();
+            const policy = await passwordPolicyService.getFinalPolicy();
+            return {
+                ...policy,
+                allowedSpecialChars
+            };
         }
         catch (e) {
             this.handleError(e, reply);

package/dist/schemas/PasswordPolicySchema.js

@@ -6,6 +6,7 @@ const PasswordPolicySchemaBase = z.object({
     requireLowercase: z.boolean(),
     requireNumber: z.boolean(),
     requireSpecialChar: z.boolean(),
+    allowedSpecialChars: z.string().optional(),
     disallowSpaces: z.boolean(),
     preventReuse: z.number().int().min(0),
     expirationDays: z.number().int().min(1).nullable(),

package/dist/services/PasswordPolicyService.js

@@ -3,6 +3,7 @@ import { ZodError } from "zod";
 import { ValidationError, ZodErrorToValidationError } from "@drax/common-back";
 import AuthUtils from "../utils/AuthUtils.js";
 import PasswordPolicySchemaFactory from "../utils/PasswordPolicySchemaFactory.js";
+import { allowedSpecialChars } from "../constants/PasswordSpecialChars.js";
 class PasswordPolicyService {
     constructor(resolver, userRepository, userPasswordHistoryService) {
         this.resolver = resolver;
@@ -42,7 +43,7 @@ class PasswordPolicyService {
         const uppercaseChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
         const lowercaseChars = "abcdefghijkmnopqrstuvwxyz";
         const numericChars = "0123456789";
-        const specialChars = "!@#$%&*_-+=";
+        const specialChars = allowedSpecialChars;
         const fallbackSpecial = policy.disallowSpaces ? "!" : " ";
         const combinedChars = [
             uppercaseChars,

package/dist/utils/PasswordPolicySchemaFactory.js

@@ -1,4 +1,5 @@
 import z from "zod";
+import { allowedSpecialChars } from "../constants/PasswordSpecialChars.js";
 class PasswordPolicySchemaFactory {
     static create(policy) {
         const cacheKey = JSON.stringify(policy);
@@ -20,7 +21,7 @@ class PasswordPolicySchemaFactory {
             schema = schema.regex(/[0-9]/, "validation.password.requireNumber");
         }
         if (policy.requireSpecialChar) {
-            schema = schema.regex(/[^A-Za-z0-9]/, "validation.password.requireSpecialChar");
+            schema = schema.refine((value) => [...value].some((char) => allowedSpecialChars.includes(char)), "validation.password.requireSpecialChar");
         }
         if (policy.disallowSpaces) {
             schema = schema.refine((value) => !/\s/.test(value), {

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "3.20.0",
+  "version": "3.21.0",
   "description": "Identity module for user management, authentication and authorization.",
   "main": "dist/index.js",
   "types": "types/index.d.ts",
@@ -29,10 +29,10 @@
   "license": "ISC",
   "dependencies": {
     "@drax/common-back": "^3.18.0",
-    "@drax/crud-back": "^3.20.0",
-    "@drax/crud-share": "^3.20.0",
+    "@drax/crud-back": "^3.21.0",
+    "@drax/crud-share": "^3.21.0",
     "@drax/email-back": "^3.1.0",
-    "@drax/identity-share": "^3.15.0",
+    "@drax/identity-share": "^3.21.0",
     "bcryptjs": "^2.4.3",
     "graphql": "^16.8.2",
     "jsonwebtoken": "^9.0.2"
@@ -63,5 +63,5 @@
       "debug": "0"
     }
   },
-  "gitHead": "6d4aea4d05133be679166e398ec6a3ae61503d9e"
+  "gitHead": "9ceebbba20e7abf7337387e2a81d1475b9ba1bca"
 }

package/src/constants/PasswordSpecialChars.ts

@@ -0,0 +1,5 @@
+//Lista hardcodeada en i18n. Si se modifica aca, se tiene que cambiar en i18n
+const allowedSpecialChars = "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"
+
+export default allowedSpecialChars
+export {allowedSpecialChars}

package/src/controllers/UserController.ts

@@ -21,6 +21,7 @@ import {IDraxCrudEvent, IDraxFieldFilter} from "@drax/crud-share";
 import TenantServiceFactory from "../factory/TenantServiceFactory.js";
 import {CustomRequest} from "@drax/crud-back/dist";
 import PasswordPolicyServiceFactory from "../factory/PasswordPolicyServiceFactory.js";
+import {allowedSpecialChars} from "../constants/PasswordSpecialChars.js";
 
