@furystack/security 7.0.8 → 8.0.0

package/src/password-authenticator.ts

@@ -1,108 +1,114 @@
 import { useSystemIdentityContext } from '@furystack/core'
-import type { Injector } from '@furystack/inject'
-import { Injectable, Injected } from '@furystack/inject'
-import type { DataSet } from '@furystack/repository'
-import { getDataSetFor } from '@furystack/repository'
+import { defineService, type Token } from '@furystack/inject'
 import { UnauthenticatedError } from './errors/index.js'
 import { PasswordComplexityError } from './errors/password-complexity-error.js'
 import type { PasswordCheckResult } from './models/index.js'
-import { PasswordCredential, PasswordResetToken } from './models/index.js'
+import { PasswordCredentialDataSet, PasswordResetTokenDataSet } from './password-credential-store.js'
 import type { PasswordHasher } from './password-hasher.js'
 import { SecurityPolicyManager } from './security-policy-manager.js'
 
-@Injectable({ lifetime: 'singleton' })
-export class PasswordAuthenticator {
-  @Injected((injector) => useSystemIdentityContext({ injector, username: 'PasswordAuthenticator' }))
-  declare private readonly systemInjector: Injector
-
-  @Injected((injector) => getDataSetFor(injector, PasswordCredential, 'userName'))
-  declare private readonly passwordDataSet: DataSet<PasswordCredential, 'userName'>
-
-  @Injected((injector) => getDataSetFor(injector, PasswordResetToken, 'token'))
-  declare private readonly tokenDataSet: DataSet<PasswordResetToken, 'token'>
-
-  @Injected(function (this: PasswordAuthenticator, injector) {
-    return injector.getInstance(this.policyManager.policy.hasher)
-  })
-  declare public readonly hasher: PasswordHasher
-
+/**
+ * Authenticator surface: check stored credentials, rotate passwords and
+ * consume reset tokens. All writes are funneled through a system-identity
+ * scope so the underlying DataSets skip caller-scoped authorization.
+ */
+export interface PasswordAuthenticator {
+  /** The hasher bound by the active {@link SecurityPolicy}. Exposed for use in tests and migration helpers. */
+  readonly hasher: PasswordHasher
+  /** The {@link SecurityPolicyManager} resolved at construction. */
+  readonly policyManager: SecurityPolicyManager
   /**
-   * @param userName The User's unique name
-   * @param plainPassword The plain password to check
-   * @returns An object that contains an { isValid } value that indicates if the password is valid
+   * Verifies that the stored credential for `userName` matches
+   * `plainPassword` and honours the policy's expiration rules.
    */
-  public async checkPasswordForUser(userName: string, plainPassword: string): Promise<PasswordCheckResult> {
-    const entry = await this.passwordDataSet.get(this.systemInjector, userName)
-    if (!entry) {
-      return {
-        isValid: false,
-        reason: 'badUsernameOrPassword',
-      }
-    }
-    const result = await this.hasher.verifyCredential(plainPassword, entry)
-    if (result.isValid && this.policyManager.hasPasswordExpired(entry)) {
-      return {
-        isValid: false,
-        reason: 'passwordExpired',
-      }
-    }
-    return result
-  }
-
+  checkPasswordForUser(userName: string, plainPassword: string): Promise<PasswordCheckResult>
   /**
-   * Sets the password for the specific user
-   * @param userName The user to set the password for
-   * @param lastPassword The last user password
-   * @param plainPassword The password as a plain string
+   * Replaces the stored credential for `userName` with one derived from
+   * `plainPassword`. Requires the current `lastPassword` to be valid and
+   * `plainPassword` to pass the configured complexity rules.
    */
-  public async setPasswordForUser(userName: string, lastPassword: string, plainPassword: string): Promise<void> {
-    const complexityResult = await this.policyManager.matchPasswordComplexityRules(plainPassword)
-    if (!complexityResult.match) {
-      throw new PasswordComplexityError(complexityResult.errors)
-    }
-
-    const lastResult = await this.checkPasswordForUser(userName, lastPassword)
-    if (!lastResult.isValid) {
-      throw new UnauthenticatedError()
-    }
-    const newCredential = await this.hasher.createCredential(userName, plainPassword)
-    const existing = await this.passwordDataSet.get(this.systemInjector, userName)
-    if (existing) {
-      await this.passwordDataSet.remove(this.systemInjector, existing.userName)
-    }
-    await this.passwordDataSet.add(this.systemInjector, newCredential)
-  }
-
+  setPasswordForUser(userName: string, lastPassword: string, plainPassword: string): Promise<void>
   /**
-   * Resets the password with a Password Reset token entry
-   * @param resetToken The Reset Token value
-   * @param plainPassword The new password in plain string
+   * Consumes `resetToken` and rotates the associated user's password to
+   * one derived from `plainPassword`. Expired tokens are rejected and
+   * cleaned up; bad tokens raise {@link UnauthenticatedError}.
    */
-  public async resetPasswordForUser(resetToken: string, plainPassword: string): Promise<void> {
-    const token = await this.tokenDataSet.get(this.systemInjector, resetToken)
+  resetPasswordForUser(resetToken: string, plainPassword: string): Promise<void>
+}
 
