@furystack/security 3.0.0 → 3.0.1

package/esm/crypto-password-hasher.js

@@ -0,0 +1,41 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@furystack/inject';
+import { randomBytes, pbkdf2 } from 'crypto';
+let CryptoPasswordHasher = class CryptoPasswordHasher {
+    constructor() {
+        this.iterations = 1000;
+        this.keylen = 64;
+    }
+    async verifyCredential(password, { passwordHash, salt }) {
+        const newHash = await new Promise((resolve, reject) => pbkdf2(password, salt, this.iterations, this.keylen, 'sha512', (err, key) => err ? reject(err) : resolve(key.toString('hex'))));
+        if (newHash === passwordHash) {
+            return {
+                isValid: true,
+            };
+        }
+        return {
+            isValid: false,
+            reason: 'badUsernameOrPassword',
+        };
+    }
+    async createCredential(userName, password) {
+        const salt = randomBytes(16).toString('hex');
+        const passwordHash = await new Promise((resolve, reject) => pbkdf2(password, salt, this.iterations, this.keylen, 'sha512', (err, key) => err ? reject(err) : resolve(key.toString('hex'))));
+        return {
+            userName,
+            salt,
+            passwordHash,
+            creationDate: new Date().toISOString(),
+        };
+    }
+};
+CryptoPasswordHasher = __decorate([
+    Injectable({ lifetime: 'singleton' })
+], CryptoPasswordHasher);
+export { CryptoPasswordHasher };
+//# sourceMappingURL=crypto-password-hasher.js.map

package/esm/crypto-password-hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-password-hasher.js","sourceRoot":"","sources":["../src/crypto-password-hasher.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAI5C,IAAa,oBAAoB,GAAjC,MAAa,oBAAoB;IAAjC;QACmB,eAAU,GAAG,IAAI,CAAA;QACjB,WAAM,GAAG,EAAE,CAAA;IAmC9B,CAAC;IAjCQ,KAAK,CAAC,gBAAgB,CAC3B,QAAgB,EAChB,EAAE,YAAY,EAAE,IAAI,EAAsB;QAE1C,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACpD,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC1E,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACjD,CACF,CAAA;QACD,IAAI,OAAO,KAAK,YAAY,EAAE;YAC5B,OAAO;gBACL,OAAO,EAAE,IAAI;aACd,CAAA;SACF;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,uBAAuB;SAChC,CAAA;IACH,CAAC;IACM,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,QAAgB;QAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACjE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC1E,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACjD,CACF,CAAA;QACD,OAAO;YACL,QAAQ;YACR,IAAI;YACJ,YAAY;YACZ,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAA;IACH,CAAC;CACF,CAAA;AArCY,oBAAoB;IADhC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;GACzB,oBAAoB,CAqChC;SArCY,oBAAoB"}

package/esm/errors/index.js

@@ -0,0 +1,4 @@
+export * from './password-complexity-error';
+export * from './unauthenticated-error';
+export * from './password-complexity-error';
+//# sourceMappingURL=index.js.map

package/esm/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,6BAA6B,CAAA"}

package/esm/errors/password-complexity-error.js

@@ -0,0 +1,11 @@
+export class PasswordComplexityError extends Error {
+    /**
+     * @param result A detailed error result array
+     * @param message The Error message
+     */
+    constructor(result, message) {
+        super(message);
+        this.result = result;
+    }
+}
+//# sourceMappingURL=password-complexity-error.js.map

package/esm/errors/password-complexity-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-complexity-error.js","sourceRoot":"","sources":["../../src/errors/password-complexity-error.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD;;;OAGG;IACH,YAA4B,MAAgD,EAAE,OAAgB;QAC5F,KAAK,CAAC,OAAO,CAAC,CAAA;QADY,WAAM,GAAN,MAAM,CAA0C;IAE5E,CAAC;CACF"}

