@drax/identity-back 3.21.0 → 3.26.0

package/dist/config/PasswordPolicyConfig.js

@@ -6,6 +6,7 @@ var PasswordPolicyConfig;
     PasswordPolicyConfig["RequireLowercase"] = "PASSWORD_POLICY_REQUIRE_LOWERCASE";
     PasswordPolicyConfig["RequireNumber"] = "PASSWORD_POLICY_REQUIRE_NUMBER";
     PasswordPolicyConfig["RequireSpecialChar"] = "PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR";
+    PasswordPolicyConfig["AllowedSpecialChars"] = "PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS";
     PasswordPolicyConfig["DisallowSpaces"] = "PASSWORD_POLICY_DISALLOW_SPACES";
     PasswordPolicyConfig["PreventReuse"] = "PASSWORD_POLICY_PREVENT_REUSE";
     PasswordPolicyConfig["ExpirationDays"] = "PASSWORD_POLICY_EXPIRATION_DAYS";

package/dist/controllers/UserController.js

@@ -10,7 +10,6 @@ import { IdentityConfig } from "../config/IdentityConfig.js";
 import UserEmailService from "../services/UserEmailService.js";
 import TenantServiceFactory from "../factory/TenantServiceFactory.js";
 import PasswordPolicyServiceFactory from "../factory/PasswordPolicyServiceFactory.js";
-import { allowedSpecialChars } from "../constants/PasswordSpecialChars.js";
 const BASE_FILE_DIR = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
 const AVATAR_DIR = DraxConfig.getOrLoad(IdentityConfig.AvatarDir) || 'avatar';
 const BASE_URL = DraxConfig.getOrLoad(CommonConfig.BaseUrl) ? DraxConfig.get(CommonConfig.BaseUrl).replace(/\/$/, '') : '';
@@ -77,11 +76,7 @@ class UserController extends AbstractFastifyController {
     async passwordPolicy(request, reply) {
         try {
             const passwordPolicyService = PasswordPolicyServiceFactory();
-            const policy = await passwordPolicyService.getFinalPolicy();
-            return {
-                ...policy,
-                allowedSpecialChars
-            };
+            return await passwordPolicyService.getFinalPolicy();
         }
         catch (e) {
             this.handleError(e, reply);

package/dist/policies/defaultPasswordPolicy.js

@@ -5,6 +5,7 @@ const defaultPasswordPolicy = {
     requireLowercase: false,
     requireNumber: false,
     requireSpecialChar: false,
+    allowedSpecialChars: "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~",
     disallowSpaces: true,
     preventReuse: 3,
     expirationDays: null

package/dist/schemas/PasswordPolicySchema.js

@@ -6,7 +6,7 @@ const PasswordPolicySchemaBase = z.object({
     requireLowercase: z.boolean(),
     requireNumber: z.boolean(),
     requireSpecialChar: z.boolean(),
-    allowedSpecialChars: z.string().optional(),
+    allowedSpecialChars: z.string(),
     disallowSpaces: z.boolean(),
     preventReuse: z.number().int().min(0),
     expirationDays: z.number().int().min(1).nullable(),

package/dist/services/PasswordPolicyService.js

@@ -3,7 +3,6 @@ import { ZodError } from "zod";
 import { ValidationError, ZodErrorToValidationError } from "@drax/common-back";
 import AuthUtils from "../utils/AuthUtils.js";
 import PasswordPolicySchemaFactory from "../utils/PasswordPolicySchemaFactory.js";
-import { allowedSpecialChars } from "../constants/PasswordSpecialChars.js";
 class PasswordPolicyService {
     constructor(resolver, userRepository, userPasswordHistoryService) {
         this.resolver = resolver;
@@ -19,8 +18,9 @@ class PasswordPolicyService {
     }
     async validatePassword(password, options) {
         const field = options?.field || "password";
+        const policy = await this.getFinalPolicy();
         try {
-            const schema = await this.getPasswordSchema();
+            const schema = PasswordPolicySchemaFactory.create(policy);
             await schema.parseAsync(password);
         }
         catch (e) {
@@ -43,7 +43,7 @@ class PasswordPolicyService {
         const uppercaseChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
         const lowercaseChars = "abcdefghijkmnopqrstuvwxyz";
         const numericChars = "0123456789";
-        const specialChars = allowedSpecialChars;
+        const specialChars = policy.allowedSpecialChars;
         const fallbackSpecial = policy.disallowSpaces ? "!" : " ";
         const combinedChars = [
             uppercaseChars,