-    if (!token) {
-      throw new UnauthenticatedError()
+/**
+ * DI token for the singleton {@link PasswordAuthenticator}.
+ *
+ * The factory creates a system-identity child scope once (at first
+ * resolution) and uses it for every credential mutation. The scope is
+ * torn down alongside the owning injector via `onDispose`.
+ */
+export const PasswordAuthenticator: Token<PasswordAuthenticator, 'singleton'> = defineService({
+  name: 'furystack/security/PasswordAuthenticator',
+  lifetime: 'singleton',
+  factory: ({ inject, injector, onDispose }): PasswordAuthenticator => {
+    const policyManager = inject(SecurityPolicyManager)
+    const hasher = inject(policyManager.policy.hasher)
+    const passwordDataSet = inject(PasswordCredentialDataSet)
+    const tokenDataSet = inject(PasswordResetTokenDataSet)
+    const systemInjector = useSystemIdentityContext({ injector, username: 'PasswordAuthenticator' })
+    onDispose(() => systemInjector[Symbol.asyncDispose]())
+
+    const checkPasswordForUser = async (userName: string, plainPassword: string): Promise<PasswordCheckResult> => {
+      const entry = await passwordDataSet.get(systemInjector, userName)
+      if (!entry) {
+        return { isValid: false, reason: 'badUsernameOrPassword' }
+      }
+      const result = await hasher.verifyCredential(plainPassword, entry)
+      if (result.isValid && policyManager.hasPasswordExpired(entry)) {
+        return { isValid: false, reason: 'passwordExpired' }
+      }
+      return result
     }
 
-    if (this.policyManager.hasTokenExpired(token)) {
-      await this.tokenDataSet.remove(this.systemInjector, resetToken)
-      throw new UnauthenticatedError()
+    const replaceCredential = async (userName: string, plainPassword: string): Promise<void> => {
+      const newCredential = await hasher.createCredential(userName, plainPassword)
+      const existing = await passwordDataSet.get(systemInjector, userName)
+      if (existing) {
+        await passwordDataSet.remove(systemInjector, existing.userName)
+      }
+      await passwordDataSet.add(systemInjector, newCredential)
     }
 