package/esm/errors/unauthenticated-error.js

@@ -0,0 +1,6 @@
+/**
+ * Error that can be thrown if an authentication is required but not provided
+ */
+export class UnauthenticatedError extends Error {
+}
+//# sourceMappingURL=unauthenticated-error.js.map

package/esm/errors/unauthenticated-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unauthenticated-error.js","sourceRoot":"","sources":["../../src/errors/unauthenticated-error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG"}

package/esm/helpers.js

@@ -0,0 +1,12 @@
+import { SecurityPolicy } from './security-policy';
+/**
+ * Sets up the @furystack/security with the provided settings
+ * @param injector The Injector instance
+ * @param {Partial<SecurityPolicy>} policy The security policy to use
+ */
+export const usePasswordPolicy = (injector, policy) => {
+    const plainPolicy = new SecurityPolicy();
+    policy && Object.assign(plainPolicy, policy);
+    injector.setExplicitInstance(plainPolicy, SecurityPolicy);
+};
+//# sourceMappingURL=helpers.js.map

package/esm/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAkB,EAAE,MAAgC,EAAE,EAAE;IACxF,MAAM,WAAW,GAAG,IAAI,cAAc,EAAE,CAAA;IACxC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;AAC3D,CAAC,CAAA"}

package/esm/index.js

@@ -0,0 +1,9 @@
+export * from './crypto-password-hasher';
+export * from './errors';
+export * from './models';
+export * from './password-authenticator';
+export * from './password-complexity-rules';
+export * from './password-hasher';
+export * from './security-policy-manager';
+export * from './helpers';
+//# sourceMappingURL=index.js.map

package/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAA;AACxC,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA;AACxB,cAAc,0BAA0B,CAAA;AACxC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,mBAAmB,CAAA;AACjC,cAAc,2BAA2B,CAAA;AAEzC,cAAc,WAAW,CAAA"}

package/esm/models/index.js

@@ -0,0 +1,6 @@
+export * from './password-check-result';
+export * from './password-complexity-result';
+export * from './password-complexity-rule';
+export * from './password-credential';
+export * from './password-reset-token';
+//# sourceMappingURL=index.js.map

package/esm/models/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAA;AACvC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,wBAAwB,CAAA"}

package/esm/models/password-check-result.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=password-check-result.js.map

package/esm/models/password-check-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-check-result.js","sourceRoot":"","sources":["../../src/models/password-check-result.ts"],"names":[],"mappings":""}

package/esm/models/password-complexity-result.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=password-complexity-result.js.map

package/esm/models/password-complexity-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-complexity-result.js","sourceRoot":"","sources":["../../src/models/password-complexity-result.ts"],"names":[],"mappings":""}

package/esm/models/password-complexity-rule.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=password-complexity-rule.js.map

package/esm/models/password-complexity-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-complexity-rule.js","sourceRoot":"","sources":["../../src/models/password-complexity-rule.ts"],"names":[],"mappings":""}

package/esm/models/password-credential.js

@@ -0,0 +1,6 @@
+/**
+ * Entry that stores credential info for password login
+ */
+export class PasswordCredential {
+}
+//# sourceMappingURL=password-credential.js.map

package/esm/models/password-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-credential.js","sourceRoot":"","sources":["../../src/models/password-credential.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAO,kBAAkB;CAmB9B"}

package/esm/models/password-reset-token.js

@@ -0,0 +1,3 @@
+export class PasswordResetToken {
+}
+//# sourceMappingURL=password-reset-token.js.map

package/esm/models/password-reset-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-token.js","sourceRoot":"","sources":["../../src/models/password-reset-token.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,kBAAkB;CAa9B"}