package/dist/setup/LoadIdentityConfigFromEnv.js

@@ -14,6 +14,7 @@ function LoadIdentityConfigFromEnv() {
     DraxConfig.set(PasswordPolicyConfig.RequireLowercase, process.env[PasswordPolicyConfig.RequireLowercase]);
     DraxConfig.set(PasswordPolicyConfig.RequireNumber, process.env[PasswordPolicyConfig.RequireNumber]);
     DraxConfig.set(PasswordPolicyConfig.RequireSpecialChar, process.env[PasswordPolicyConfig.RequireSpecialChar]);
+    DraxConfig.set(PasswordPolicyConfig.AllowedSpecialChars, process.env[PasswordPolicyConfig.AllowedSpecialChars]);
     DraxConfig.set(PasswordPolicyConfig.DisallowSpaces, process.env[PasswordPolicyConfig.DisallowSpaces]);
     DraxConfig.set(PasswordPolicyConfig.PreventReuse, process.env[PasswordPolicyConfig.PreventReuse]);
     DraxConfig.set(PasswordPolicyConfig.ExpirationDays, process.env[PasswordPolicyConfig.ExpirationDays]);

package/dist/utils/PasswordPolicySchemaFactory.js

@@ -1,5 +1,4 @@
 import z from "zod";
-import { allowedSpecialChars } from "../constants/PasswordSpecialChars.js";
 class PasswordPolicySchemaFactory {
     static create(policy) {
         const cacheKey = JSON.stringify(policy);
@@ -21,7 +20,7 @@ class PasswordPolicySchemaFactory {
             schema = schema.regex(/[0-9]/, "validation.password.requireNumber");
         }
         if (policy.requireSpecialChar) {
-            schema = schema.refine((value) => [...value].some((char) => allowedSpecialChars.includes(char)), "validation.password.requireSpecialChar");
+            schema = schema.refine((value) => [...value].some((char) => policy.allowedSpecialChars.includes(char)), "validation.password.requireSpecialChar");
         }
         if (policy.disallowSpaces) {
             schema = schema.refine((value) => !/\s/.test(value), {

package/dist/utils/getPasswordEnvPolicy.js

@@ -9,6 +9,7 @@ function getPasswordEnvPolicy() {
         requireLowercase: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireLowercase, "boolean"),
         requireNumber: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireNumber, "boolean"),
         requireSpecialChar: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireSpecialChar, "boolean"),
+        allowedSpecialChars: DraxConfig.getOrLoad(PasswordPolicyConfig.AllowedSpecialChars),
         disallowSpaces: DraxConfig.getOrLoad(PasswordPolicyConfig.DisallowSpaces, "boolean"),
         preventReuse: DraxConfig.getOrLoad(PasswordPolicyConfig.PreventReuse, "number"),
         expirationDays: DraxConfig.getOrLoad(PasswordPolicyConfig.ExpirationDays, "number")

