@furystack/security 1.0.0

package/src/crypto-password-hasher.ts

@@ -0,0 +1,44 @@
+import { Injectable } from '@furystack/inject'
+import { PasswordHasher } from './password-hasher'
+import { randomBytes, pbkdf2 } from 'crypto'
+import { PasswordCheckResult, PasswordCredential } from './models'
+
+@Injectable({ lifetime: 'singleton' })
+export class CryptoPasswordHasher implements PasswordHasher {
+  private readonly iterations = 1000
+  private readonly keylen = 64
+
+  public async verifyCredential(
+    password: string,
+    { passwordHash, salt }: PasswordCredential,
+  ): Promise<PasswordCheckResult> {
+    const newHash = await new Promise((resolve, reject) =>
+      pbkdf2(password, salt, this.iterations, this.keylen, 'sha512', (err, key) =>
+        err ? reject(err) : resolve(key.toString('hex')),
+      ),
+    )
+    if (newHash === passwordHash) {
+      return {
+        isValid: true,
+      }
+    }
+    return {
+      isValid: false,
+      reason: 'badUsernameOrPassword',
+    }
+  }
+  public async createCredential(userName: string, password: string) {
+    const salt = randomBytes(16).toString('hex')
+    const passwordHash = await new Promise<string>((resolve, reject) =>
+      pbkdf2(password, salt, this.iterations, this.keylen, 'sha512', (err, key) =>
+        err ? reject(err) : resolve(key.toString('hex')),
+      ),
+    )
+    return {
+      userName,
+      salt,
+      passwordHash,
+      creationDate: new Date().toISOString(),
+    }
+  }
+}

package/src/errors/index.ts

@@ -0,0 +1,3 @@
+export * from './password-complexity-error'
+export * from './unauthenticated-error'
+export * from './password-complexity-error'

package/src/errors/password-complexity-error.ts

@@ -0,0 +1,9 @@
+export class PasswordComplexityError extends Error {
+  /**
+   * @param result A detailed error result array
+   * @param message The Error message
+   */
+  constructor(public readonly result: Array<{ message: string; rule: string }>, message?: string) {
+    super(message)
+  }
+}

package/src/errors/unauthenticated-error.ts

@@ -0,0 +1,4 @@
+/**
+ * Error that can be thrown if an authentication is required but not provided
+ */
+export class UnauthenticatedError extends Error {}

package/src/index.ts

@@ -0,0 +1,9 @@
+export * from './crypto-password-hasher'
+export * from './errors'
+export * from './models'
+export * from './password-authenticator'
+export * from './password-complexity-rules'
+export * from './password-hasher'
+export * from './security-policy-manager'
+
+import './injector-extensions'

package/src/injector-extensions.ts

@@ -0,0 +1,21 @@
+import { Injector } from '@furystack/inject/dist/injector'
+import { SecurityPolicy } from './security-policy'
+
+declare module '@furystack/inject/dist/injector' {
+  /**
+   * Extended Injector with Password Policy related methods
+   */
+  export interface Injector {
+    /**
+     * Sets up the @furystack/security with the provided settings
+     */
+    usePasswordPolicy: (policy?: Partial<SecurityPolicy>) => this
+  }
+}
+
+Injector.prototype.usePasswordPolicy = function (policy) {
+  const plainPolicy = new SecurityPolicy()
+  policy && Object.assign(plainPolicy, policy)
+  this.setExplicitInstance(plainPolicy, SecurityPolicy)
+  return this
+}

package/src/models/index.ts

@@ -0,0 +1,5 @@
+export * from './password-check-result'
+export * from './password-complexity-result'
+export * from './password-complexity-rule'
+export * from './password-credential'
+export * from './password-reset-token'

package/src/models/password-check-result.ts

@@ -0,0 +1,11 @@
+export interface PasswordCheckSuccessResult {
+  isValid: true
+  willExpire?: string
+}
+
+export interface PasswordCheckFailedResult {
+  isValid: false
+  reason: 'badUsernameOrPassword' | 'passwordExpired' // TODO | 'challengeNeeded'
+}
+
+export type PasswordCheckResult = PasswordCheckFailedResult | PasswordCheckSuccessResult

package/src/models/password-complexity-result.ts

@@ -0,0 +1,11 @@
+export interface PasswordComplexitySuccessResult {
+  success: true
+}
+
+export interface PasswordComplexityFailedResult {
+  success: false
+  message: string
+  rule: string
+}
+
+export type PasswordComplexityResult = PasswordComplexitySuccessResult | PasswordComplexityFailedResult