package/esm/password-authenticator.js

@@ -0,0 +1,103 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { StoreManager } from '@furystack/core';
+import { Injectable, Injected, Injector } from '@furystack/inject';
+import { SecurityPolicyManager } from './security-policy-manager';
+import { UnauthenticatedError } from './errors';
+import { PasswordCredential, PasswordResetToken } from './models';
+import { PasswordComplexityError } from './errors/password-complexity-error';
+let PasswordAuthenticator = class PasswordAuthenticator {
+    constructor() {
+        this.getPasswordStore = () => this.injector.getInstance(StoreManager).getStoreFor(PasswordCredential, 'userName');
+        this.getTokenStore = () => this.injector.getInstance(StoreManager).getStoreFor(PasswordResetToken, 'token');
+        this.getHasher = () => this.injector.getInstance(this.policyManager.policy.hasher);
+    }
+    /**
+     * @param userName The User's unique name
+     * @param plainPassword The plain password to check
+     * @returns An object that contains an { isValid } value that indicates if the password is valid
+     */
+    async checkPasswordForUser(userName, plainPassword) {
+        const entry = await this.getPasswordStore().get(userName);
+        if (!entry) {
+            return {
+                isValid: false,
+                reason: 'badUsernameOrPassword',
+            };
+        }
+        const result = await this.getHasher().verifyCredential(plainPassword, entry);
+        if (result.isValid && this.policyManager.hasPasswordExpired(entry)) {
+            return {
+                isValid: false,
+                reason: 'passwordExpired',
+            };
+        }
+        return result;
+    }
+    /**
+     *
+     *Sets the password for the specific user
+     * @param userName The user to set the password for
+     * @param lastPassword The last user password
+     * @param plainPassword The password as a plain string
+     */
+    async setPasswordForUser(userName, lastPassword, plainPassword) {
+        const complexityResult = await this.policyManager.matchPasswordComplexityRules(plainPassword);
+        if (!complexityResult.match) {
+            throw new PasswordComplexityError(complexityResult.errors);
+        }
+        const lastResult = await this.checkPasswordForUser(userName, lastPassword);
+        if (!lastResult.isValid) {
+            throw new UnauthenticatedError();
+        }
+        const store = this.getPasswordStore();
+        const newCredential = await this.getHasher().createCredential(userName, plainPassword);
+        const existing = await store.get(userName);
+        existing && (await store.remove(existing.userName));
+        await store.add(newCredential);
+    }
+    /**
+     * Resets the password with a Password Reset token entry
+     * @param resetToken The Reset Token value
+     * @param plainPassword The new password in plain string
+     */
+    async resetPasswordForUser(resetToken, plainPassword) {
+        const token = await this.getTokenStore().get(resetToken);
+        if (!token) {
+            throw new UnauthenticatedError();
+        }
+        if (this.policyManager.hasTokenExpired(token)) {
+            await this.getTokenStore().remove(resetToken); // clean up token
+            throw new UnauthenticatedError();
+        }
+        const complexityResult = await this.policyManager.matchPasswordComplexityRules(plainPassword);
+        if (!complexityResult.match) {
+            throw new PasswordComplexityError(complexityResult.errors);
+        }
+        const newCredential = await this.getHasher().createCredential(token.userName, plainPassword);
+        const store = this.getPasswordStore();
+        const existing = await store.get(token.userName);
+        existing && (await store.remove(existing.userName));
+        await store.add(newCredential);
+    }
+};
+__decorate([
+    Injected(Injector),
+    __metadata("design:type", Injector)
+], PasswordAuthenticator.prototype, "injector", void 0);
+__decorate([
+    Injected(SecurityPolicyManager),
+    __metadata("design:type", SecurityPolicyManager)
+], PasswordAuthenticator.prototype, "policyManager", void 0);
+PasswordAuthenticator = __decorate([
+    Injectable({ lifetime: 'singleton' })
+], PasswordAuthenticator);
+export { PasswordAuthenticator };
+//# sourceMappingURL=password-authenticator.js.map