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "3.21.0",
+  "version": "3.26.0",
   "description": "Identity module for user management, authentication and authorization.",
   "main": "dist/index.js",
   "types": "types/index.d.ts",
@@ -29,10 +29,10 @@
   "license": "ISC",
   "dependencies": {
     "@drax/common-back": "^3.18.0",
-    "@drax/crud-back": "^3.21.0",
-    "@drax/crud-share": "^3.21.0",
+    "@drax/crud-back": "^3.26.0",
+    "@drax/crud-share": "^3.26.0",
     "@drax/email-back": "^3.1.0",
-    "@drax/identity-share": "^3.21.0",
+    "@drax/identity-share": "^3.23.0",
     "bcryptjs": "^2.4.3",
     "graphql": "^16.8.2",
     "jsonwebtoken": "^9.0.2"
@@ -63,5 +63,5 @@
       "debug": "0"
     }
   },
-  "gitHead": "9ceebbba20e7abf7337387e2a81d1475b9ba1bca"
+  "gitHead": "482f91f51a9e783ac9131f557ace113f3b3404fa"
 }

package/src/config/PasswordPolicyConfig.ts

@@ -5,6 +5,7 @@ enum PasswordPolicyConfig {
     RequireLowercase = "PASSWORD_POLICY_REQUIRE_LOWERCASE",
     RequireNumber = "PASSWORD_POLICY_REQUIRE_NUMBER",
     RequireSpecialChar = "PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR",
+    AllowedSpecialChars = "PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS",
     DisallowSpaces = "PASSWORD_POLICY_DISALLOW_SPACES",
     PreventReuse = "PASSWORD_POLICY_PREVENT_REUSE",
     ExpirationDays = "PASSWORD_POLICY_EXPIRATION_DAYS",

package/src/controllers/UserController.ts

@@ -19,9 +19,8 @@ import {IdentityConfig} from "../config/IdentityConfig.js";
 import UserEmailService from "../services/UserEmailService.js";
 import {IDraxCrudEvent, IDraxFieldFilter} from "@drax/crud-share";
 import TenantServiceFactory from "../factory/TenantServiceFactory.js";
-import {CustomRequest} from "@drax/crud-back/dist";
+import {CustomRequest} from "@drax/crud-back";
 import PasswordPolicyServiceFactory from "../factory/PasswordPolicyServiceFactory.js";
-import {allowedSpecialChars} from "../constants/PasswordSpecialChars.js";
 
 const BASE_FILE_DIR = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
 const AVATAR_DIR = DraxConfig.getOrLoad(IdentityConfig.AvatarDir) || 'avatar';
@@ -96,11 +95,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
     async passwordPolicy(request, reply) {
         try {
             const passwordPolicyService = PasswordPolicyServiceFactory()
-            const policy = await passwordPolicyService.getFinalPolicy()
-            return {
-                ...policy,
-                allowedSpecialChars
-            }
+            return await passwordPolicyService.getFinalPolicy()
         } catch (e) {
             this.handleError(e, reply)
         }

package/src/policies/defaultPasswordPolicy.ts

@@ -1,4 +1,4 @@
-import type {IPasswordPolicy} from "@drax/identity-share/dist";
+import type {IPasswordPolicy} from "@drax/identity-share";
 
 const defaultPasswordPolicy: IPasswordPolicy = {
     minLength: 6,
@@ -7,6 +7,7 @@ const defaultPasswordPolicy: IPasswordPolicy = {
     requireLowercase: false,
     requireNumber: false,
     requireSpecialChar: false,
+    allowedSpecialChars: "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~",
     disallowSpaces: true,
     preventReuse: 3,
     expirationDays: null

package/src/schemas/PasswordPolicySchema.ts

@@ -7,7 +7,7 @@ const PasswordPolicySchemaBase = z.object({
     requireLowercase: z.boolean(),
     requireNumber: z.boolean(),
     requireSpecialChar: z.boolean(),
-    allowedSpecialChars: z.string().optional(),
+    allowedSpecialChars: z.string(),
     disallowSpaces: z.boolean(),
     preventReuse: z.number().int().min(0),
     expirationDays: z.number().int().min(1).nullable(),

