@drax/identity-back 3.20.0 → 3.23.0

package/dist/config/PasswordPolicyConfig.js

@@ -6,6 +6,7 @@ var PasswordPolicyConfig;
     PasswordPolicyConfig["RequireLowercase"] = "PASSWORD_POLICY_REQUIRE_LOWERCASE";
     PasswordPolicyConfig["RequireNumber"] = "PASSWORD_POLICY_REQUIRE_NUMBER";
     PasswordPolicyConfig["RequireSpecialChar"] = "PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR";
+    PasswordPolicyConfig["AllowedSpecialChars"] = "PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS";
     PasswordPolicyConfig["DisallowSpaces"] = "PASSWORD_POLICY_DISALLOW_SPACES";
     PasswordPolicyConfig["PreventReuse"] = "PASSWORD_POLICY_PREVENT_REUSE";
     PasswordPolicyConfig["ExpirationDays"] = "PASSWORD_POLICY_EXPIRATION_DAYS";

package/dist/constants/PasswordSpecialChars.js

@@ -0,0 +1,4 @@
+//Lista hardcodeada en i18n. Si se modifica aca, se tiene que cambiar en i18n
+const allowedSpecialChars = "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";
+export default allowedSpecialChars;
+export { allowedSpecialChars };

package/dist/policies/defaultPasswordPolicy.js

@@ -5,6 +5,7 @@ const defaultPasswordPolicy = {
     requireLowercase: false,
     requireNumber: false,
     requireSpecialChar: false,
+    allowedSpecialChars: "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~",
     disallowSpaces: true,
     preventReuse: 3,
     expirationDays: null

package/dist/schemas/PasswordPolicySchema.js

@@ -6,6 +6,7 @@ const PasswordPolicySchemaBase = z.object({
     requireLowercase: z.boolean(),
     requireNumber: z.boolean(),
     requireSpecialChar: z.boolean(),
+    allowedSpecialChars: z.string(),
     disallowSpaces: z.boolean(),
     preventReuse: z.number().int().min(0),
     expirationDays: z.number().int().min(1).nullable(),

package/dist/services/PasswordPolicyService.js

@@ -18,8 +18,9 @@ class PasswordPolicyService {
     }
     async validatePassword(password, options) {
         const field = options?.field || "password";
+        const policy = await this.getFinalPolicy();
         try {
-            const schema = await this.getPasswordSchema();
+            const schema = PasswordPolicySchemaFactory.create(policy);
             await schema.parseAsync(password);
         }
         catch (e) {
@@ -42,7 +43,7 @@ class PasswordPolicyService {
         const uppercaseChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
         const lowercaseChars = "abcdefghijkmnopqrstuvwxyz";
         const numericChars = "0123456789";
-        const specialChars = "!@#$%&*_-+=";
+        const specialChars = policy.allowedSpecialChars;
         const fallbackSpecial = policy.disallowSpaces ? "!" : " ";
         const combinedChars = [
             uppercaseChars,

package/dist/setup/LoadIdentityConfigFromEnv.js

@@ -14,6 +14,7 @@ function LoadIdentityConfigFromEnv() {
     DraxConfig.set(PasswordPolicyConfig.RequireLowercase, process.env[PasswordPolicyConfig.RequireLowercase]);
     DraxConfig.set(PasswordPolicyConfig.RequireNumber, process.env[PasswordPolicyConfig.RequireNumber]);
     DraxConfig.set(PasswordPolicyConfig.RequireSpecialChar, process.env[PasswordPolicyConfig.RequireSpecialChar]);
+    DraxConfig.set(PasswordPolicyConfig.AllowedSpecialChars, process.env[PasswordPolicyConfig.AllowedSpecialChars]);
     DraxConfig.set(PasswordPolicyConfig.DisallowSpaces, process.env[PasswordPolicyConfig.DisallowSpaces]);
     DraxConfig.set(PasswordPolicyConfig.PreventReuse, process.env[PasswordPolicyConfig.PreventReuse]);
     DraxConfig.set(PasswordPolicyConfig.ExpirationDays, process.env[PasswordPolicyConfig.ExpirationDays]);

