@furystack/security 7.0.9 → 8.0.0

package/src/crypto-password-hasher.ts

@@ -1,44 +1,51 @@
-import { Injectable } from '@furystack/inject'
+import { defineService, type Token } from '@furystack/inject'
+import { pbkdf2, randomBytes } from 'crypto'
+import type { PasswordCheckResult } from './models/index.js'
 import type { PasswordHasher } from './password-hasher.js'
-import { randomBytes, pbkdf2 } from 'crypto'
-import type { PasswordCheckResult, PasswordCredential } from './models/index.js'
 
-@Injectable({ lifetime: 'singleton' })
-export class CryptoPasswordHasher implements PasswordHasher {
-  private readonly iterations = 1000
-  private readonly keylen = 64
+const ITERATIONS = 1000
+const KEY_LENGTH = 64
+const SALT_BYTES = 16
 
-  public async verifyCredential(
-    password: string,
-    { passwordHash, salt }: PasswordCredential,
-  ): Promise<PasswordCheckResult> {
-    const newHash = await new Promise((resolve, reject) =>
-      pbkdf2(password, salt, this.iterations, this.keylen, 'sha512', (err, key) =>
-        err ? reject(err) : resolve(key.toString('hex')),
-      ),
-    )
-    if (newHash === passwordHash) {
+const deriveHash = (password: string, salt: string): Promise<string> =>
+  new Promise<string>((resolve, reject) => {
+    pbkdf2(password, salt, ITERATIONS, KEY_LENGTH, 'sha512', (err, key) => {
+      if (err) {
+        reject(err)
+        return
+      }
+      resolve(key.toString('hex'))
+    })
+  })
+
+/**
+ * Default PBKDF2-based {@link PasswordHasher} implementation. Uses SHA-512
+ * with 1000 iterations and a 64-byte derived key length.
+ *
+ * Swap this token in {@link SecurityPolicy.hasher} to replace the hashing
+ * algorithm — for example with a stronger Argon2 implementation or a
+ * delegated hashing service.
+ */
+export const CryptoPasswordHasher: Token<PasswordHasher, 'singleton'> = defineService({
+  name: 'furystack/security/CryptoPasswordHasher',
+  lifetime: 'singleton',
+  factory: (): PasswordHasher => ({
+    verifyCredential: async (password, { passwordHash, salt }): Promise<PasswordCheckResult> => {
+      const candidate = await deriveHash(password, salt)
+      if (candidate === passwordHash) {
+        return { isValid: true }
+      }
+      return { isValid: false, reason: 'badUsernameOrPassword' }
+    },
+    createCredential: async (userName, password) => {
+      const salt = randomBytes(SALT_BYTES).toString('hex')
+      const passwordHash = await deriveHash(password, salt)
       return {
-        isValid: true,
+        userName,
+        salt,
+        passwordHash,
+        creationDate: new Date().toISOString(),
       }
-    }
-    return {
-      isValid: false,
-      reason: 'badUsernameOrPassword',
-    }
-  }
-  public async createCredential(userName: string, password: string) {
-    const salt = randomBytes(16).toString('hex')
-    const passwordHash = await new Promise<string>((resolve, reject) =>
-      pbkdf2(password, salt, this.iterations, this.keylen, 'sha512', (err, key) =>
-        err ? reject(err) : resolve(key.toString('hex')),
-      ),
-    )
-    return {
-      userName,
-      salt,
-      passwordHash,
-      creationDate: new Date().toISOString(),
-    }
-  }
-}
+    },
+  }),
+})

package/src/helpers.ts

@@ -1,22 +1,34 @@
 import type { Injector } from '@furystack/inject'
-import { SecurityPolicy } from './security-policy.js'
+import { PasswordAuthenticator } from './password-authenticator.js'
+import { SecurityPolicyManager } from './security-policy-manager.js'
+import { defaultSecurityPolicy, SecurityPolicy } from './security-policy.js'
 
 /**
- * Sets up the @furystack/security with the provided settings.
+ * Rebinds the {@link SecurityPolicy} on the given injector with the default
+ * policy merged with `overrides`.
  *
- * **Prerequisite:** DataSets for `PasswordCredential` and `PasswordResetToken` must be registered
- * via `getRepository(injector).createDataSet()` before `PasswordAuthenticator` is instantiated,
- * as it resolves these DataSets through `@Injected`.
+ * Apply this at application setup before resolving any service that reads
+ * the policy — {@link PasswordAuthenticator}, {@link SecurityPolicyManager}
+ * or direct `injector.get(SecurityPolicy)` callers. Because those services
+ * capture the policy at resolve time, calling `usePasswordPolicy` after
+ * they have been resolved has no effect unless you also invalidate them.
  *
- * @param injector The Injector instance
- * @param policy The security policy to use
+ * **Prerequisite:** bind persistent implementations of
+ * `PasswordCredentialStore` and `PasswordResetTokenStore` before resolving
+ * {@link PasswordAuthenticator}. Their default factories throw on purpose
+ * so password data is never silently kept in-memory.
+ *
+ * @example
+ * ```ts
+ * usePasswordPolicy(injector, {
+ *   passwordExpirationDays: 90,
+ *   passwordComplexityRules: [createMinLengthComplexityRule(8)],
+ * })
+ * ```
  */
-export const usePasswordPolicy = (injector: Injector, policy?: Partial<SecurityPolicy>) => {
-  const plainPolicy = new SecurityPolicy()
-
-  if (policy) {
-    Object.assign(plainPolicy, policy)
-  }
-
-  injector.setExplicitInstance(plainPolicy, SecurityPolicy)
+export const usePasswordPolicy = (injector: Injector, overrides?: Partial<SecurityPolicy>): void => {
+  injector.bind(SecurityPolicy, () => ({ ...defaultSecurityPolicy(), ...overrides }))
+  injector.invalidate(SecurityPolicy)
+  injector.invalidate(SecurityPolicyManager)
+  injector.invalidate(PasswordAuthenticator)
 }

package/src/index.ts

@@ -1,9 +1,10 @@
 export * from './crypto-password-hasher.js'
 export * from './errors/index.js'
+export * from './helpers.js'
 export * from './models/index.js'
 export * from './password-authenticator.js'
 export * from './password-complexity-rules/index.js'
+export * from './password-credential-store.js'
 export * from './password-hasher.js'
 export * from './security-policy-manager.js'
-
-export * from './helpers.js'
+export * from './security-policy.js'