@furystack/security 1.0.0

package/src/password-complexity-rules/contains-lowercase.spec.ts

@@ -0,0 +1,34 @@
+import { PasswordComplexityFailedResult } from '../models'
+import { createContainsLowercasePolicy } from './contains-lowercase'
+
+describe('Contains-lowercase', () => {
+  it('Should fail if the password is shorter than expected', async () => {
+    const policy = createContainsLowercasePolicy(3)
+    const result = await policy.check('')
+    expect(result.success).toBe(false)
+    expect((result as PasswordComplexityFailedResult).message).toBe(
+      'The password should contain at least 3 lower case characters',
+    )
+  })
+
+  it('Should fail if the password does not contain enough lowercase chars', async () => {
+    const policy = createContainsLowercasePolicy(3)
+    const result = await policy.check('ASD12345(=/!+')
+    expect(result.success).toBe(false)
+    expect((result as PasswordComplexityFailedResult).message).toBe(
+      'The password should contain at least 3 lower case characters',
+    )
+  })
+
+  it('Should succeed if the password contains enough lowercase chars', async () => {
+    const policy = createContainsLowercasePolicy(3)
+    const result = await policy.check('asd')
+    expect(result.success).toBe(true)
+  })
+
+  it('Should succeed if the password contains enough lowercase chars supporting special ones', async () => {
+    const policy = createContainsLowercasePolicy(3)
+    const result = await policy.check('éáő')
+    expect(result.success).toBe(true)
+  })
+})

package/src/password-complexity-rules/contains-lowercase.ts

@@ -0,0 +1,27 @@
+import { PasswordComplexityRule } from '../models'
+
+/**
+ * @param lowerCaseCount The minimum lower case characters length
+ * @returns The created Password Policy object
+ */
+export const createContainsLowercasePolicy = (lowerCaseCount: number): PasswordComplexityRule => ({
+  name: 'containsLowercase' as const,
+  check: async (passwordString: string) => {
+    const actualLowerCaseCount =
+      passwordString.length >= lowerCaseCount
+        ? passwordString
+            .normalize('NFD')
+            .replace(/\p{Diacritic}/gu, '')
+            .replace(/[^a-z]/g, '').length
+        : 0
+    const success = actualLowerCaseCount >= lowerCaseCount
+    if (success) {
+      return { success }
+    }
+    return {
+      success,
+      message: `The password should contain at least ${lowerCaseCount} lower case characters`,
+      rule: 'containsLowercase',
+    }
+  },
+})

package/src/password-complexity-rules/contains-uppercase.spec.ts

@@ -0,0 +1,34 @@
+import { PasswordComplexityFailedResult } from '../models'
+import { createContainsUppercasePolicy } from './contains-uppercase'
+
+describe('Contains-uppercase', () => {
+  it('Should fail if the password is shorter than expected', async () => {
+    const policy = createContainsUppercasePolicy(3)
+    const result = await policy.check('')
+    expect(result.success).toBe(false)
+    expect((result as PasswordComplexityFailedResult).message).toBe(
+      'The password should contain at least 3 upper case characters',
+    )
+  })
+
+  it('Should fail if the password does not contain enough lowercase chars', async () => {
+    const policy = createContainsUppercasePolicy(3)
+    const result = await policy.check('asd12345(=/!+')
+    expect(result.success).toBe(false)
+    expect((result as PasswordComplexityFailedResult).message).toBe(
+      'The password should contain at least 3 upper case characters',
+    )
+  })
+
+  it('Should succeed if the password contains enough lowercase chars', async () => {
+    const policy = createContainsUppercasePolicy(3)
+    const result = await policy.check('ASD')
+    expect(result.success).toBe(true)
+  })
+
+  it('Should succeed if the password contains enough lowercase chars supporting special ones', async () => {
+    const policy = createContainsUppercasePolicy(3)
+    const result = await policy.check('ÉÁÍ')
+    expect(result.success).toBe(true)
+  })
+})