package/dist/utils/PasswordPolicySchemaFactory.js

@@ -20,7 +20,7 @@ class PasswordPolicySchemaFactory {
             schema = schema.regex(/[0-9]/, "validation.password.requireNumber");
         }
         if (policy.requireSpecialChar) {
-            schema = schema.regex(/[^A-Za-z0-9]/, "validation.password.requireSpecialChar");
+            schema = schema.refine((value) => [...value].some((char) => policy.allowedSpecialChars.includes(char)), "validation.password.requireSpecialChar");
         }
         if (policy.disallowSpaces) {
             schema = schema.refine((value) => !/\s/.test(value), {

package/dist/utils/getPasswordEnvPolicy.js

@@ -9,6 +9,7 @@ function getPasswordEnvPolicy() {
         requireLowercase: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireLowercase, "boolean"),
         requireNumber: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireNumber, "boolean"),
         requireSpecialChar: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireSpecialChar, "boolean"),
+        allowedSpecialChars: DraxConfig.getOrLoad(PasswordPolicyConfig.AllowedSpecialChars),
         disallowSpaces: DraxConfig.getOrLoad(PasswordPolicyConfig.DisallowSpaces, "boolean"),
         preventReuse: DraxConfig.getOrLoad(PasswordPolicyConfig.PreventReuse, "number"),
         expirationDays: DraxConfig.getOrLoad(PasswordPolicyConfig.ExpirationDays, "number")

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "3.20.0",
+  "version": "3.23.0",
   "description": "Identity module for user management, authentication and authorization.",
   "main": "dist/index.js",
   "types": "types/index.d.ts",
@@ -29,10 +29,10 @@
   "license": "ISC",
   "dependencies": {
     "@drax/common-back": "^3.18.0",
-    "@drax/crud-back": "^3.20.0",
-    "@drax/crud-share": "^3.20.0",
+    "@drax/crud-back": "^3.23.0",
+    "@drax/crud-share": "^3.21.0",
     "@drax/email-back": "^3.1.0",
-    "@drax/identity-share": "^3.15.0",
+    "@drax/identity-share": "^3.23.0",
     "bcryptjs": "^2.4.3",
     "graphql": "^16.8.2",
     "jsonwebtoken": "^9.0.2"
@@ -63,5 +63,5 @@
       "debug": "0"
     }
   },
-  "gitHead": "6d4aea4d05133be679166e398ec6a3ae61503d9e"
+  "gitHead": "5768e7721a2eaa06cf4bcf97811897613a8c9470"
 }

package/src/config/PasswordPolicyConfig.ts

@@ -5,6 +5,7 @@ enum PasswordPolicyConfig {
     RequireLowercase = "PASSWORD_POLICY_REQUIRE_LOWERCASE",
     RequireNumber = "PASSWORD_POLICY_REQUIRE_NUMBER",
     RequireSpecialChar = "PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR",
+    AllowedSpecialChars = "PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS",
     DisallowSpaces = "PASSWORD_POLICY_DISALLOW_SPACES",
     PreventReuse = "PASSWORD_POLICY_PREVENT_REUSE",
     ExpirationDays = "PASSWORD_POLICY_EXPIRATION_DAYS",

package/src/controllers/UserController.ts

@@ -19,7 +19,7 @@ import {IdentityConfig} from "../config/IdentityConfig.js";
 import UserEmailService from "../services/UserEmailService.js";
 import {IDraxCrudEvent, IDraxFieldFilter} from "@drax/crud-share";
 import TenantServiceFactory from "../factory/TenantServiceFactory.js";
-import {CustomRequest} from "@drax/crud-back/dist";
+import {CustomRequest} from "@drax/crud-back";
 import PasswordPolicyServiceFactory from "../factory/PasswordPolicyServiceFactory.js";
 
 const BASE_FILE_DIR = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';

package/src/policies/defaultPasswordPolicy.ts

@@ -1,4 +1,4 @@
-import type {IPasswordPolicy} from "@drax/identity-share/dist";
+import type {IPasswordPolicy} from "@drax/identity-share";
 