package/src/models/password-complexity-rule.ts

@@ -0,0 +1,6 @@
+import type { PasswordComplexityResult } from './password-complexity-result'
+
+export interface PasswordComplexityRule {
+  name: string
+  check: (passwordString: string) => Promise<PasswordComplexityResult>
+}

package/src/models/password-credential.ts

@@ -0,0 +1,23 @@
+/**
+ * Entry that stores credential info for password login
+ */
+export class PasswordCredential {
+  /**
+   * The unique name of the user
+   */
+  userName!: string
+  /**
+   * The hashed password value
+   */
+  passwordHash!: string
+
+  /**
+   * Salt value for password hashing // TODO
+   */
+  salt!: string
+
+  /**
+   * The Creation date in ISO String format
+   */
+  creationDate!: string
+}

package/src/models/password-reset-token.ts

@@ -0,0 +1,14 @@
+export class PasswordResetToken {
+  /**
+   * The related user name
+   */
+  userName!: string
+  /**
+   * The Token value - should be some kind of generated UUID that can be included e.g. in URLs
+   */
+  token!: string
+  /**
+   * The creation date in an ISO datetime format
+   */
+  createdAt!: string
+}

package/src/password-authenticator.spec.ts

@@ -0,0 +1,393 @@
+import { InMemoryStore, StoreManager, User } from '@furystack/core'
+import { Injector } from '@furystack/inject'
+import { using, usingAsync } from '@furystack/utils'
+import './injector-extensions'
+import { v4 } from 'uuid'
+import { PasswordCheckFailedResult, PasswordCredential, PasswordResetToken } from './models'
+import { PasswordAuthenticator } from './password-authenticator'
+import { createMinLengthComplexityRule } from './password-complexity-rules'
+import { SecurityPolicyManager } from './security-policy-manager'
+import { PasswordComplexityError, UnauthenticatedError } from './errors'
+
+describe('PasswordAuthenticator', () => {
+  it('Should be instantiated', () => {
+    using(new Injector(), (i) => {
+      const auth = i.getInstance(PasswordAuthenticator)
+      expect(auth).toBeInstanceOf(PasswordAuthenticator)
+    })
+  })
+
+  it('Should inherit policy from the extension method', () => {
+    using(new Injector(), (i) => {
+      i.usePasswordPolicy({
+        passwordComplexityRules: [createMinLengthComplexityRule(3)],
+      })
+      const auth = i.getInstance(PasswordAuthenticator)
+      expect(auth).toBeInstanceOf(PasswordAuthenticator)
+      expect(auth.policyManager.policy.passwordComplexityRules[0].name).toBe('minLength')
+    })
+  })
+
+  describe('checkPasswordForUser', () => {
+    it('Should return a truthy value for valid username and password', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const password = v4()
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' })),
+        )
+        i.usePasswordPolicy({})
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+
+        const entry = await hasher.createCredential(userName, password)
+        await passwordStore.add(entry)
+
+        const successResult = await authenticator.checkPasswordForUser(userName, password)
+        expect(successResult.isValid).toBeTruthy()
+      })
+    })
+
+    it('Should return a falsy value for invalid username', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const password = v4()
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' })),
+        )
+        i.usePasswordPolicy({})
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+
+        const entry = await hasher.createCredential(userName, password)
+        await passwordStore.add(entry)
+
+        const failResult = await authenticator.checkPasswordForUser('invalidUsername', password)
+        expect(failResult.isValid).toBeFalsy()
+        expect((failResult as PasswordCheckFailedResult).reason).toBe('badUsernameOrPassword')
+      })
+    })
+
+    it('Should return a falsy value for invalid password', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const password = v4()
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' })),
+        )
+        i.usePasswordPolicy({})
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+
+        const entry = await hasher.createCredential(userName, password)
+        await passwordStore.add(entry)
+
+        const failResult = await authenticator.checkPasswordForUser(userName, 'someInvalidPassword')
+        expect(failResult.isValid).toBeFalsy()
+        expect((failResult as PasswordCheckFailedResult).reason).toBe('badUsernameOrPassword')
+      })
+    })
+
+    it('Should return a falsy value for an expired password', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const password = v4()
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' })),
+        )
+        i.usePasswordPolicy({ passwordExpirationDays: 1 })
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+
+        const entry = await hasher.createCredential(userName, password)
+
+        const creationDate = new Date()
+        creationDate.setDate(creationDate.getDate() - 2)
+
+        entry.creationDate = creationDate.toISOString()
+
+        await passwordStore.add(entry)
+
+        const failResult = await authenticator.checkPasswordForUser(userName, password)
+        expect(failResult.isValid).toBeFalsy()
+        expect((failResult as PasswordCheckFailedResult).reason).toBe('passwordExpired')
+      })
