@futdevpro/nts-dynamo 1.15.154 → 1.15.156

package/build/_modules/account-security/account-password.control-service.js

@@ -1,214 +1,214 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyNTS_AccountPassword_ControlService = void 0;
-const crypto_1 = require("crypto");
-const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
-const global_settings_const_1 = require("../../_collections/global-settings.const");
-const PASSWORD_HASH_VERSION = 'dyn-scrypt-v1';
-const DEFAULT_POLICY = {
-    minLength: 12,
-    maxLength: 128,
-    scryptCost: 16_384,
-    scryptBlockSize: 8,
-    scryptParallelization: 1,
-    derivedKeyLength: 32,
-    saltLength: 16,
-    commonPasswordSha256: [],
-};
-const MAX_VERIFY_COST = 131_072;
-const MAX_VERIFY_BLOCK_SIZE = 8;
-const MAX_VERIFY_PARALLELIZATION = 2;
-const MAX_VERIFY_KEY_LENGTH = 64;
-const MAX_PASSWORD_LENGTH = 1_024;
-const MAX_STORED_HASH_LENGTH = 1_024;
-/**
- * Standalone password capability using versioned Node scrypt hashes.
- * Passwords and derived bytes never enter errors, logs or result objects.
- */
-class DyNTS_AccountPassword_ControlService {
-    policy;
-    /** Creates a validated immutable policy snapshot. */
-    constructor(policy) {
-        this.policy = {
-            ...DEFAULT_POLICY,
-            ...policy,
-            commonPasswordSha256: [
-                ...(policy?.commonPasswordSha256 ?? DEFAULT_POLICY.commonPasswordSha256),
-            ],
-        };
-        this.validatePolicy();
-    }
-    /** Validates and hashes one password to a self-describing scrypt record. */
-    async hashPassword(password) {
-        this.validatePassword(password);
-        const salt = (0, crypto_1.randomBytes)(this.policy.saltLength);
-        const derivedKey = await this.deriveKey({
-            password: password,
-            salt: salt,
-            cost: this.policy.scryptCost,
-            blockSize: this.policy.scryptBlockSize,
-            parallelization: this.policy.scryptParallelization,
-            keyLength: this.policy.derivedKeyLength,
-        });
-        return [
-            PASSWORD_HASH_VERSION,
-            this.policy.scryptCost,
-            this.policy.scryptBlockSize,
-            this.policy.scryptParallelization,
-            salt.toString('base64url'),
-            derivedKey.toString('base64url'),
-        ].join('$');
-    }
-    /** Performs constant-time verification and reports whether the stored cost should be upgraded. */
-    async verifyPassword(password, storedHash) {
-        if (typeof password !== 'string' || Array.from(password).length > this.policy.maxLength) {
-            await this.runDummyDerivation('invalid-password-candidate');
-            return { isValid: false, needsRehash: false };
-        }
-        const parsed = this.parseHash(storedHash);
-        if (!parsed) {
-            await this.runDummyDerivation(password);
-            return { isValid: false, needsRehash: false };
-        }
-        let candidate;
-        try {
-            candidate = await this.deriveKey({
-                password: password,
-                salt: parsed.salt,
-                cost: parsed.cost,
-                blockSize: parsed.blockSize,
-                parallelization: parsed.parallelization,
-                keyLength: parsed.derivedKey.length,
-            });
-        }
-        catch {
-            await this.runDummyDerivation(password);
-            return { isValid: false, needsRehash: false };
-        }
-        const isValid = candidate.length === parsed.derivedKey.length
-            && (0, crypto_1.timingSafeEqual)(candidate, parsed.derivedKey);
-        return {
-            isValid: isValid,
-            needsRehash: isValid && (parsed.cost !== this.policy.scryptCost
-                || parsed.blockSize !== this.policy.scryptBlockSize
-                || parsed.parallelization !== this.policy.scryptParallelization
-                || parsed.derivedKey.length !== this.policy.derivedKeyLength