 const defaultPasswordPolicy: IPasswordPolicy = {
     minLength: 6,
@@ -7,6 +7,7 @@ const defaultPasswordPolicy: IPasswordPolicy = {
     requireLowercase: false,
     requireNumber: false,
     requireSpecialChar: false,
+    allowedSpecialChars: "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~",
     disallowSpaces: true,
     preventReuse: 3,
     expirationDays: null

package/src/schemas/PasswordPolicySchema.ts

@@ -7,6 +7,7 @@ const PasswordPolicySchemaBase = z.object({
     requireLowercase: z.boolean(),
     requireNumber: z.boolean(),
     requireSpecialChar: z.boolean(),
+    allowedSpecialChars: z.string(),
     disallowSpaces: z.boolean(),
     preventReuse: z.number().int().min(0),
     expirationDays: z.number().int().min(1).nullable(),

package/src/services/PasswordPolicyService.ts

@@ -35,8 +35,9 @@ class PasswordPolicyService {
 
     async validatePassword(password: string,  options?: IValidatePasswordOptions): Promise<void> {
         const field = options?.field || "password"
+        const policy = await this.getFinalPolicy()
         try {
-            const schema = await this.getPasswordSchema()
+            const schema = PasswordPolicySchemaFactory.create(policy)
             await schema.parseAsync(password)
         } catch (e) {
             if (e instanceof ZodError) {
@@ -60,7 +61,7 @@ class PasswordPolicyService {
         const uppercaseChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
         const lowercaseChars = "abcdefghijkmnopqrstuvwxyz"
         const numericChars = "0123456789"
-        const specialChars = "!@#$%&*_-+="
+        const specialChars = policy.allowedSpecialChars
         const fallbackSpecial = policy.disallowSpaces ? "!" : " "
         const combinedChars = [
             uppercaseChars,

package/src/setup/LoadIdentityConfigFromEnv.ts

@@ -18,6 +18,7 @@ function LoadIdentityConfigFromEnv() {
     DraxConfig.set(PasswordPolicyConfig.RequireLowercase, process.env[PasswordPolicyConfig.RequireLowercase])
     DraxConfig.set(PasswordPolicyConfig.RequireNumber, process.env[PasswordPolicyConfig.RequireNumber])
     DraxConfig.set(PasswordPolicyConfig.RequireSpecialChar, process.env[PasswordPolicyConfig.RequireSpecialChar])
+    DraxConfig.set(PasswordPolicyConfig.AllowedSpecialChars, process.env[PasswordPolicyConfig.AllowedSpecialChars])
     DraxConfig.set(PasswordPolicyConfig.DisallowSpaces, process.env[PasswordPolicyConfig.DisallowSpaces])
     DraxConfig.set(PasswordPolicyConfig.PreventReuse, process.env[PasswordPolicyConfig.PreventReuse])
     DraxConfig.set(PasswordPolicyConfig.ExpirationDays, process.env[PasswordPolicyConfig.ExpirationDays])

package/src/utils/PasswordPolicySchemaFactory.ts

@@ -29,7 +29,10 @@ class PasswordPolicySchemaFactory {
         }
 
         if (policy.requireSpecialChar) {
-            schema = schema.regex(/[^A-Za-z0-9]/, "validation.password.requireSpecialChar")
+            schema = schema.refine(
+                (value) => [...value].some((char) => policy.allowedSpecialChars.includes(char)),
+                "validation.password.requireSpecialChar"
+            )
         }
 
         if (policy.disallowSpaces) {

package/src/utils/getPasswordEnvPolicy.ts

@@ -11,6 +11,7 @@ function getPasswordEnvPolicy(): Partial<IPasswordPolicy> {
         requireLowercase: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireLowercase, "boolean"),
         requireNumber: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireNumber, "boolean"),
         requireSpecialChar: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireSpecialChar, "boolean"),
+        allowedSpecialChars: DraxConfig.getOrLoad(PasswordPolicyConfig.AllowedSpecialChars),
         disallowSpaces: DraxConfig.getOrLoad(PasswordPolicyConfig.DisallowSpaces, "boolean"),
         preventReuse: DraxConfig.getOrLoad(PasswordPolicyConfig.PreventReuse, "number"),
         expirationDays: DraxConfig.getOrLoad(PasswordPolicyConfig.ExpirationDays, "number")