package/src/services/PasswordPolicyService.ts

@@ -9,7 +9,6 @@ import type {IUserRepository} from "../interfaces/IUserRepository";
 import AuthUtils from "../utils/AuthUtils.js";
 import PasswordPolicyResolver from "../resolver/PasswordPolicyResolver.js";
 import PasswordPolicySchemaFactory from "../utils/PasswordPolicySchemaFactory.js";
-import {allowedSpecialChars} from "../constants/PasswordSpecialChars.js";
 
 interface IValidatePasswordOptions {
     field?: string
@@ -36,8 +35,9 @@ class PasswordPolicyService {
 
     async validatePassword(password: string,  options?: IValidatePasswordOptions): Promise<void> {
         const field = options?.field || "password"
+        const policy = await this.getFinalPolicy()
         try {
-            const schema = await this.getPasswordSchema()
+            const schema = PasswordPolicySchemaFactory.create(policy)
             await schema.parseAsync(password)
         } catch (e) {
             if (e instanceof ZodError) {
@@ -61,7 +61,7 @@ class PasswordPolicyService {
         const uppercaseChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
         const lowercaseChars = "abcdefghijkmnopqrstuvwxyz"
         const numericChars = "0123456789"
-        const specialChars = allowedSpecialChars
+        const specialChars = policy.allowedSpecialChars
         const fallbackSpecial = policy.disallowSpaces ? "!" : " "
         const combinedChars = [
             uppercaseChars,

package/src/setup/LoadIdentityConfigFromEnv.ts

@@ -18,6 +18,7 @@ function LoadIdentityConfigFromEnv() {
     DraxConfig.set(PasswordPolicyConfig.RequireLowercase, process.env[PasswordPolicyConfig.RequireLowercase])
     DraxConfig.set(PasswordPolicyConfig.RequireNumber, process.env[PasswordPolicyConfig.RequireNumber])
     DraxConfig.set(PasswordPolicyConfig.RequireSpecialChar, process.env[PasswordPolicyConfig.RequireSpecialChar])
+    DraxConfig.set(PasswordPolicyConfig.AllowedSpecialChars, process.env[PasswordPolicyConfig.AllowedSpecialChars])
     DraxConfig.set(PasswordPolicyConfig.DisallowSpaces, process.env[PasswordPolicyConfig.DisallowSpaces])
     DraxConfig.set(PasswordPolicyConfig.PreventReuse, process.env[PasswordPolicyConfig.PreventReuse])
     DraxConfig.set(PasswordPolicyConfig.ExpirationDays, process.env[PasswordPolicyConfig.ExpirationDays])

package/src/utils/PasswordPolicySchemaFactory.ts

@@ -1,6 +1,5 @@
 import z from "zod";
 import type {IPasswordPolicy} from "@drax/identity-share";
-import {allowedSpecialChars} from "../constants/PasswordSpecialChars.js";
 
 class PasswordPolicySchemaFactory {
     private static cache = new Map<string, z.ZodType<string>>()
@@ -31,7 +30,7 @@ class PasswordPolicySchemaFactory {
 
         if (policy.requireSpecialChar) {
             schema = schema.refine(
-                (value) => [...value].some((char) => allowedSpecialChars.includes(char)),
+                (value) => [...value].some((char) => policy.allowedSpecialChars.includes(char)),
                 "validation.password.requireSpecialChar"
             )
         }

package/src/utils/getPasswordEnvPolicy.ts

@@ -11,6 +11,7 @@ function getPasswordEnvPolicy(): Partial<IPasswordPolicy> {
         requireLowercase: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireLowercase, "boolean"),
         requireNumber: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireNumber, "boolean"),
         requireSpecialChar: DraxConfig.getOrLoad(PasswordPolicyConfig.RequireSpecialChar, "boolean"),
+        allowedSpecialChars: DraxConfig.getOrLoad(PasswordPolicyConfig.AllowedSpecialChars),
         disallowSpaces: DraxConfig.getOrLoad(PasswordPolicyConfig.DisallowSpaces, "boolean"),
         preventReuse: DraxConfig.getOrLoad(PasswordPolicyConfig.PreventReuse, "number"),
         expirationDays: DraxConfig.getOrLoad(PasswordPolicyConfig.ExpirationDays, "number")