-                || parsed.salt.length !== this.policy.saltLength),
-        };
-    }
-    /** Rejects weak, oversized and configured common passwords without exposing their content. */
-    validatePassword(password) {
-        if (typeof password !== 'string') {
-            throw this.buildError('PASSWORD_POLICY_LENGTH', 'Password input must be a string.');
-        }
-        const passwordLength = Array.from(password).length;
-        if (passwordLength < this.policy.minLength || passwordLength > this.policy.maxLength) {
-            throw this.buildError('PASSWORD_POLICY_LENGTH', `Password length must be between ${this.policy.minLength} and ${this.policy.maxLength} characters.`);
-        }
-        const commonDigest = (0, crypto_1.createHash)('sha256')
-            .update(password.normalize('NFKC').toLocaleLowerCase('en-US'))
-            .digest('hex');
-        if (this.policy.commonPasswordSha256.includes(commonDigest)) {
-            throw this.buildError('PASSWORD_POLICY_COMMON', 'The password matches a configured common-password denylist entry.');
-        }
-    }
-    parseHash(storedHash) {
-        if (typeof storedHash !== 'string' || storedHash.length > MAX_STORED_HASH_LENGTH) {
-            return null;
-        }
-        const parts = storedHash.split('$');
-        if (parts.length !== 6 || parts[0] !== PASSWORD_HASH_VERSION) {
-            return null;
-        }
-        const cost = Number(parts[1]);
-        const blockSize = Number(parts[2]);
-        const parallelization = Number(parts[3]);
-        const salt = Buffer.from(parts[4], 'base64url');
-        const derivedKey = Buffer.from(parts[5], 'base64url');
-        if (!this.isPowerOfTwo(cost)
-            || cost < 2
-            || cost > MAX_VERIFY_COST
-            || !Number.isInteger(blockSize)
-            || blockSize < 1
-            || blockSize > MAX_VERIFY_BLOCK_SIZE
-            || !Number.isInteger(parallelization)
-            || parallelization < 1
-            || parallelization > MAX_VERIFY_PARALLELIZATION
-            || !salt.length
-            || !derivedKey.length
-            || derivedKey.length > MAX_VERIFY_KEY_LENGTH) {
-            return null;
-        }
-        return {
-            cost: cost,
-            blockSize: blockSize,
-            parallelization: parallelization,
-            salt: salt,
-            derivedKey: derivedKey,
-        };
-    }
-    async runDummyDerivation(password) {
-        await this.deriveKey({
-            password: password,
-            salt: Buffer.alloc(this.policy.saltLength),
-            cost: this.policy.scryptCost,
-            blockSize: this.policy.scryptBlockSize,
-            parallelization: this.policy.scryptParallelization,
-            keyLength: this.policy.derivedKeyLength,
-        });
-    }
-    deriveKey(set) {
-        return new Promise((resolve, reject) => {
-            const maxmem = Math.max(32 * 1024 * 1024, 256 * set.cost * set.blockSize);
-            (0, crypto_1.scrypt)(set.password, set.salt, set.keyLength, {
-                N: set.cost,
-                r: set.blockSize,
-                p: set.parallelization,
-                maxmem: maxmem,
-            }, (error, derivedKey) => {
-                if (error) {
-                    reject(error);
-                    return;
-                }
-                resolve(derivedKey);
-            });
-        });
-    }
-    validatePolicy() {
-        if (!Number.isInteger(this.policy.minLength)
-            || !Number.isInteger(this.policy.maxLength)
-            || this.policy.minLength < 8
-            || this.policy.maxLength < this.policy.minLength
-            || this.policy.maxLength > MAX_PASSWORD_LENGTH
-            || !this.isPowerOfTwo(this.policy.scryptCost)
-            || this.policy.scryptCost > MAX_VERIFY_COST
-            || !Number.isInteger(this.policy.scryptBlockSize)
-            || this.policy.scryptBlockSize < 1