package/test/endpoints/password-policy-route.test.ts

@@ -9,12 +9,14 @@ describe("Password Policy Route Test", () => {
         await testSetup.setup()
         process.env.PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR = "true"
         process.env.PASSWORD_POLICY_MIN_LENGTH = "18"
+        process.env.PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS = "@%"
         LoadIdentityConfigFromEnv()
     })
 
     afterAll(async () => {
         delete process.env.PASSWORD_POLICY_MIN_LENGTH
         delete process.env.PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR
+        delete process.env.PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS
         await testSetup.dropAndClose()
     })
 
@@ -28,6 +30,7 @@ describe("Password Policy Route Test", () => {
         const body = response.json()
         expect(body.minLength).toBe(18)
         expect(body.requireSpecialChar).toBe(true)
-        expect(body.requireUppercase).toBe(true)
+        expect(body.allowedSpecialChars).toBe("@%")
+        expect(body.requireUppercase).toBe(false)
     })
 })

package/test/security/password-policy-resolver.test.ts

@@ -8,18 +8,21 @@ describe("PasswordPolicyResolver", () => {
         delete process.env.PASSWORD_POLICY_MIN_LENGTH
         delete process.env.PASSWORD_POLICY_MAX_LENGTH
         delete process.env.PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR
+        delete process.env.PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS
         DraxConfig.set(PasswordPolicyConfig.MinLength, undefined)
         DraxConfig.set(PasswordPolicyConfig.MaxLength, undefined)
         DraxConfig.set(PasswordPolicyConfig.RequireSpecialChar, undefined)
+        DraxConfig.set(PasswordPolicyConfig.AllowedSpecialChars, undefined)
     })
 
     it("uses default policy when there are no overrides", async () => {
         const resolver = new PasswordPolicyResolver()
         const policy = await resolver.resolve()
 
-        expect(policy.minLength).toBe(8)
+        expect(policy.minLength).toBe(6)
         expect(policy.maxLength).toBe(64)
-        expect(policy.requireUppercase).toBe(true)
+        expect(policy.requireUppercase).toBe(false)
+        expect(policy.allowedSpecialChars).toBe("!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~")
     })
 
     it("project policy overrides default policy", async () => {
@@ -32,15 +35,26 @@ describe("PasswordPolicyResolver", () => {
         expect(policy.requireUppercase).toBe(false)
     })
 
+    it("project policy can override allowed special chars", async () => {
+        const resolver = new PasswordPolicyResolver()
+        resolver.setProjectPolicy({allowedSpecialChars: "%@"})
+        const policy = await resolver.resolve()
+
+        expect(policy.allowedSpecialChars).toBe("%@")
+    })
+
     it("env policy overrides project policy", async () => {
         process.env.PASSWORD_POLICY_MIN_LENGTH = "16"
         process.env.PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR = "false"
+        process.env.PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS = "%^"
 
         const resolver = new PasswordPolicyResolver()
+        resolver.setProjectPolicy({allowedSpecialChars: "@@"})
         const policy = await resolver.resolve()
 
         expect(policy.minLength).toBe(16)
         expect(policy.requireSpecialChar).toBe(false)
+        expect(policy.allowedSpecialChars).toBe("%^")
     })
 
     it("ignores undefined env overrides", async () => {

package/test/security/password-policy-schema-factory.test.ts

@@ -5,7 +5,7 @@ import {defaultPasswordPolicy} from "../../src/policies/defaultPasswordPolicy.js
 describe("PasswordPolicySchemaFactory", () => {
     it("validates minLength", async () => {
         const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
-        await expect(schema.parseAsync("Abc1234")).rejects.toThrow()
+        await expect(schema.parseAsync("Abc12")).rejects.toThrow()
     })
 
     it("validates maxLength", async () => {
@@ -14,17 +14,17 @@ describe("PasswordPolicySchemaFactory", () => {
     })
 
     it("validates uppercase", async () => {
-        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireUppercase: true})
         await expect(schema.parseAsync("lowercase1")).rejects.toThrow()
     })
 
     it("validates lowercase", async () => {
-        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireLowercase: true})
         await expect(schema.parseAsync("UPPERCASE1")).rejects.toThrow()
     })
 
     it("validates number", async () => {
-        const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireNumber: true})
         await expect(schema.parseAsync("NoNumbers")).rejects.toThrow()
     })
 