package/esm/password-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-authenticator.js","sourceRoot":"","sources":["../src/password-authenticator.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAE/C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AAG5E,IAAa,qBAAqB,GAAlC,MAAa,qBAAqB;IAAlC;QACmB,qBAAgB,GAAG,GAAG,EAAE,CACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;QAEpE,kBAAa,GAAG,GAAG,EAAE,CACpC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;QAElE,cAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAmF/F,CAAC;IAjFC;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,aAAqB;QACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACzD,IAAI,CAAC,KAAK,EAAE;YACV,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,uBAAuB;aAChC,CAAA;SACF;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QAC5E,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE;YAClE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iBAAiB;aAC1B,CAAA;SACF;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,kBAAkB,CAAC,QAAgB,EAAE,YAAoB,EAAE,aAAqB;QAC3F,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC7F,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE;YAC3B,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;SAC3D;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC1E,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;YACvB,MAAM,IAAI,oBAAoB,EAAE,CAAA;SACjC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACrC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QACtF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1C,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QACnD,MAAM,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAChC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAAC,UAAkB,EAAE,aAAqB;QACzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAExD,IAAI,CAAC,KAAK,EAAE;YACV,MAAM,IAAI,oBAAoB,EAAE,CAAA;SACjC;QAED,IAAI,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE;YAC7C,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA,CAAC,iBAAiB;YAC/D,MAAM,IAAI,oBAAoB,EAAE,CAAA;SACjC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC7F,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE;YAC3B,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;SAC3D;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QAC5F,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAChD,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QACnD,MAAM,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAChC,CAAC;CAOF,CAAA;AAJkB;IADhB,QAAQ,CAAC,QAAQ,CAAC;8BACS,QAAQ;uDAAA;AAG7B;IADN,QAAQ,CAAC,qBAAqB,CAAC;8BACT,qBAAqB;4DAAA;AAzFjC,qBAAqB;IADjC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;GACzB,qBAAqB,CA0FjC;SA1FY,qBAAqB"}

package/esm/password-complexity-rules/contains-lowercase.js

@@ -0,0 +1,25 @@
+/**
+ * @param lowerCaseCount The minimum lower case characters length
+ * @returns The created Password Policy object
+ */
+export const createContainsLowercasePolicy = (lowerCaseCount) => ({
+    name: 'containsLowercase',
+    check: async (passwordString) => {
+        const actualLowerCaseCount = passwordString.length >= lowerCaseCount
+            ? passwordString
+                .normalize('NFD')
+                .replace(/\p{Diacritic}/gu, '')
+                .replace(/[^a-z]/g, '').length
+            : 0;
+        const success = actualLowerCaseCount >= lowerCaseCount;
+        if (success) {
+            return { success };
+        }
+        return {
+            success,
+            message: `The password should contain at least ${lowerCaseCount} lower case characters`,
+            rule: 'containsLowercase',
+        };
+    },
+});
+//# sourceMappingURL=contains-lowercase.js.map

package/esm/password-complexity-rules/contains-lowercase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contains-lowercase.js","sourceRoot":"","sources":["../../src/password-complexity-rules/contains-lowercase.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,cAAsB,EAA0B,EAAE,CAAC,CAAC;IAChG,IAAI,EAAE,mBAA4B;IAClC,KAAK,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;QACtC,MAAM,oBAAoB,GACxB,cAAc,CAAC,MAAM,IAAI,cAAc;YACrC,CAAC,CAAC,cAAc;iBACX,SAAS,CAAC,KAAK,CAAC;iBAChB,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;iBAC9B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM;YAClC,CAAC,CAAC,CAAC,CAAA;QACP,MAAM,OAAO,GAAG,oBAAoB,IAAI,cAAc,CAAA;QACtD,IAAI,OAAO,EAAE;YACX,OAAO,EAAE,OAAO,EAAE,CAAA;SACnB;QACD,OAAO;YACL,OAAO;YACP,OAAO,EAAE,wCAAwC,cAAc,wBAAwB;YACvF,IAAI,EAAE,mBAAmB;SAC1B,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/esm/password-complexity-rules/contains-uppercase.js