package/src/password-complexity-rules/contains-uppercase.ts

@@ -0,0 +1,24 @@
+import { PasswordComplexityRule } from '../models'
+
+/**
+ * @param upperCaseCount The minimum upper case characters length
+ * @returns The created Password Policy object
+ */
+export const createContainsUppercasePolicy = (upperCaseCount: number): PasswordComplexityRule => ({
+  name: 'containsUppercase' as const,
+  check: async (passwordString: string) => {
+    const actualUpperCaseCount = passwordString
+      .normalize('NFD')
+      .replace(/\p{Diacritic}/gu, '')
+      .replace(/[^A-Z]/g, '').length
+    const success = actualUpperCaseCount >= upperCaseCount
+    if (success) {
+      return { success }
+    }
+    return {
+      success,
+      message: `The password should contain at least ${upperCaseCount} upper case characters`,
+      rule: 'containsUppercase',
+    }
+  },
+})

package/src/password-complexity-rules/index.ts

@@ -0,0 +1,4 @@
+export * from './contains-lowercase'
+export * from './contains-uppercase'
+export * from './max-length'
+export * from './min-length'

package/src/password-complexity-rules/max-length.spec.ts

@@ -0,0 +1,17 @@
+import { PasswordComplexityFailedResult } from '../models'
+import { createMaxLengthComplexityRule } from './max-length'
+
+describe('max-length', () => {
+  it('Should fail if the password is longer than expected', async () => {
+    const policy = createMaxLengthComplexityRule(3)
+    const result = await policy.check('asdasd123')
+    expect(result.success).toBe(false)
+    expect((result as PasswordComplexityFailedResult).message).toBe('The password has to be maximum 3 character length')
+  })
+
+  it('Should fail if the password does not contain enough lowercase chars', async () => {
+    const policy = createMaxLengthComplexityRule(3)
+    const result = await policy.check('asd')
+    expect(result.success).toBe(true)
+  })
+})

package/src/password-complexity-rules/max-length.ts

@@ -0,0 +1,16 @@
+import type { PasswordComplexityRule } from '../models'
+
+/**
+ * @param maxLength The maximum password length
+ * @returns The created Password Policy object
+ */
+export const createMaxLengthComplexityRule = (maxLength: number): PasswordComplexityRule => ({
+  name: 'maxLength' as const,
+  check: async (passwordString: string) => {
+    const success = passwordString.length <= maxLength
+    if (success) {
+      return { success }
+    }
+    return { success, message: `The password has to be maximum ${maxLength} character length`, rule: 'maxLength' }
+  },
+})

package/src/password-complexity-rules/min-length.spec.ts

@@ -0,0 +1,19 @@
+import { PasswordComplexityFailedResult } from '../models'
+import { createMinLengthComplexityRule } from './min-length'
+
+describe('min-length', () => {
+  it('Should fail if the password is shorter than expected', async () => {
+    const policy = createMinLengthComplexityRule(3)
+    const result = await policy.check('')
+    expect(result.success).toBe(false)
+    expect((result as PasswordComplexityFailedResult).message).toBe(
+      'The password has to be at least 3 character length',
+    )
+  })
+
+  it('Should fail if the password does not contain enough lowercase chars', async () => {
+    const policy = createMinLengthComplexityRule(3)
+    const result = await policy.check('asd12345(=/!+')
+    expect(result.success).toBe(true)
+  })
+})

package/src/password-complexity-rules/min-length.ts

@@ -0,0 +1,16 @@
+import type { PasswordComplexityRule } from '../models'
+
+/**
+ * @param minLength The minimum password length
+ * @returns The created Password Policy object
+ */
+export const createMinLengthComplexityRule = (minLength: number): PasswordComplexityRule => ({
+  name: 'minLength' as const,
+  check: async (passwordString: string) => {
+    const success = passwordString.length >= minLength
+    if (success) {
+      return { success }
+    }
+    return { success, message: `The password has to be at least ${minLength} character length`, rule: 'minLength' }
+  },
+})