+    })
+  })
+  describe('setPasswordForUser', () => {
+    it('Should be able to set the password for the user using the last password', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const lastPassword = v4()
+        const password = v4()
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' })),
+        )
+        i.usePasswordPolicy({})
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+        const policyManager = i.getInstance(SecurityPolicyManager)
+        const pmSpy = jest.spyOn(policyManager, 'matchPasswordComplexityRules')
+
+        const entry = await hasher.createCredential(userName, lastPassword)
+
+        await passwordStore.add(entry)
+        await authenticator.setPasswordForUser(userName, lastPassword, password)
+
+        expect(pmSpy).toBeCalled()
+
+        const entryCount = await passwordStore.count({ userName: { $eq: userName } })
+
+        expect(entryCount).toBe(1) // old entry should be removed
+
+        const successResult = await authenticator.checkPasswordForUser(userName, password)
+        expect(successResult.isValid).toBeTruthy()
+
+        // Password updated, cannot use the last password
+        const failResult = await authenticator.checkPasswordForUser(userName, lastPassword)
+        expect(failResult.isValid).toBeFalsy()
+        expect((failResult as PasswordCheckFailedResult).reason).toBe('badUsernameOrPassword')
+      })
+    })
+
+    it('Should throw PasswordComplexityError if the complexity rules are not respected', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const lastPassword = v4()
+        const password = ''
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' })),
+        )
+        i.usePasswordPolicy({ passwordComplexityRules: [createMinLengthComplexityRule(3)] })
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+        const policyManager = i.getInstance(SecurityPolicyManager)
+        const pmSpy = jest.spyOn(policyManager, 'matchPasswordComplexityRules')
+
+        const entry = await hasher.createCredential(userName, lastPassword)
+
+        await passwordStore.add(entry)
+
+        await expect(authenticator.setPasswordForUser(userName, lastPassword, password)).rejects.toThrowError(
+          PasswordComplexityError,
+        )
+
+        expect(pmSpy).toBeCalled()
+
+        const entryCount = await passwordStore.count({ userName: { $eq: userName } })
+
+        expect(entryCount).toBe(1) // old entry should be removed
+
+        const failResult = await authenticator.checkPasswordForUser(userName, password)
+        // Password NOT updated, can use the last password
+        expect(failResult.isValid).toBeFalsy()
+        expect((failResult as PasswordCheckFailedResult).reason).toBe('badUsernameOrPassword')
+
+        // Password NOT updated, cannot use the new password
+        const successResult = await authenticator.checkPasswordForUser(userName, lastPassword)
+        expect(successResult.isValid).toBeTruthy()
+      })
+    })
+
+    it('Should throw UnauthenticatedError if the last password is not valid', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const lastPassword = v4()
+        const password = v4()
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' })),
+        )
+        i.usePasswordPolicy()
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+        const policyManager = i.getInstance(SecurityPolicyManager)
+        const pmSpy = jest.spyOn(policyManager, 'matchPasswordComplexityRules')
+
+        const entry = await hasher.createCredential(userName, lastPassword)
+
+        await passwordStore.add(entry)
+
+        await expect(authenticator.setPasswordForUser(userName, 'someBadLastPassword', password)).rejects.toThrowError(
+          UnauthenticatedError,
+        )
+
+        expect(pmSpy).toBeCalled()
+
+        const entryCount = await passwordStore.count({ userName: { $eq: userName } })
+
+        expect(entryCount).toBe(1) // old entry should be removed
+
+        const failResult = await authenticator.checkPasswordForUser(userName, password)
+        // Password NOT updated, can use the last password
+        expect(failResult.isValid).toBeFalsy()
+        expect((failResult as PasswordCheckFailedResult).reason).toBe('badUsernameOrPassword')
+
+        // Password NOT updated, cannot use the new password
+        const successResult = await authenticator.checkPasswordForUser(userName, lastPassword)
+        expect(successResult.isValid).toBeTruthy()
+      })
+    })
+  })
+
+  describe('resetPasswordForUser', () => {
+    it('Should reset the password with the valid token', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const lastPassword = v4()
+        const password = v4()
+        const token = v4()
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' }))
+            .addStore(new InMemoryStore({ model: PasswordResetToken, primaryKey: 'token' })),
+        )
+        i.usePasswordPolicy()
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+        const resetTokenStore = i.getInstance(StoreManager).getStoreFor(PasswordResetToken, 'token')
+
+        const entry = await hasher.createCredential(userName, lastPassword)
+        await passwordStore.add(entry)
+        await resetTokenStore.add({ userName, createdAt: new Date().toISOString(), token })