-            || this.policy.scryptBlockSize > MAX_VERIFY_BLOCK_SIZE
-            || !Number.isInteger(this.policy.scryptParallelization)
-            || this.policy.scryptParallelization < 1
-            || this.policy.scryptParallelization > MAX_VERIFY_PARALLELIZATION
-            || !Number.isInteger(this.policy.derivedKeyLength)
-            || this.policy.derivedKeyLength < 16
-            || this.policy.derivedKeyLength > MAX_VERIFY_KEY_LENGTH
-            || !Number.isInteger(this.policy.saltLength)
-            || this.policy.saltLength < 16
-            || this.policy.saltLength > 64) {
-            throw this.buildError('PASSWORD_POLICY_INVALID', 'The password policy is outside supported safe bounds.');
-        }
-    }
-    isPowerOfTwo(value) {
-        return Number.isSafeInteger(value) && value > 0 && (value & (value - 1)) === 0;
-    }
-    buildError(errorCode, message) {
-        return new fsm_dynamo_1.DyFM_Error({
-            status: 400,
-            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|${errorCode}`,
-            message: message,
-            userMessage: 'The credential does not satisfy the account security policy.',
-            issuerService: this.constructor.name,
-        });
-    }
-}
-exports.DyNTS_AccountPassword_ControlService = DyNTS_AccountPassword_ControlService;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AccountPassword_ControlService = void 0;
+const crypto_1 = require("crypto");
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+const PASSWORD_HASH_VERSION = 'dyn-scrypt-v1';
+const DEFAULT_POLICY = {
+    minLength: 12,
+    maxLength: 128,
+    scryptCost: 16_384,
+    scryptBlockSize: 8,
+    scryptParallelization: 1,
+    derivedKeyLength: 32,
+    saltLength: 16,
+    commonPasswordSha256: [],
+};
+const MAX_VERIFY_COST = 131_072;
+const MAX_VERIFY_BLOCK_SIZE = 8;
+const MAX_VERIFY_PARALLELIZATION = 2;
+const MAX_VERIFY_KEY_LENGTH = 64;
+const MAX_PASSWORD_LENGTH = 1_024;
+const MAX_STORED_HASH_LENGTH = 1_024;
+/**
+ * Standalone password capability using versioned Node scrypt hashes.
+ * Passwords and derived bytes never enter errors, logs or result objects.
+ */
+class DyNTS_AccountPassword_ControlService {
+    policy;
+    /** Creates a validated immutable policy snapshot. */
+    constructor(policy) {
+        this.policy = {
+            ...DEFAULT_POLICY,
+            ...policy,
+            commonPasswordSha256: [
+                ...(policy?.commonPasswordSha256 ?? DEFAULT_POLICY.commonPasswordSha256),
+            ],
+        };
+        this.validatePolicy();
+    }
+    /** Validates and hashes one password to a self-describing scrypt record. */
+    async hashPassword(password) {
+        this.validatePassword(password);
+        const salt = (0, crypto_1.randomBytes)(this.policy.saltLength);
+        const derivedKey = await this.deriveKey({
+            password: password,
+            salt: salt,
+            cost: this.policy.scryptCost,
+            blockSize: this.policy.scryptBlockSize,
+            parallelization: this.policy.scryptParallelization,
+            keyLength: this.policy.derivedKeyLength,
+        });
+        return [
+            PASSWORD_HASH_VERSION,
+            this.policy.scryptCost,
+            this.policy.scryptBlockSize,
+            this.policy.scryptParallelization,
+            salt.toString('base64url'),
+            derivedKey.toString('base64url'),
+        ].join('$');
+    }
+    /** Performs constant-time verification and reports whether the stored cost should be upgraded. */
+    async verifyPassword(password, storedHash) {
+        if (typeof password !== 'string' || Array.from(password).length > this.policy.maxLength) {
+            await this.runDummyDerivation('invalid-password-candidate');
+            return { isValid: false, needsRehash: false };
+        }
+        const parsed = this.parseHash(storedHash);
+        if (!parsed) {
+            await this.runDummyDerivation(password);