-    const complexityResult = await this.policyManager.matchPasswordComplexityRules(plainPassword)
-    if (!complexityResult.match) {
-      throw new PasswordComplexityError(complexityResult.errors)
+    const setPasswordForUser = async (userName: string, lastPassword: string, plainPassword: string): Promise<void> => {
+      const complexityResult = await policyManager.matchPasswordComplexityRules(plainPassword)
+      if (!complexityResult.match) {
+        throw new PasswordComplexityError(complexityResult.errors)
+      }
+      const lastResult = await checkPasswordForUser(userName, lastPassword)
+      if (!lastResult.isValid) {
+        throw new UnauthenticatedError()
+      }
+      await replaceCredential(userName, plainPassword)
     }
 
-    const newCredential = await this.hasher.createCredential(token.userName, plainPassword)
-    const existing = await this.passwordDataSet.get(this.systemInjector, token.userName)
-    if (existing) {
-      await this.passwordDataSet.remove(this.systemInjector, existing.userName)
+    const resetPasswordForUser = async (resetToken: string, plainPassword: string): Promise<void> => {
+      const token = await tokenDataSet.get(systemInjector, resetToken)
+      if (!token) {
+        throw new UnauthenticatedError()
+      }
+      if (policyManager.hasTokenExpired(token)) {
+        await tokenDataSet.remove(systemInjector, resetToken)
+        throw new UnauthenticatedError()
+      }
+      const complexityResult = await policyManager.matchPasswordComplexityRules(plainPassword)
+      if (!complexityResult.match) {
+        throw new PasswordComplexityError(complexityResult.errors)
+      }
+      await replaceCredential(token.userName, plainPassword)
     }
-    await this.passwordDataSet.add(this.systemInjector, newCredential)
-  }
 
-  @Injected(SecurityPolicyManager)
-  declare public policyManager: SecurityPolicyManager
-}
+    return {
+      hasher,
+      policyManager,
+      checkPasswordForUser,
+      setPasswordForUser,
+      resetPasswordForUser,
+    }
+  },
+})

package/src/password-credential-store.spec.ts

@@ -0,0 +1,77 @@
+import { InMemoryStore } from '@furystack/core'
+import { createInjector } from '@furystack/inject'
+import { usingAsync } from '@furystack/utils'
+import { describe, expect, it } from 'vitest'
+import { PasswordCredential } from './models/password-credential.js'
+import { PasswordResetToken } from './models/password-reset-token.js'
+import {
+  PasswordCredentialDataSet,
+  PasswordCredentialStore,
+  PasswordResetTokenDataSet,
+  PasswordResetTokenStore,
+  SecurityStoreNotConfiguredError,
+} from './password-credential-store.js'
+
+describe('PasswordCredentialStore', () => {
+  it('exposes the PasswordCredential model and userName primary key on the token', () => {
+    expect(PasswordCredentialStore.model).toBe(PasswordCredential)
+    expect(PasswordCredentialStore.primaryKey).toBe('userName')
+    expect(PasswordCredentialStore.lifetime).toBe('singleton')
+  })
+
+  it('throws SecurityStoreNotConfiguredError when resolved without an override', async () => {
+    await usingAsync(createInjector(), async (injector) => {
+      expect(() => injector.get(PasswordCredentialStore)).toThrow(SecurityStoreNotConfiguredError)
+      expect(() => injector.get(PasswordCredentialStore)).toThrow(/PasswordCredentialStore.*not been configured/)
+    })
+  })
+
+  it('returns the bound implementation after rebinding the token', async () => {
+    await usingAsync(createInjector(), async (injector) => {
+      const impl = new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' })
+      injector.bind(PasswordCredentialStore, () => impl)
+      expect(injector.get(PasswordCredentialStore)).toBe(impl)
+    })
+  })
+})
+
+describe('PasswordResetTokenStore', () => {
+  it('exposes the PasswordResetToken model and token primary key on the token', () => {
+    expect(PasswordResetTokenStore.model).toBe(PasswordResetToken)
+    expect(PasswordResetTokenStore.primaryKey).toBe('token')
+    expect(PasswordResetTokenStore.lifetime).toBe('singleton')
+  })
+
+  it('throws SecurityStoreNotConfiguredError when resolved without an override', async () => {
+    await usingAsync(createInjector(), async (injector) => {
+      expect(() => injector.get(PasswordResetTokenStore)).toThrow(SecurityStoreNotConfiguredError)
+      expect(() => injector.get(PasswordResetTokenStore)).toThrow(/PasswordResetTokenStore.*not been configured/)
+    })
+  })
+
+  it('returns the bound implementation after rebinding the token', async () => {
+    await usingAsync(createInjector(), async (injector) => {
+      const impl = new InMemoryStore({ model: PasswordResetToken, primaryKey: 'token' })
+      injector.bind(PasswordResetTokenStore, () => impl)
+      expect(injector.get(PasswordResetTokenStore)).toBe(impl)
+    })
+  })
+})
+
+describe('PasswordCredentialDataSet / PasswordResetTokenDataSet', () => {
+  it('mirror the backing store metadata onto the data-set token', () => {
+    expect(PasswordCredentialDataSet.model).toBe(PasswordCredential)
+    expect(PasswordCredentialDataSet.primaryKey).toBe('userName')
+    expect(PasswordResetTokenDataSet.model).toBe(PasswordResetToken)
+    expect(PasswordResetTokenDataSet.primaryKey).toBe('token')
+  })
+})
+
+describe('SecurityStoreNotConfiguredError', () => {
+  it('embeds the store name in the message and sets the error name', () => {
+    const error = new SecurityStoreNotConfiguredError('SomeStore')
+    expect(error.name).toBe('SecurityStoreNotConfiguredError')
+    expect(error.message).toContain('SomeStore')
+    expect(error).toBeInstanceOf(Error)
+  })
+})