@@ -0,0 +1,23 @@
+/**
+ * @param upperCaseCount The minimum upper case characters length
+ * @returns The created Password Policy object
+ */
+export const createContainsUppercasePolicy = (upperCaseCount) => ({
+    name: 'containsUppercase',
+    check: async (passwordString) => {
+        const actualUpperCaseCount = passwordString
+            .normalize('NFD')
+            .replace(/\p{Diacritic}/gu, '')
+            .replace(/[^A-Z]/g, '').length;
+        const success = actualUpperCaseCount >= upperCaseCount;
+        if (success) {
+            return { success };
+        }
+        return {
+            success,
+            message: `The password should contain at least ${upperCaseCount} upper case characters`,
+            rule: 'containsUppercase',
+        };
+    },
+});
+//# sourceMappingURL=contains-uppercase.js.map

package/esm/password-complexity-rules/contains-uppercase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contains-uppercase.js","sourceRoot":"","sources":["../../src/password-complexity-rules/contains-uppercase.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,cAAsB,EAA0B,EAAE,CAAC,CAAC;IAChG,IAAI,EAAE,mBAA4B;IAClC,KAAK,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;QACtC,MAAM,oBAAoB,GAAG,cAAc;aACxC,SAAS,CAAC,KAAK,CAAC;aAChB,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;aAC9B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,CAAA;QAChC,MAAM,OAAO,GAAG,oBAAoB,IAAI,cAAc,CAAA;QACtD,IAAI,OAAO,EAAE;YACX,OAAO,EAAE,OAAO,EAAE,CAAA;SACnB;QACD,OAAO;YACL,OAAO;YACP,OAAO,EAAE,wCAAwC,cAAc,wBAAwB;YACvF,IAAI,EAAE,mBAAmB;SAC1B,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/esm/password-complexity-rules/index.js

@@ -0,0 +1,5 @@
+export * from './contains-lowercase';
+export * from './contains-uppercase';
+export * from './max-length';
+export * from './min-length';
+//# sourceMappingURL=index.js.map

package/esm/password-complexity-rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/password-complexity-rules/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA"}

package/esm/password-complexity-rules/max-length.js

@@ -0,0 +1,15 @@
+/**
+ * @param maxLength The maximum password length
+ * @returns The created Password Policy object
+ */
+export const createMaxLengthComplexityRule = (maxLength) => ({
+    name: 'maxLength',
+    check: async (passwordString) => {
+        const success = passwordString.length <= maxLength;
+        if (success) {
+            return { success };
+        }
+        return { success, message: `The password has to be maximum ${maxLength} character length`, rule: 'maxLength' };
+    },
+});
+//# sourceMappingURL=max-length.js.map

package/esm/password-complexity-rules/max-length.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"max-length.js","sourceRoot":"","sources":["../../src/password-complexity-rules/max-length.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,SAAiB,EAA0B,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,WAAoB;IAC1B,KAAK,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,IAAI,SAAS,CAAA;QAClD,IAAI,OAAO,EAAE;YACX,OAAO,EAAE,OAAO,EAAE,CAAA;SACnB;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,kCAAkC,SAAS,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IAChH,CAAC;CACF,CAAC,CAAA"}

package/esm/password-complexity-rules/min-length.js

@@ -0,0 +1,15 @@
+/**
+ * @param minLength The minimum password length
+ * @returns The created Password Policy object
+ */
+export const createMinLengthComplexityRule = (minLength) => ({
+    name: 'minLength',
+    check: async (passwordString) => {
+        const success = passwordString.length >= minLength;
+        if (success) {
+            return { success };
+        }
+        return { success, message: `The password has to be at least ${minLength} character length`, rule: 'minLength' };
+    },
+});
+//# sourceMappingURL=min-length.js.map

