@furystack/security 7.0.9 → 8.0.1

package/esm/password-authenticator.js

@@ -1,114 +1,78 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
 import { useSystemIdentityContext } from '@furystack/core';
-import { Injectable, Injected } from '@furystack/inject';
-import { getDataSetFor } from '@furystack/repository';
+import { defineService } from '@furystack/inject';
 import { UnauthenticatedError } from './errors/index.js';
 import { PasswordComplexityError } from './errors/password-complexity-error.js';
-import { PasswordCredential, PasswordResetToken } from './models/index.js';
+import { PasswordCredentialDataSet, PasswordResetTokenDataSet } from './password-credential-store.js';
 import { SecurityPolicyManager } from './security-policy-manager.js';
-let PasswordAuthenticator = class PasswordAuthenticator {
-    /**
-     * @param userName The User's unique name
-     * @param plainPassword The plain password to check
-     * @returns An object that contains an { isValid } value that indicates if the password is valid
-     */
-    async checkPasswordForUser(userName, plainPassword) {
-        const entry = await this.passwordDataSet.get(this.systemInjector, userName);
-        if (!entry) {
-            return {
-                isValid: false,
-                reason: 'badUsernameOrPassword',
-            };
-        }
-        const result = await this.hasher.verifyCredential(plainPassword, entry);
-        if (result.isValid && this.policyManager.hasPasswordExpired(entry)) {
-            return {
-                isValid: false,
-                reason: 'passwordExpired',
-            };
-        }
-        return result;
-    }
-    /**
-     * Sets the password for the specific user
-     * @param userName The user to set the password for
-     * @param lastPassword The last user password
-     * @param plainPassword The password as a plain string
-     */
-    async setPasswordForUser(userName, lastPassword, plainPassword) {
-        const complexityResult = await this.policyManager.matchPasswordComplexityRules(plainPassword);
-        if (!complexityResult.match) {
-            throw new PasswordComplexityError(complexityResult.errors);
-        }
-        const lastResult = await this.checkPasswordForUser(userName, lastPassword);
-        if (!lastResult.isValid) {
-            throw new UnauthenticatedError();
-        }
-        const newCredential = await this.hasher.createCredential(userName, plainPassword);
-        const existing = await this.passwordDataSet.get(this.systemInjector, userName);
-        if (existing) {
-            await this.passwordDataSet.remove(this.systemInjector, existing.userName);
-        }
-        await this.passwordDataSet.add(this.systemInjector, newCredential);
-    }
-    /**
-     * Resets the password with a Password Reset token entry
-     * @param resetToken The Reset Token value
-     * @param plainPassword The new password in plain string
-     */
-    async resetPasswordForUser(resetToken, plainPassword) {
-        const token = await this.tokenDataSet.get(this.systemInjector, resetToken);
-        if (!token) {
-            throw new UnauthenticatedError();
-        }
-        if (this.policyManager.hasTokenExpired(token)) {
-            await this.tokenDataSet.remove(this.systemInjector, resetToken);
-            throw new UnauthenticatedError();
-        }
-        const complexityResult = await this.policyManager.matchPasswordComplexityRules(plainPassword);
-        if (!complexityResult.match) {
-            throw new PasswordComplexityError(complexityResult.errors);
-        }
-        const newCredential = await this.hasher.createCredential(token.userName, plainPassword);
-        const existing = await this.passwordDataSet.get(this.systemInjector, token.userName);
-        if (existing) {
-            await this.passwordDataSet.remove(this.systemInjector, existing.userName);
-        }
-        await this.passwordDataSet.add(this.systemInjector, newCredential);
-    }
-};
-__decorate([
-    Injected((injector) => useSystemIdentityContext({ injector, username: 'PasswordAuthenticator' })),
-    __metadata("design:type", Function)
-], PasswordAuthenticator.prototype, "systemInjector", void 0);
-__decorate([
-    Injected((injector) => getDataSetFor(injector, PasswordCredential, 'userName')),
-    __metadata("design:type", Function)
-], PasswordAuthenticator.prototype, "passwordDataSet", void 0);
-__decorate([
-    Injected((injector) => getDataSetFor(injector, PasswordResetToken, 'token')),
-    __metadata("design:type", Function)
-], PasswordAuthenticator.prototype, "tokenDataSet", void 0);
-__decorate([
-    Injected(function (injector) {
-        return injector.getInstance(this.policyManager.policy.hasher);
-    }),
-    __metadata("design:type", Function)
-], PasswordAuthenticator.prototype, "hasher", void 0);
-__decorate([
-    Injected(SecurityPolicyManager),
-    __metadata("design:type", SecurityPolicyManager)
-], PasswordAuthenticator.prototype, "policyManager", void 0);
-PasswordAuthenticator = __decorate([
-    Injectable({ lifetime: 'singleton' })
-], PasswordAuthenticator);
-export { PasswordAuthenticator };
+/**
+ * DI token for the singleton {@link PasswordAuthenticator}.
+ *
+ * The factory creates a system-identity child scope once (at first
+ * resolution) and uses it for every credential mutation. The scope is
+ * torn down alongside the owning injector via `onDispose`.
+ */
+export const PasswordAuthenticator = defineService({
+    name: 'furystack/security/PasswordAuthenticator',
+    lifetime: 'singleton',
+    factory: ({ inject, injector, onDispose }) => {
+        const policyManager = inject(SecurityPolicyManager);
+        const hasher = inject(policyManager.policy.hasher);
+        const passwordDataSet = inject(PasswordCredentialDataSet);
+        const tokenDataSet = inject(PasswordResetTokenDataSet);
+        const systemInjector = useSystemIdentityContext({ injector, username: 'PasswordAuthenticator' });
+        onDispose(() => systemInjector[Symbol.asyncDispose]());
+        const checkPasswordForUser = async (userName, plainPassword) => {
+            const entry = await passwordDataSet.get(systemInjector, userName);
+            if (!entry) {
+                return { isValid: false, reason: 'badUsernameOrPassword' };
+            }
+            const result = await hasher.verifyCredential(plainPassword, entry);
+            if (result.isValid && policyManager.hasPasswordExpired(entry)) {
+                return { isValid: false, reason: 'passwordExpired' };
+            }
+            return result;
+        };
+        const replaceCredential = async (userName, plainPassword) => {
+            const newCredential = await hasher.createCredential(userName, plainPassword);
+            const existing = await passwordDataSet.get(systemInjector, userName);
+            if (existing) {
+                await passwordDataSet.remove(systemInjector, existing.userName);
+            }
+            await passwordDataSet.add(systemInjector, newCredential);
+        };
+        const setPasswordForUser = async (userName, lastPassword, plainPassword) => {
+            const complexityResult = await policyManager.matchPasswordComplexityRules(plainPassword);
+            if (!complexityResult.match) {
+                throw new PasswordComplexityError(complexityResult.errors);
+            }
+            const lastResult = await checkPasswordForUser(userName, lastPassword);
+            if (!lastResult.isValid) {
+                throw new UnauthenticatedError();
+            }
+            await replaceCredential(userName, plainPassword);
+        };
+        const resetPasswordForUser = async (resetToken, plainPassword) => {
+            const token = await tokenDataSet.get(systemInjector, resetToken);
+            if (!token) {
+                throw new UnauthenticatedError();
+            }
+            if (policyManager.hasTokenExpired(token)) {
+                await tokenDataSet.remove(systemInjector, resetToken);
+                throw new UnauthenticatedError();
+            }
+            const complexityResult = await policyManager.matchPasswordComplexityRules(plainPassword);
+            if (!complexityResult.match) {
+                throw new PasswordComplexityError(complexityResult.errors);
+            }
+            await replaceCredential(token.userName, plainPassword);
+        };
+        return {
+            hasher,
+            policyManager,
+            checkPasswordForUser,
+            setPasswordForUser,
+            resetPasswordForUser,
+        };
+    },
+});
 //# sourceMappingURL=password-authenticator.js.map