package/src/password-credential-store.ts

@@ -0,0 +1,79 @@
+import { defineStore, type StoreToken } from '@furystack/core'
+import { defineDataSet, type DataSetToken } from '@furystack/repository'
+import { PasswordCredential } from './models/password-credential.js'
+import { PasswordResetToken } from './models/password-reset-token.js'
+
+/**
+ * Error thrown by the default factories of {@link PasswordCredentialStore}
+ * and {@link PasswordResetTokenStore} when they are resolved without a
+ * caller-provided override.
+ *
+ * Password credentials and reset tokens **must** survive process restarts,
+ * so security refuses to fall back to an in-memory store. Applications
+ * must bind a persistent implementation before resolving the
+ * {@link PasswordAuthenticator}.
+ */
+export class SecurityStoreNotConfiguredError extends Error {
+  constructor(storeName: string) {
+    super(
+      `Security store '${storeName}' has not been configured. Bind a persistent PhysicalStore for ${storeName} before resolving the PasswordAuthenticator.`,
+    )
+    this.name = 'SecurityStoreNotConfiguredError'
+  }
+}
+
+/**
+ * Store token for persisted {@link PasswordCredential} records. The default
+ * factory deliberately throws — applications are expected to rebind this
+ * token on their root injector with a persistent backing store before
+ * resolving any service that depends on it.
+ *
+ * @example
+ * ```ts
+ * injector.bind(PasswordCredentialStore, () => myPersistentCredentialStore)
+ * ```
+ */
+export const PasswordCredentialStore: StoreToken<PasswordCredential, 'userName'> = defineStore({
+  name: 'furystack/security/PasswordCredentialStore',
+  model: PasswordCredential,
+  primaryKey: 'userName',
+  factory: () => {
+    throw new SecurityStoreNotConfiguredError('PasswordCredentialStore')
+  },
+})
+
+/**
+ * Store token for persisted {@link PasswordResetToken} records. Shares the
+ * throw-by-default contract with {@link PasswordCredentialStore}.
+ *
+ * @example
+ * ```ts
+ * injector.bind(PasswordResetTokenStore, () => myPersistentTokenStore)
+ * ```
+ */
+export const PasswordResetTokenStore: StoreToken<PasswordResetToken, 'token'> = defineStore({
+  name: 'furystack/security/PasswordResetTokenStore',
+  model: PasswordResetToken,
+  primaryKey: 'token',
+  factory: () => {
+    throw new SecurityStoreNotConfiguredError('PasswordResetTokenStore')
+  },
+})
+
+/**
+ * Data set token over {@link PasswordCredentialStore}. The security services
+ * route all credential I/O through this dataset so authorization, hooks and
+ * change events can be layered on top of the raw store.
+ */
+export const PasswordCredentialDataSet: DataSetToken<PasswordCredential, 'userName'> = defineDataSet({
+  name: 'furystack/security/PasswordCredentialDataSet',
+  store: PasswordCredentialStore,
+})
+
+/**
+ * Data set token over {@link PasswordResetTokenStore}.
+ */
+export const PasswordResetTokenDataSet: DataSetToken<PasswordResetToken, 'token'> = defineDataSet({
+  name: 'furystack/security/PasswordResetTokenDataSet',
+  store: PasswordResetTokenStore,
+})