@@ -33,6 +33,27 @@ describe("PasswordPolicySchemaFactory", () => {
         await expect(schema.parseAsync("NoSpecial1")).rejects.toThrow()
     })
 
+    it("accepts allowed special chars", async () => {
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireSpecialChar: true})
+        await expect(schema.parseAsync(`Password1${defaultPasswordPolicy.allowedSpecialChars.at(-1)}`)).resolves.toBeDefined()
+    })
+
+    it("rejects special chars outside the allowed list", async () => {
+        const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireSpecialChar: true})
+        await expect(schema.parseAsync("Password1ñ")).rejects.toThrow()
+    })
+
+    it("uses the special chars defined in the policy", async () => {
+        const schema = PasswordPolicySchemaFactory.create({
+            ...defaultPasswordPolicy,
+            requireSpecialChar: true,
+            allowedSpecialChars: "%"
+        })
+
+        await expect(schema.parseAsync("Password1%")).resolves.toBeDefined()
+        await expect(schema.parseAsync("Password1!")).rejects.toThrow()
+    })
+
     it("validates disallowSpaces", async () => {
         const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
         await expect(schema.parseAsync("Space 123A")).rejects.toThrow()

package/test/services/user-service.test.ts

@@ -144,7 +144,9 @@ describe("UserServiceTest", function () {
     beforeEach(async () => {
         userRepository = new InMemoryUserRepository()
         const userPasswordHistoryService = new UserPasswordHistoryService(new InMemoryUserPasswordHistoryRepository())
-        const passwordPolicyService = new PasswordPolicyService(new PasswordPolicyResolver(), userRepository, userPasswordHistoryService)
+        const passwordPolicyResolver = new PasswordPolicyResolver()
+        passwordPolicyResolver.setProjectPolicy({requireUppercase: true})
+        const passwordPolicyService = new PasswordPolicyService(passwordPolicyResolver, userRepository, userPasswordHistoryService)
         userService = new UserService(userRepository, passwordPolicyService, userPasswordHistoryService)
 
         userAdminData = {
@@ -222,7 +224,7 @@ describe("UserServiceTest", function () {
     it("changeOwnPassword rejects password that does not meet policy", async function () {
         const userId = userAdminData._id
         await expect(async () => {
-            await userService.changeOwnPassword(userId, "Root1234", "short1A")
+            await userService.changeOwnPassword(userId, "Root1234", "sho1A")
         }).rejects.toSatisfy((err) => {
             expect(err).toBeInstanceOf(ValidationError)
             expect(err.errors[0].field).toBe('newPassword')
@@ -256,4 +258,20 @@ describe("UserServiceTest", function () {
             return true;
         });
     })
+
+    it("validatePassword returns allowedSpecialChars when required special char is invalid", async function () {
+        const resolver = new PasswordPolicyResolver()
+        resolver.setProjectPolicy({requireSpecialChar: true, allowedSpecialChars: "%"})
+        const passwordPolicyService = new PasswordPolicyService(resolver, userRepository)
+
+        await expect(async () => {
+            await passwordPolicyService.validatePassword("Password1ñ")
+        }).rejects.toSatisfy((err) => {
+            expect(err).toBeInstanceOf(ValidationError)
+            expect(err.errors[0].field).toBe('password')
+            expect(err.errors[0].reason).toBe('validation.password.requireSpecialChar')
+            expect(err.errors[0].allowedSpecialChars).toBe("%")
+            return true;
+        });
+    })
 })