+
+        await authenticator.resetPasswordForUser(token, password)
+
+        const successResult = await authenticator.checkPasswordForUser(userName, password)
+        expect(successResult.isValid).toBeTruthy()
+
+        // Password updated, cannot use the last password
+        const failResult = await authenticator.checkPasswordForUser(userName, lastPassword)
+        expect(failResult.isValid).toBeFalsy()
+        expect((failResult as PasswordCheckFailedResult).reason).toBe('badUsernameOrPassword')
+      })
+    })
+    it('Should throw PasswordComplexityError if the complexity rules are not respected', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const lastPassword = v4()
+        const password = ''
+        const token = v4()
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' }))
+            .addStore(new InMemoryStore({ model: PasswordResetToken, primaryKey: 'token' })),
+        )
+        i.usePasswordPolicy({ passwordComplexityRules: [createMinLengthComplexityRule(3)] })
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+        const resetTokenStore = i.getInstance(StoreManager).getStoreFor(PasswordResetToken, 'token')
+
+        const entry = await hasher.createCredential(userName, lastPassword)
+        await passwordStore.add(entry)
+        await resetTokenStore.add({ userName, createdAt: new Date().toISOString(), token })
+
+        await expect(authenticator.resetPasswordForUser(token, password)).rejects.toThrowError(PasswordComplexityError)
+        const successResult = await authenticator.checkPasswordForUser(userName, lastPassword)
+        expect(successResult.isValid).toBeTruthy()
+
+        // Password updated, cannot use the last password
+        const failResult = await authenticator.checkPasswordForUser(userName, password)
+        expect(failResult.isValid).toBeFalsy()
+        expect((failResult as PasswordCheckFailedResult).reason).toBe('badUsernameOrPassword')
+      })
+    })
+    it('Should throw UnauthenticatedError if the token is not valid', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const lastPassword = v4()
+        const password = ''
+        const token = v4()
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' }))
+            .addStore(new InMemoryStore({ model: PasswordResetToken, primaryKey: 'token' })),
+        )
+        i.usePasswordPolicy()
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+        const resetTokenStore = i.getInstance(StoreManager).getStoreFor(PasswordResetToken, 'token')
+
+        const entry = await hasher.createCredential(userName, lastPassword)
+        await passwordStore.add(entry)
+        await resetTokenStore.add({ userName, createdAt: new Date().toISOString(), token })
+
+        await expect(authenticator.resetPasswordForUser('someBadToken', password)).rejects.toThrowError(
+          UnauthenticatedError,
+        )
+        const successResult = await authenticator.checkPasswordForUser(userName, lastPassword)
+        expect(successResult.isValid).toBeTruthy()
+
+        // Password updated, cannot use the last password
+        const failResult = await authenticator.checkPasswordForUser(userName, password)
+        expect(failResult.isValid).toBeFalsy()
+        expect((failResult as PasswordCheckFailedResult).reason).toBe('badUsernameOrPassword')
+      })
+    })
+    it('Should throw UnauthenticatedError and clean up token if the token has been expired', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        const userName = v4()
+        const lastPassword = v4()
+        const password = ''
+        const token = v4()
+        i.setupStores((sm) =>
+          sm
+            .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+            .addStore(new InMemoryStore({ model: User, primaryKey: 'username' }))
+            .addStore(new InMemoryStore({ model: PasswordResetToken, primaryKey: 'token' })),
+        )
+        i.usePasswordPolicy({ resetTokenExpirationSeconds: 1 })
+        const authenticator = i.getInstance(PasswordAuthenticator)
+        const hasher = authenticator.getHasher()
+        const passwordStore = i.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+        const resetTokenStore = i.getInstance(StoreManager).getStoreFor(PasswordResetToken, 'token')
+
+        const entry = await hasher.createCredential(userName, lastPassword)
+        await passwordStore.add(entry)
+
+        const creationDate = new Date()
+        creationDate.setDate(creationDate.getDate() - 2)
+
+        await resetTokenStore.add({ userName, createdAt: creationDate.toISOString(), token })
+
+        await expect(authenticator.resetPasswordForUser(token, password)).rejects.toThrowError(UnauthenticatedError)
+        const successResult = await authenticator.checkPasswordForUser(userName, lastPassword)
+        expect(successResult.isValid).toBeTruthy()
+
+        // Password updated, cannot use the last password
+        const failResult = await authenticator.checkPasswordForUser(userName, password)
+        expect(failResult.isValid).toBeFalsy()
+        expect((failResult as PasswordCheckFailedResult).reason).toBe('badUsernameOrPassword')
+
+        const tokenCount = await resetTokenStore.count()
+        expect(tokenCount).toBe(0)
+      })
+    })
+  })
+})