package/src/password-hasher.ts

@@ -1,13 +1,25 @@
-import { Injectable } from '@furystack/inject'
 import type { PasswordCheckResult, PasswordCredential } from './models/index.js'
 
-@Injectable({ lifetime: 'singleton' })
-export class PasswordHasher {
-  public createCredential(_userName: string, _password: string): Promise<PasswordCredential> {
-    throw Error('Set up hasher - TODO')
-  }
+/**
+ * Abstraction for hashing and verifying password credentials.
+ *
+ * Implementations are DI tokens that resolve to an object conforming to this
+ * interface. The default implementation shipped by `@furystack/security` is
+ * {@link CryptoPasswordHasher}; applications can swap in an alternative by
+ * binding the {@link SecurityPolicy.hasher} token (for example, to use a
+ * stronger KDF or a managed hashing service).
+ */
+export interface PasswordHasher {
+  /**
+   * Produces a fresh credential entry for the given user name and plain
+   * password. The returned record is suitable for persistence in the
+   * credential store.
+   */
+  createCredential(userName: string, password: string): Promise<PasswordCredential>
 
-  public verifyCredential(_password: string, _credential: PasswordCredential): Promise<PasswordCheckResult> {
-    throw Error('Set up hasher - TODO')
-  }
+  /**
+   * Verifies a plain password against a stored credential. Implementations
+   * should be constant-time relative to the password to avoid timing leaks.
+   */
+  verifyCredential(password: string, credential: PasswordCredential): Promise<PasswordCheckResult>
 }

package/src/security-policy-manager.spec.ts

@@ -1,17 +1,73 @@
-import { Injector } from '@furystack/inject'
+import { createInjector } from '@furystack/inject'
 import { usingAsync } from '@furystack/utils'
 import { describe, expect, it } from 'vitest'
 import { usePasswordPolicy } from './helpers.js'
 import { SecurityPolicyManager } from './security-policy-manager.js'
 