package/test/endpoints/password-policy-route.test.ts

@@ -1,7 +1,6 @@
 import {afterAll, beforeAll, describe, expect, it} from "vitest";
 import {LoadIdentityConfigFromEnv} from "../../src/setup/LoadIdentityConfigFromEnv.js";
 import {TestSetup} from "../setup/TestSetup";
-import {allowedSpecialChars} from "../../src/constants/PasswordSpecialChars.js";
 
 describe("Password Policy Route Test", () => {
     const testSetup = new TestSetup("sqlite")
@@ -10,12 +9,14 @@ describe("Password Policy Route Test", () => {
         await testSetup.setup()
         process.env.PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR = "true"
         process.env.PASSWORD_POLICY_MIN_LENGTH = "18"
+        process.env.PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS = "@%"
         LoadIdentityConfigFromEnv()
     })
 
     afterAll(async () => {
         delete process.env.PASSWORD_POLICY_MIN_LENGTH
         delete process.env.PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR
+        delete process.env.PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS
         await testSetup.dropAndClose()
     })
 
@@ -29,7 +30,7 @@ describe("Password Policy Route Test", () => {
         const body = response.json()
         expect(body.minLength).toBe(18)
         expect(body.requireSpecialChar).toBe(true)
-        expect(body.allowedSpecialChars).toBe(allowedSpecialChars)
+        expect(body.allowedSpecialChars).toBe("@%")
         expect(body.requireUppercase).toBe(false)
     })
 })

package/test/security/password-policy-resolver.test.ts

@@ -8,18 +8,21 @@ describe("PasswordPolicyResolver", () => {
         delete process.env.PASSWORD_POLICY_MIN_LENGTH
         delete process.env.PASSWORD_POLICY_MAX_LENGTH
         delete process.env.PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR
+        delete process.env.PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS
         DraxConfig.set(PasswordPolicyConfig.MinLength, undefined)
         DraxConfig.set(PasswordPolicyConfig.MaxLength, undefined)
         DraxConfig.set(PasswordPolicyConfig.RequireSpecialChar, undefined)
+        DraxConfig.set(PasswordPolicyConfig.AllowedSpecialChars, undefined)
     })
 
     it("uses default policy when there are no overrides", async () => {
         const resolver = new PasswordPolicyResolver()
         const policy = await resolver.resolve()
 
-        expect(policy.minLength).toBe(8)
+        expect(policy.minLength).toBe(6)
         expect(policy.maxLength).toBe(64)
-        expect(policy.requireUppercase).toBe(true)
+        expect(policy.requireUppercase).toBe(false)
+        expect(policy.allowedSpecialChars).toBe("!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~")
     })
 
     it("project policy overrides default policy", async () => {
@@ -32,15 +35,26 @@ describe("PasswordPolicyResolver", () => {
         expect(policy.requireUppercase).toBe(false)
     })
 
+    it("project policy can override allowed special chars", async () => {
+        const resolver = new PasswordPolicyResolver()
+        resolver.setProjectPolicy({allowedSpecialChars: "%@"})
+        const policy = await resolver.resolve()
+
+        expect(policy.allowedSpecialChars).toBe("%@")
+    })
+
     it("env policy overrides project policy", async () => {
         process.env.PASSWORD_POLICY_MIN_LENGTH = "16"
         process.env.PASSWORD_POLICY_REQUIRE_SPECIAL_CHAR = "false"
+        process.env.PASSWORD_POLICY_ALLOWED_SPECIAL_CHARS = "%^"
 
         const resolver = new PasswordPolicyResolver()
+        resolver.setProjectPolicy({allowedSpecialChars: "@@"})
         const policy = await resolver.resolve()
 