package/esm/password-authenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-authenticator.js","sourceRoot":"","sources":["../src/password-authenticator.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAE1D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AAE/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAE1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAG7D,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAehC;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,aAAqB;QACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,uBAAuB;aAChC,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QACvE,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iBAAiB;aAC1B,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAAC,QAAgB,EAAE,YAAoB,EAAE,aAAqB;QAC3F,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC7F,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC1E,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,EAAE,CAAA;QAClC,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;QAC9E,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,CAAC;QACD,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IACpE,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAAC,UAAkB,EAAE,aAAqB;QACzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oBAAoB,EAAE,CAAA;QAClC,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;YAC/D,MAAM,IAAI,oBAAoB,EAAE,CAAA;QAClC,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC7F,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QACpF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,CAAC;QACD,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IACpE,CAAC;CAIF,CAAA;AA5F0B;IADxB,QAAQ,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC,CAAC;;6DACjD;AAGxB;IADxB,QAAQ,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;;8DACC;AAGxD;IADxB,QAAQ,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;;2DACF;AAKnD;IAHvB,QAAQ,CAAC,UAAuC,QAAQ;QACvD,OAAO,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC/D,CAAC,CAAC;;qDAC4C;AAgF/B;IADd,QAAQ,CAAC,qBAAqB,CAAC;8BACF,qBAAqB;4DAAA;AA7FxC,qBAAqB;IADjC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;GACzB,qBAAqB,CA8FjC"}
+{"version":3,"file":"password-authenticator.js","sourceRoot":"","sources":["../src/password-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAc,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AAE/E,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAErG,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AA+BpE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA8C,aAAa,CAAC;IAC5F,IAAI,EAAE,0CAA0C;IAChD,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAyB,EAAE;QAClE,MAAM,aAAa,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAClD,MAAM,eAAe,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACzD,MAAM,YAAY,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,wBAAwB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC,CAAA;QAChG,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QAEtD,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAAgB,EAAE,aAAqB,EAAgC,EAAE;YAC3G,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;YACjE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;YAC5D,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;YAClE,IAAI,MAAM,CAAC,OAAO,IAAI,aAAa,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;YACtD,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAA;QAED,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAE,aAAqB,EAAiB,EAAE;YACzF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;YAC5E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;YACpE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;QAC1D,CAAC,CAAA;QAED,MAAM,kBAAkB,GAAG,KAAK,EAAE,QAAgB,EAAE,YAAoB,EAAE,aAAqB,EAAiB,EAAE;YAChH,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;YACxF,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;YACrE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,oBAAoB,EAAE,CAAA;YAClC,CAAC;YACD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QAClD,CAAC,CAAA;QAED,MAAM,oBAAoB,GAAG,KAAK,EAAE,UAAkB,EAAE,aAAqB,EAAiB,EAAE;YAC9F,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;YAChE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,oBAAoB,EAAE,CAAA;YAClC,CAAC;YACD,IAAI,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,MAAM,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;gBACrD,MAAM,IAAI,oBAAoB,EAAE,CAAA;YAClC,CAAC;YACD,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;YACxF,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QACxD,CAAC,CAAA;QAED,OAAO;YACL,MAAM;YACN,aAAa;YACb,oBAAoB;YACpB,kBAAkB;YAClB,oBAAoB;SACrB,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}