package/src/password-hasher.ts

@@ -0,0 +1,13 @@
+import { Injectable } from '@furystack/inject'
+import { PasswordCheckResult, PasswordCredential } from './models'
+
+@Injectable({ lifetime: 'singleton' })
+export class PasswordHasher {
+  public createCredential(_userName: string, _password: string): Promise<PasswordCredential> {
+    throw Error('Set up hasher - TODO')
+  }
+
+  public verifyCredential(_password: string, _credential: PasswordCredential): Promise<PasswordCheckResult> {
+    throw Error('Set up hasher - TODO')
+  }
+}

package/src/security-policy-manager.spec.ts

@@ -0,0 +1,16 @@
+import { Injector } from '@furystack/inject'
+import { using } from '@furystack/utils'
+import { v4 } from 'uuid'
+import './injector-extensions'
+import { SecurityPolicyManager } from './security-policy-manager'
+describe('SecurityPolicyManager', () => {
+  it('Should return false when no token expiration has been set', () => {
+    using(new Injector(), (i) => {
+      i.usePasswordPolicy({ resetTokenExpirationSeconds: 0 })
+      const result = i
+        .getInstance(SecurityPolicyManager)
+        .hasTokenExpired({ createdAt: new Date().toISOString(), token: v4(), userName: v4() })
+      expect(result).toBeFalsy()
+    })
+  })
+})

package/src/security-policy-manager.ts

@@ -0,0 +1,53 @@
+import { Injectable } from '@furystack/inject'
+import { PasswordCredential, PasswordResetToken } from './models'
+import { SecurityPolicy } from './security-policy'
+
+@Injectable({ lifetime: 'singleton' })
+export class SecurityPolicyManager {
+  /**
+   * @param password The Plain password string
+   * @returns if the password matches the complexity rules
+   */
+  public async matchPasswordComplexityRules(password: string) {
+    const result = await Promise.all(this.policy.passwordComplexityRules.map((rule) => rule.check(password)))
+    const failed = result.filter((r) => r.success === false)
+    if (failed.length) {
+      return {
+        match: false as const,
+        errors: failed.map((f) => f.success === false && { message: f.message, rule: f.rule }) as Array<{
+          message: string
+          rule: string
+        }>,
+      }
+    }
+
+    return {
+      match: true as const,
+    }
+  }
+
+  public hasPasswordExpired(credential: PasswordCredential) {
+    if (!this.policy.passwordExpirationDays) {
+      return false
+    }
+    const credentialExpiration = new Date(credential.creationDate)
+    credentialExpiration.setDate(credentialExpiration.getDate() + this.policy.passwordExpirationDays)
+    const now = new Date()
+    return now > credentialExpiration
+  }
+
+  public hasTokenExpired(token: PasswordResetToken) {
+    if (!this.policy.resetTokenExpirationSeconds) {
+      return false
+    }
+    const tokenExpiration = new Date(token.createdAt)
+    tokenExpiration.setSeconds(tokenExpiration.getSeconds() + this.policy.resetTokenExpirationSeconds)
+    const now = new Date()
+    return now > tokenExpiration
+  }
+
+  /**
+   * @param policy The related Password Policy object
+   */
+  constructor(public readonly policy: SecurityPolicy) {}
+}

package/src/security-policy.ts

@@ -0,0 +1,32 @@
+import { Constructable, Injectable } from '@furystack/inject'
+import { CryptoPasswordHasher } from './crypto-password-hasher'
+import { PasswordComplexityRule } from './models'
+import { PasswordHasher } from './password-hasher'
+
+@Injectable({ lifetime: 'singleton' })
+export class SecurityPolicy {
+  /**
+   * A Hasher instance for password hash generation
+   */
+  hasher: Constructable<PasswordHasher> = CryptoPasswordHasher
+
+  /**
+   * Array of password complexity rules to apply
+   */
+  passwordComplexityRules: PasswordComplexityRule[] = []
+
+  /**
+   * The password expiration in days
+   */
+  passwordExpirationDays = 0
+
+  /**
+   * Defines if the login needs a second factor authentication
+   */
+  requireSecondFactor: 'never' | 'always' = 'never' // TODO - Challenge based on trusted devices
+
+  /**
+   * The Password Reset Token expiration in seconds
+   */
+  resetTokenExpirationSeconds = 15
+}