 const BASE_FILE_DIR = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
 const AVATAR_DIR = DraxConfig.getOrLoad(IdentityConfig.AvatarDir) || 'avatar';
@@ -95,7 +96,11 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
     async passwordPolicy(request, reply) {
         try {
             const passwordPolicyService = PasswordPolicyServiceFactory()
-            return await passwordPolicyService.getFinalPolicy()
+            const policy = await passwordPolicyService.getFinalPolicy()
+            return {
+                ...policy,
+                allowedSpecialChars
+            }
         } catch (e) {
             this.handleError(e, reply)
         }

package/src/schemas/PasswordPolicySchema.ts

@@ -7,6 +7,7 @@ const PasswordPolicySchemaBase = z.object({
     requireLowercase: z.boolean(),
     requireNumber: z.boolean(),
     requireSpecialChar: z.boolean(),
+    allowedSpecialChars: z.string().optional(),
     disallowSpaces: z.boolean(),
     preventReuse: z.number().int().min(0),
     expirationDays: z.number().int().min(1).nullable(),

package/src/services/PasswordPolicyService.ts

@@ -9,6 +9,7 @@ import type {IUserRepository} from "../interfaces/IUserRepository";
 import AuthUtils from "../utils/AuthUtils.js";
 import PasswordPolicyResolver from "../resolver/PasswordPolicyResolver.js";
 import PasswordPolicySchemaFactory from "../utils/PasswordPolicySchemaFactory.js";
+import {allowedSpecialChars} from "../constants/PasswordSpecialChars.js";
 
 interface IValidatePasswordOptions {
     field?: string
@@ -60,7 +61,7 @@ class PasswordPolicyService {
         const uppercaseChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
         const lowercaseChars = "abcdefghijkmnopqrstuvwxyz"
         const numericChars = "0123456789"
-        const specialChars = "!@#$%&*_-+="
+        const specialChars = allowedSpecialChars
         const fallbackSpecial = policy.disallowSpaces ? "!" : " "
         const combinedChars = [
             uppercaseChars,

package/src/utils/PasswordPolicySchemaFactory.ts

@@ -1,5 +1,6 @@
 import z from "zod";
 import type {IPasswordPolicy} from "@drax/identity-share";
+import {allowedSpecialChars} from "../constants/PasswordSpecialChars.js";
 
 class PasswordPolicySchemaFactory {
     private static cache = new Map<string, z.ZodType<string>>()
@@ -29,7 +30,10 @@ class PasswordPolicySchemaFactory {
         }
 
         if (policy.requireSpecialChar) {
-            schema = schema.regex(/[^A-Za-z0-9]/, "validation.password.requireSpecialChar")
+            schema = schema.refine(
+                (value) => [...value].some((char) => allowedSpecialChars.includes(char)),
+                "validation.password.requireSpecialChar"
+            )
         }
 
         if (policy.disallowSpaces) {

package/test/endpoints/password-policy-route.test.ts

@@ -1,6 +1,7 @@
 import {afterAll, beforeAll, describe, expect, it} from "vitest";
 import {LoadIdentityConfigFromEnv} from "../../src/setup/LoadIdentityConfigFromEnv.js";
 import {TestSetup} from "../setup/TestSetup";
+import {allowedSpecialChars} from "../../src/constants/PasswordSpecialChars.js";
 
 describe("Password Policy Route Test", () => {
     const testSetup = new TestSetup("sqlite")
@@ -28,6 +29,7 @@ describe("Password Policy Route Test", () => {
         const body = response.json()
         expect(body.minLength).toBe(18)
         expect(body.requireSpecialChar).toBe(true)
-        expect(body.requireUppercase).toBe(true)
+        expect(body.allowedSpecialChars).toBe(allowedSpecialChars)
+        expect(body.requireUppercase).toBe(false)
     })
 })

package/test/security/password-policy-schema-factory.test.ts

@@ -1,11 +1,12 @@
 import {describe, expect, it} from "vitest";
 import PasswordPolicySchemaFactory from "../../src/utils/PasswordPolicySchemaFactory.js";
 import {defaultPasswordPolicy} from "../../src/policies/defaultPasswordPolicy.js";
+import {allowedSpecialChars} from "../../src/constants/PasswordSpecialChars.js";
 