+            return { isValid: false, needsRehash: false };
+        }
+        let candidate;
+        try {
+            candidate = await this.deriveKey({
+                password: password,
+                salt: parsed.salt,
+                cost: parsed.cost,
+                blockSize: parsed.blockSize,
+                parallelization: parsed.parallelization,
+                keyLength: parsed.derivedKey.length,
+            });
+        }
+        catch {
+            await this.runDummyDerivation(password);
+            return { isValid: false, needsRehash: false };
+        }
+        const isValid = candidate.length === parsed.derivedKey.length
+            && (0, crypto_1.timingSafeEqual)(candidate, parsed.derivedKey);
+        return {
+            isValid: isValid,
+            needsRehash: isValid && (parsed.cost !== this.policy.scryptCost
+                || parsed.blockSize !== this.policy.scryptBlockSize
+                || parsed.parallelization !== this.policy.scryptParallelization
+                || parsed.derivedKey.length !== this.policy.derivedKeyLength
+                || parsed.salt.length !== this.policy.saltLength),
+        };
+    }
+    /** Rejects weak, oversized and configured common passwords without exposing their content. */
+    validatePassword(password) {
+        if (typeof password !== 'string') {
+            throw this.buildError('PASSWORD_POLICY_LENGTH', 'Password input must be a string.');
+        }
+        const passwordLength = Array.from(password).length;
+        if (passwordLength < this.policy.minLength || passwordLength > this.policy.maxLength) {
+            throw this.buildError('PASSWORD_POLICY_LENGTH', `Password length must be between ${this.policy.minLength} and ${this.policy.maxLength} characters.`);
+        }
+        const commonDigest = (0, crypto_1.createHash)('sha256')
+            .update(password.normalize('NFKC').toLocaleLowerCase('en-US'))
+            .digest('hex');
+        if (this.policy.commonPasswordSha256.includes(commonDigest)) {
+            throw this.buildError('PASSWORD_POLICY_COMMON', 'The password matches a configured common-password denylist entry.');
+        }
+    }
+    parseHash(storedHash) {
+        if (typeof storedHash !== 'string' || storedHash.length > MAX_STORED_HASH_LENGTH) {
+            return null;
+        }
+        const parts = storedHash.split('$');
+        if (parts.length !== 6 || parts[0] !== PASSWORD_HASH_VERSION) {
+            return null;
+        }
+        const cost = Number(parts[1]);
+        const blockSize = Number(parts[2]);
+        const parallelization = Number(parts[3]);
+        const salt = Buffer.from(parts[4], 'base64url');
+        const derivedKey = Buffer.from(parts[5], 'base64url');
+        if (!this.isPowerOfTwo(cost)
+            || cost < 2
+            || cost > MAX_VERIFY_COST
+            || !Number.isInteger(blockSize)
+            || blockSize < 1
+            || blockSize > MAX_VERIFY_BLOCK_SIZE
+            || !Number.isInteger(parallelization)
+            || parallelization < 1
+            || parallelization > MAX_VERIFY_PARALLELIZATION
+            || !salt.length
+            || !derivedKey.length
+            || derivedKey.length > MAX_VERIFY_KEY_LENGTH) {
+            return null;
+        }
+        return {
+            cost: cost,
+            blockSize: blockSize,
+            parallelization: parallelization,
+            salt: salt,
+            derivedKey: derivedKey,
+        };
+    }
+    async runDummyDerivation(password) {
+        await this.deriveKey({
+            password: password,
+            salt: Buffer.alloc(this.policy.saltLength),
+            cost: this.policy.scryptCost,
+            blockSize: this.policy.scryptBlockSize,
+            parallelization: this.policy.scryptParallelization,
+            keyLength: this.policy.derivedKeyLength,
+        });
+    }
+    deriveKey(set) {
+        return new Promise((resolve, reject) => {