package/src/password-authenticator.ts

@@ -0,0 +1,101 @@
+import { StoreManager } from '@furystack/core'
+import { Injectable, Injector } from '@furystack/inject'
+import { SecurityPolicyManager } from './security-policy-manager'
+import { UnauthenticatedError } from './errors'
+import { PasswordCheckResult, PasswordCredential, PasswordResetToken } from './models'
+import { PasswordComplexityError } from './errors/password-complexity-error'
+
+@Injectable({ lifetime: 'singleton' })
+export class PasswordAuthenticator {
+  private readonly getPasswordStore = () =>
+    this.injector.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName')
+
+  private readonly getTokenStore = () =>
+    this.injector.getInstance(StoreManager).getStoreFor(PasswordResetToken, 'token')
+
+  public readonly getHasher = () => this.injector.getInstance(this.policyManager.policy.hasher)
+
+  /**
+   * @param userName The User's unique name
+   * @param plainPassword The plain password to check
+   * @returns An object that contains an { isValid } value that indicates if the password is valid
+   */
+  public async checkPasswordForUser(userName: string, plainPassword: string): Promise<PasswordCheckResult> {
+    const entry = await this.getPasswordStore().get(userName)
+    if (!entry) {
+      return {
+        isValid: false,
+        reason: 'badUsernameOrPassword',
+      }
+    }
+    const result = await this.getHasher().verifyCredential(plainPassword, entry)
+    if (result.isValid && this.policyManager.hasPasswordExpired(entry)) {
+      return {
+        isValid: false,
+        reason: 'passwordExpired',
+      }
+    }
+    return result
+  }
+
+  /**
+   *
+   * Sets the password for the specific user
+   *
+   * @param userName The user to set the password for
+   * @param lastPassword The last user password
+   * @param plainPassword The password as a plain string
+   */
+  public async setPasswordForUser(userName: string, lastPassword: string, plainPassword: string): Promise<void> {
+    const complexityResult = await this.policyManager.matchPasswordComplexityRules(plainPassword)
+    if (!complexityResult.match) {
+      throw new PasswordComplexityError(complexityResult.errors)
+    }
+
+    const lastResult = await this.checkPasswordForUser(userName, lastPassword)
+    if (!lastResult.isValid) {
+      throw new UnauthenticatedError()
+    }
+    const store = this.getPasswordStore()
+    const newCredential = await this.getHasher().createCredential(userName, plainPassword)
+    const existing = await store.get(userName)
+    existing && (await store.remove(existing.userName))
+    await store.add(newCredential)
+  }
+
+  /**
+   * Resets the password with a Password Reset token entry
+   *
+   * @param resetToken The Reset Token value
+   * @param plainPassword The new password in plain string
+   */
+  public async resetPasswordForUser(resetToken: string, plainPassword: string): Promise<void> {
+    const token = await this.getTokenStore().get(resetToken)
+
+    if (!token) {
+      throw new UnauthenticatedError()
+    }
+
+    if (this.policyManager.hasTokenExpired(token)) {
+      await this.getTokenStore().remove(resetToken) // clean up token
+      throw new UnauthenticatedError()
+    }
+
+    const complexityResult = await this.policyManager.matchPasswordComplexityRules(plainPassword)
+    if (!complexityResult.match) {
+      throw new PasswordComplexityError(complexityResult.errors)
+    }
+
+    const newCredential = await this.getHasher().createCredential(token.userName, plainPassword)
+    const store = this.getPasswordStore()
+    const existing = await store.get(token.userName)
+    existing && (await store.remove(existing.userName))
+    await store.add(newCredential)
+  }
+
+  /**
+   * @param injector The Injector instance
+   * @param policyManager The Password Policy Manager instance
+   */
+  constructor(private readonly injector: Injector, public policyManager: SecurityPolicyManager) {}
+}