 describe('SecurityPolicyManager', () => {
-  it('Should return false when no token expiration has been set', async () => {
-    await usingAsync(new Injector(), async (i) => {
+  it('returns a cached manager backed by the current policy', async () => {
+    await usingAsync(createInjector(), async (i) => {
+      usePasswordPolicy(i, { passwordExpirationDays: 30 })
+      const manager = i.get(SecurityPolicyManager)
+      expect(manager.policy.passwordExpirationDays).toBe(30)
+    })
+  })
+
+  it('never considers a token expired when resetTokenExpirationSeconds is 0', async () => {
+    await usingAsync(createInjector(), async (i) => {
       usePasswordPolicy(i, { resetTokenExpirationSeconds: 0 })
-      const result = i
-        .getInstance(SecurityPolicyManager)
-        .hasTokenExpired({ createdAt: new Date().toISOString(), token: 'token', userName: 'user' })
-      expect(result).toBeFalsy()
+      const expired = i
+        .get(SecurityPolicyManager)
+        .hasTokenExpired({ createdAt: new Date(0).toISOString(), token: 'token', userName: 'user' })
+      expect(expired).toBe(false)
+    })
+  })
+
+  it('flags a token as expired once its lifetime has elapsed', async () => {
+    await usingAsync(createInjector(), async (i) => {
+      usePasswordPolicy(i, { resetTokenExpirationSeconds: 1 })
+      const pastCreatedAt = new Date()
+      pastCreatedAt.setSeconds(pastCreatedAt.getSeconds() - 10)
+      const expired = i
+        .get(SecurityPolicyManager)
+        .hasTokenExpired({ createdAt: pastCreatedAt.toISOString(), token: 'token', userName: 'user' })
+      expect(expired).toBe(true)
+    })
+  })
+
+  it('never considers a credential expired when passwordExpirationDays is 0', async () => {
+    await usingAsync(createInjector(), async (i) => {
+      usePasswordPolicy(i, { passwordExpirationDays: 0 })
+      const expired = i.get(SecurityPolicyManager).hasPasswordExpired({
+        userName: 'user',
+        passwordHash: 'hash',
+        salt: 'salt',
+        creationDate: new Date(0).toISOString(),
+      })
+      expect(expired).toBe(false)
+    })
+  })
+
+  it('flags a credential as expired once its lifetime has elapsed', async () => {
+    await usingAsync(createInjector(), async (i) => {
+      usePasswordPolicy(i, { passwordExpirationDays: 1 })
+      const pastCreationDate = new Date()
+      pastCreationDate.setDate(pastCreationDate.getDate() - 5)
+      const expired = i.get(SecurityPolicyManager).hasPasswordExpired({
+        userName: 'user',
+        passwordHash: 'hash',
+        salt: 'salt',
+        creationDate: pastCreationDate.toISOString(),
+      })
+      expect(expired).toBe(true)
+    })
+  })
+
+  it('reports match=true when no complexity rules are configured', async () => {
+    await usingAsync(createInjector(), async (i) => {
+      usePasswordPolicy(i)
+      const result = await i.get(SecurityPolicyManager).matchPasswordComplexityRules('anything')
+      expect(result.match).toBe(true)
     })
   })
 })

package/src/security-policy-manager.ts

@@ -1,51 +1,100 @@
-import { Injectable, Injected } from '@furystack/inject'
+import { defineService, type Token } from '@furystack/inject'
 import type { PasswordCredential, PasswordResetToken } from './models/index.js'
 import { SecurityPolicy } from './security-policy.js'
 
-@Injectable({ lifetime: 'singleton' })
-export class SecurityPolicyManager {
+/**
+ * Result of a successful password complexity check — no rule reported a
+ * failure.
+ */
+export type PasswordComplexityMatch = { match: true }
+
+/**
+ * Result of a failed password complexity check along with the individual
+ * rule failures for user-facing reporting.
+ */
+export type PasswordComplexityMismatch = {
+  match: false
+  errors: Array<{ message: string; rule: string }>
+}
+
+/**
+ * Runtime checker for the active {@link SecurityPolicy}. Applies complexity
+ * rules to candidate passwords and determines whether stored credentials
+ * and reset tokens have expired.
+ */
+export interface SecurityPolicyManager {
+  /** The active {@link SecurityPolicy} snapshot captured at resolve time. */
+  readonly policy: SecurityPolicy
   /**
-   * @param password The Plain password string
-   * @returns whether the password matches the complexity rules
+   * Evaluates every complexity rule against `password` and aggregates the
+   * result. `match: true` means the password is acceptable.
    */
-  public async matchPasswordComplexityRules(password: string) {
-    const result = await Promise.all(this.policy.passwordComplexityRules.map((rule) => rule.check(password)))
-    const failed = result.filter((r) => r.success === false)
-    if (failed.length) {
-      return {
-        match: false as const,
-        errors: failed.map((f) => f.success === false && { message: f.message, rule: f.rule }) as Array<{
-          message: string
-          rule: string
-        }>,
-      }
-    }
+  matchPasswordComplexityRules(password: string): Promise<PasswordComplexityMatch | PasswordComplexityMismatch>
+  /**
+   * Returns `true` when `credential.creationDate` plus
+   * `policy.passwordExpirationDays` is in the past. Always `false` when the
+   * policy sets `passwordExpirationDays` to `0`.
+   */
+  hasPasswordExpired(credential: PasswordCredential): boolean
+  /**
+   * Returns `true` when `token.createdAt` plus
+   * `policy.resetTokenExpirationSeconds` is in the past. Always `false`
+   * when the policy sets `resetTokenExpirationSeconds` to `0`.
+   */
+  hasTokenExpired(token: PasswordResetToken): boolean
+}
 