 describe("PasswordPolicySchemaFactory", () => {
     it("validates minLength", async () => {
         const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
-        await expect(schema.parseAsync("Abc1234")).rejects.toThrow()
+        await expect(schema.parseAsync("Abc12")).rejects.toThrow()
     })
 
     it("validates maxLength", async () => {
@@ -14,17 +15,17 @@ describe("PasswordPolicySchemaFactory", () => {
     })
 
     it("validates uppercase", async () => {
-        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireUppercase: true})
         await expect(schema.parseAsync("lowercase1")).rejects.toThrow()
     })
 
     it("validates lowercase", async () => {
-        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireLowercase: true})
         await expect(schema.parseAsync("UPPERCASE1")).rejects.toThrow()
     })
 
     it("validates number", async () => {
-        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireNumber: true})
         await expect(schema.parseAsync("NoNumbers")).rejects.toThrow()
     })
 
@@ -33,6 +34,16 @@ describe("PasswordPolicySchemaFactory", () => {
         await expect(schema.parseAsync("NoSpecial1")).rejects.toThrow()
     })
 
+    it("accepts allowed special chars", async () => {
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireSpecialChar: true})
+        await expect(schema.parseAsync(`Password1${allowedSpecialChars.at(-1)}`)).resolves.toBeDefined()
+    })
+
+    it("rejects special chars outside the allowed list", async () => {
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireSpecialChar: true})
+        await expect(schema.parseAsync("Password1ñ")).rejects.toThrow()
+    })
+
     it("validates disallowSpaces", async () => {
         const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
         await expect(schema.parseAsync("Space 123A")).rejects.toThrow()

package/test/services/user-service.test.ts

@@ -8,6 +8,7 @@ import PasswordPolicyService from "../../src/services/PasswordPolicyService";
 import type {IUserPasswordHistory} from "../../src/interfaces/IUserPasswordHistory";
 import type {IUserPasswordHistoryRepository} from "../../src/interfaces/IUserPasswordHistoryRepository";
 import UserPasswordHistoryService from "../../src/services/UserPasswordHistoryService";
+import {allowedSpecialChars} from "../../src/constants/PasswordSpecialChars";
 
 class InMemoryUserRepository implements IUserRepository {
     private items = new Map<string, IUser>()
@@ -144,7 +145,9 @@ describe("UserServiceTest", function () {
     beforeEach(async () => {
         userRepository = new InMemoryUserRepository()
         const userPasswordHistoryService = new UserPasswordHistoryService(new InMemoryUserPasswordHistoryRepository())
-        const passwordPolicyService = new PasswordPolicyService(new PasswordPolicyResolver(), userRepository, userPasswordHistoryService)
+        const passwordPolicyResolver = new PasswordPolicyResolver()
+        passwordPolicyResolver.setProjectPolicy({requireUppercase: true})
+        const passwordPolicyService = new PasswordPolicyService(passwordPolicyResolver, userRepository, userPasswordHistoryService)
         userService = new UserService(userRepository, passwordPolicyService, userPasswordHistoryService)
 
         userAdminData = {
@@ -222,7 +225,7 @@ describe("UserServiceTest", function () {
     it("changeOwnPassword rejects password that does not meet policy", async function () {
         const userId = userAdminData._id
         await expect(async () => {
-            await userService.changeOwnPassword(userId, "Root1234", "short1A")
+            await userService.changeOwnPassword(userId, "Root1234", "sho1A")
         }).rejects.toSatisfy((err) => {
             expect(err).toBeInstanceOf(ValidationError)
             expect(err.errors[0].field).toBe('newPassword')
@@ -256,4 +259,20 @@ describe("UserServiceTest", function () {
             return true;
         });
     })
+
+    it("validatePassword returns allowedSpecialChars when required special char is invalid", async function () {
+        const resolver = new PasswordPolicyResolver()
+        resolver.setProjectPolicy({requireSpecialChar: true})
+        const passwordPolicyService = new PasswordPolicyService(resolver, userRepository)
+
+        await expect(async () => {
+            await passwordPolicyService.validatePassword("Password1ñ")
+        }).rejects.toSatisfy((err) => {
+            expect(err).toBeInstanceOf(ValidationError)
+            expect(err.errors[0].field).toBe('password')
+            expect(err.errors[0].reason).toBe('validation.password.requireSpecialChar')
+            expect(err.errors[0].allowedSpecialChars).toBe(allowedSpecialChars)
+            return true;
+        });
+    })
 })