package/esm/password-complexity-rules/min-length.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"min-length.js","sourceRoot":"","sources":["../../src/password-complexity-rules/min-length.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,SAAiB,EAA0B,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,WAAoB;IAC1B,KAAK,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,IAAI,SAAS,CAAA;QAClD,IAAI,OAAO,EAAE;YACX,OAAO,EAAE,OAAO,EAAE,CAAA;SACnB;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,SAAS,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IACjH,CAAC;CACF,CAAC,CAAA"}

package/esm/password-hasher.js

@@ -0,0 +1,20 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@furystack/inject';
+let PasswordHasher = class PasswordHasher {
+    createCredential(_userName, _password) {
+        throw Error('Set up hasher - TODO');
+    }
+    verifyCredential(_password, _credential) {
+        throw Error('Set up hasher - TODO');
+    }
+};
+PasswordHasher = __decorate([
+    Injectable({ lifetime: 'singleton' })
+], PasswordHasher);
+export { PasswordHasher };
+//# sourceMappingURL=password-hasher.js.map

package/esm/password-hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hasher.js","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAI9C,IAAa,cAAc,GAA3B,MAAa,cAAc;IAClB,gBAAgB,CAAC,SAAiB,EAAE,SAAiB;QAC1D,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrC,CAAC;IAEM,gBAAgB,CAAC,SAAiB,EAAE,WAA+B;QACxE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrC,CAAC;CACF,CAAA;AARY,cAAc;IAD1B,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;GACzB,cAAc,CAQ1B;SARY,cAAc"}

package/esm/security-policy-manager.js

@@ -0,0 +1,57 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable, Injected } from '@furystack/inject';
+import { SecurityPolicy } from './security-policy';
+let SecurityPolicyManager = class SecurityPolicyManager {
+    /**
+     * @param password The Plain password string
+     * @returns if the password matches the complexity rules
+     */
+    async matchPasswordComplexityRules(password) {
+        const result = await Promise.all(this.policy.passwordComplexityRules.map((rule) => rule.check(password)));
+        const failed = result.filter((r) => r.success === false);
+        if (failed.length) {
+            return {
+                match: false,
+                errors: failed.map((f) => f.success === false && { message: f.message, rule: f.rule }),
+            };
+        }
+        return {
+            match: true,
+        };
+    }
+    hasPasswordExpired(credential) {
+        if (!this.policy.passwordExpirationDays) {
+            return false;
+        }
+        const credentialExpiration = new Date(credential.creationDate);
+        credentialExpiration.setDate(credentialExpiration.getDate() + this.policy.passwordExpirationDays);
+        const now = new Date();
+        return now > credentialExpiration;
+    }
+    hasTokenExpired(token) {
+        if (!this.policy.resetTokenExpirationSeconds) {
+            return false;
+        }
+        const tokenExpiration = new Date(token.createdAt);
+        tokenExpiration.setSeconds(tokenExpiration.getSeconds() + this.policy.resetTokenExpirationSeconds);
+        const now = new Date();
+        return now > tokenExpiration;
+    }
+};
+__decorate([
+    Injected(SecurityPolicy),
+    __metadata("design:type", SecurityPolicy)
+], SecurityPolicyManager.prototype, "policy", void 0);
+SecurityPolicyManager = __decorate([
+    Injectable({ lifetime: 'singleton' })
+], SecurityPolicyManager);
+export { SecurityPolicyManager };
+//# sourceMappingURL=security-policy-manager.js.map