         expect(policy.minLength).toBe(16)
         expect(policy.requireSpecialChar).toBe(false)
+        expect(policy.allowedSpecialChars).toBe("%^")
     })
 
     it("ignores undefined env overrides", async () => {

package/test/security/password-policy-schema-factory.test.ts

@@ -1,7 +1,6 @@
 import {describe, expect, it} from "vitest";
 import PasswordPolicySchemaFactory from "../../src/utils/PasswordPolicySchemaFactory.js";
 import {defaultPasswordPolicy} from "../../src/policies/defaultPasswordPolicy.js";
-import {allowedSpecialChars} from "../../src/constants/PasswordSpecialChars.js";
 
 describe("PasswordPolicySchemaFactory", () => {
     it("validates minLength", async () => {
@@ -36,7 +35,7 @@ describe("PasswordPolicySchemaFactory", () => {
 
     it("accepts allowed special chars", async () => {
         const schema = PasswordPolicySchemaFactory.create({...defaultPasswordPolicy, requireSpecialChar: true})
-        await expect(schema.parseAsync(`Password1${allowedSpecialChars.at(-1)}`)).resolves.toBeDefined()
+        await expect(schema.parseAsync(`Password1${defaultPasswordPolicy.allowedSpecialChars.at(-1)}`)).resolves.toBeDefined()
     })
 
     it("rejects special chars outside the allowed list", async () => {
@@ -44,6 +43,17 @@ describe("PasswordPolicySchemaFactory", () => {
         await expect(schema.parseAsync("Password1ñ")).rejects.toThrow()
     })
 
+    it("uses the special chars defined in the policy", async () => {
+        const schema = PasswordPolicySchemaFactory.create({
+            ...defaultPasswordPolicy,
+            requireSpecialChar: true,
+            allowedSpecialChars: "%"
+        })
+
+        await expect(schema.parseAsync("Password1%")).resolves.toBeDefined()
+        await expect(schema.parseAsync("Password1!")).rejects.toThrow()
+    })
+
     it("validates disallowSpaces", async () => {
         const schema = PasswordPolicySchemaFactory.create(defaultPasswordPolicy)
         await expect(schema.parseAsync("Space 123A")).rejects.toThrow()

package/test/services/user-service.test.ts

@@ -8,7 +8,6 @@ import PasswordPolicyService from "../../src/services/PasswordPolicyService";
 import type {IUserPasswordHistory} from "../../src/interfaces/IUserPasswordHistory";
 import type {IUserPasswordHistoryRepository} from "../../src/interfaces/IUserPasswordHistoryRepository";
 import UserPasswordHistoryService from "../../src/services/UserPasswordHistoryService";
-import {allowedSpecialChars} from "../../src/constants/PasswordSpecialChars";
 
 class InMemoryUserRepository implements IUserRepository {
     private items = new Map<string, IUser>()
@@ -262,7 +261,7 @@ describe("UserServiceTest", function () {
 
     it("validatePassword returns allowedSpecialChars when required special char is invalid", async function () {
         const resolver = new PasswordPolicyResolver()
-        resolver.setProjectPolicy({requireSpecialChar: true})
+        resolver.setProjectPolicy({requireSpecialChar: true, allowedSpecialChars: "%"})
         const passwordPolicyService = new PasswordPolicyService(resolver, userRepository)
 
         await expect(async () => {
@@ -271,7 +270,7 @@ describe("UserServiceTest", function () {
             expect(err).toBeInstanceOf(ValidationError)
             expect(err.errors[0].field).toBe('password')
             expect(err.errors[0].reason).toBe('validation.password.requireSpecialChar')
-            expect(err.errors[0].allowedSpecialChars).toBe(allowedSpecialChars)
+            expect(err.errors[0].allowedSpecialChars).toBe("%")
             return true;
         });
     })