-    return {
-      match: true as const,
-    }
-  }
+const addDays = (base: Date, days: number): Date => {
+  const result = new Date(base)
+  result.setDate(result.getDate() + days)
+  return result
+}
 
-  public hasPasswordExpired(credential: PasswordCredential) {
-    if (!this.policy.passwordExpirationDays) {
-      return false
-    }
-    const credentialExpiration = new Date(credential.creationDate)
-    credentialExpiration.setDate(credentialExpiration.getDate() + this.policy.passwordExpirationDays)
-    const now = new Date()
-    return now > credentialExpiration
-  }
+const addSeconds = (base: Date, seconds: number): Date => {
+  const result = new Date(base)
+  result.setSeconds(result.getSeconds() + seconds)
+  return result
+}
 
-  public hasTokenExpired(token: PasswordResetToken) {
-    if (!this.policy.resetTokenExpirationSeconds) {
-      return false
+/**
+ * DI token for the singleton {@link SecurityPolicyManager}. Resolves the
+ * current {@link SecurityPolicy} once and closes over it for the lifetime
+ * of the owning injector.
+ */
+export const SecurityPolicyManager: Token<SecurityPolicyManager, 'singleton'> = defineService({
+  name: 'furystack/security/SecurityPolicyManager',
+  lifetime: 'singleton',
+  factory: ({ inject }): SecurityPolicyManager => {
+    const policy = inject(SecurityPolicy)
+    return {
+      policy,
+      matchPasswordComplexityRules: async (password) => {
+        const outcomes = await Promise.all(policy.passwordComplexityRules.map((rule) => rule.check(password)))
+        const failed = outcomes.filter((outcome) => outcome.success === false)
+        if (failed.length === 0) {
+          return { match: true }
+        }
+        return {
+          match: false,
+          errors: failed.map((outcome) =>
+            outcome.success === false ? { message: outcome.message, rule: outcome.rule } : { message: '', rule: '' },
+          ),
+        }
+      },
+      hasPasswordExpired: (credential) => {
+        if (!policy.passwordExpirationDays) {
+          return false
+        }
+        const expiration = addDays(new Date(credential.creationDate), policy.passwordExpirationDays)
+        return new Date() > expiration
+      },
+      hasTokenExpired: (token) => {
+        if (!policy.resetTokenExpirationSeconds) {
+          return false
+        }
+        const expiration = addSeconds(new Date(token.createdAt), policy.resetTokenExpirationSeconds)
+        return new Date() > expiration
+      },
     }
-    const tokenExpiration = new Date(token.createdAt)
-    tokenExpiration.setSeconds(tokenExpiration.getSeconds() + this.policy.resetTokenExpirationSeconds)
-    const now = new Date()
-    return now > tokenExpiration
-  }
-
-  @Injected(SecurityPolicy)
-  declare public readonly policy: SecurityPolicy
-}
+  },
+})