package/esm/security-policy-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy-manager.js","sourceRoot":"","sources":["../src/security-policy-manager.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGlD,IAAa,qBAAqB,GAAlC,MAAa,qBAAqB;IAChC;;;OAGG;IACI,KAAK,CAAC,4BAA4B,CAAC,QAAgB;QACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;QACzG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAA;QACxD,IAAI,MAAM,CAAC,MAAM,EAAE;YACjB,OAAO;gBACL,KAAK,EAAE,KAAc;gBACrB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAGnF;aACH,CAAA;SACF;QAED,OAAO;YACL,KAAK,EAAE,IAAa;SACrB,CAAA;IACH,CAAC;IAEM,kBAAkB,CAAC,UAA8B;QACtD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;YACvC,OAAO,KAAK,CAAA;SACb;QACD,MAAM,oBAAoB,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;QAC9D,oBAAoB,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACjG,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,OAAO,GAAG,GAAG,oBAAoB,CAAA;IACnC,CAAC;IAEM,eAAe,CAAC,KAAyB;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE;YAC5C,OAAO,KAAK,CAAA;SACb;QACD,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACjD,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAClG,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,OAAO,GAAG,GAAG,eAAe,CAAA;IAC9B,CAAC;CAIF,CAAA;AADiB;IADf,QAAQ,CAAC,cAAc,CAAC;8BACA,cAAc;qDAAA;AA5C5B,qBAAqB;IADjC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;GACzB,qBAAqB,CA6CjC;SA7CY,qBAAqB"}

package/esm/security-policy.js

@@ -0,0 +1,37 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@furystack/inject';
+import { CryptoPasswordHasher } from './crypto-password-hasher';
+let SecurityPolicy = class SecurityPolicy {
+    constructor() {
+        /**
+         * A Hasher instance for password hash generation
+         */
+        this.hasher = CryptoPasswordHasher;
+        /**
+         * Array of password complexity rules to apply
+         */
+        this.passwordComplexityRules = [];
+        /**
+         * The password expiration in days
+         */
+        this.passwordExpirationDays = 0;
+        /**
+         * Defines if the login needs a second factor authentication
+         */
+        this.requireSecondFactor = 'never'; // TODO - Challenge based on trusted devices
+        /**
+         * The Password Reset Token expiration in seconds
+         */
+        this.resetTokenExpirationSeconds = 15;
+    }
+};
+SecurityPolicy = __decorate([
+    Injectable({ lifetime: 'singleton' })
+], SecurityPolicy);
+export { SecurityPolicy };
+//# sourceMappingURL=security-policy.js.map

package/esm/security-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.js","sourceRoot":"","sources":["../src/security-policy.ts"],"names":[],"mappings":";;;;;;AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAK/D,IAAa,cAAc,GAA3B,MAAa,cAAc;IAA3B;QACE;;WAEG;QACH,WAAM,GAAkC,oBAAoB,CAAA;QAE5D;;WAEG;QACH,4BAAuB,GAA6B,EAAE,CAAA;QAEtD;;WAEG;QACH,2BAAsB,GAAG,CAAC,CAAA;QAE1B;;WAEG;QACH,wBAAmB,GAAuB,OAAO,CAAA,CAAC,4CAA4C;QAE9F;;WAEG;QACH,gCAA2B,GAAG,EAAE,CAAA;IAClC,CAAC;CAAA,CAAA;AAzBY,cAAc;IAD1B,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;GACzB,cAAc,CAyB1B;SAzBY,cAAc"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@furystack/security",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Security, password management and authorization related stuff for FuryStack",
   "type": "module",
   "scripts": {
@@ -23,7 +23,7 @@
     }
   },
   "files": [
-    "dist",
+    "esm",
     "types",
     "src"
   ],
@@ -44,9 +44,9 @@
     "url": "https://github.com/furystack/furystack/issues"
   },
   "dependencies": {
-    "@furystack/core": "^12.0.0",
-    "@furystack/inject": "^8.0.0",
-    "@furystack/utils": "^4.0.0"
+    "@furystack/core": "^12.0.1",
+    "@furystack/inject": "^8.0.1",
+    "@furystack/utils": "^4.0.1"
   },
   "homepage": "https://github.com/furystack/furystack",
   "devDependencies": {