+            const maxmem = Math.max(32 * 1024 * 1024, 256 * set.cost * set.blockSize);
+            (0, crypto_1.scrypt)(set.password, set.salt, set.keyLength, {
+                N: set.cost,
+                r: set.blockSize,
+                p: set.parallelization,
+                maxmem: maxmem,
+            }, (error, derivedKey) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve(derivedKey);
+            });
+        });
+    }
+    validatePolicy() {
+        if (!Number.isInteger(this.policy.minLength)
+            || !Number.isInteger(this.policy.maxLength)
+            || this.policy.minLength < 8
+            || this.policy.maxLength < this.policy.minLength
+            || this.policy.maxLength > MAX_PASSWORD_LENGTH
+            || !this.isPowerOfTwo(this.policy.scryptCost)
+            || this.policy.scryptCost > MAX_VERIFY_COST
+            || !Number.isInteger(this.policy.scryptBlockSize)
+            || this.policy.scryptBlockSize < 1
+            || this.policy.scryptBlockSize > MAX_VERIFY_BLOCK_SIZE
+            || !Number.isInteger(this.policy.scryptParallelization)
+            || this.policy.scryptParallelization < 1
+            || this.policy.scryptParallelization > MAX_VERIFY_PARALLELIZATION
+            || !Number.isInteger(this.policy.derivedKeyLength)
+            || this.policy.derivedKeyLength < 16
+            || this.policy.derivedKeyLength > MAX_VERIFY_KEY_LENGTH
+            || !Number.isInteger(this.policy.saltLength)
+            || this.policy.saltLength < 16
+            || this.policy.saltLength > 64) {
+            throw this.buildError('PASSWORD_POLICY_INVALID', 'The password policy is outside supported safe bounds.');
+        }
+    }
+    isPowerOfTwo(value) {
+        return Number.isSafeInteger(value) && value > 0 && (value & (value - 1)) === 0;
+    }
+    buildError(errorCode, message) {
+        return new fsm_dynamo_1.DyFM_Error({
+            status: 400,
+            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|${errorCode}`,
+            message: message,
+            userMessage: 'The credential does not satisfy the account security policy.',
+            issuerService: this.constructor.name,
+        });
+    }
+}
+exports.DyNTS_AccountPassword_ControlService = DyNTS_AccountPassword_ControlService;
 //# sourceMappingURL=account-password.control-service.js.map

package/build/_modules/account-security/account-session.control-service.d.ts

@@ -1,39 +1,39 @@
-import { DyNTS_AccountSessionClaims_Interface } from './_models/account-session-claims.interface';
-import { DyNTS_AccountSessionContext_Interface } from './_models/account-session-context.interface';
-import { DyNTS_AccountSessionSettings_Interface } from './_models/account-session-settings.interface';
-import { DyNTS_AccountSessionTokenPair_Interface } from './_models/account-session-token-pair.interface';
-import { DyNTS_AccountSessionView_Interface } from './_models/account-session-view.interface';
-/**
- * Opaque, server-revocable account session families with one-time refresh rotation and replay detection.
- */
-export declare class DyNTS_AccountSession_ControlService {
-    private readonly adapter;
-    private readonly accessTtlMs;
-    private readonly refreshTtlMs;
-    private readonly tokenBytes;
-    private readonly maxRefreshRotations;
-    private readonly clock;
-    /** Creates a validated session service over an atomic persistence adapter. */
-    constructor(set: DyNTS_AccountSessionSettings_Interface);
-    /** Atomically persists a new session family before returning its raw credentials. */
-    issueSession(subjectId: string, authorizationVersion: number, context: DyNTS_AccountSessionContext_Interface): Promise<DyNTS_AccountSessionTokenPair_Interface>;
-    /** Resolves an opaque access token through the server-side active-session record. */
-    authenticateAccessToken(accessToken: string): Promise<DyNTS_AccountSessionClaims_Interface>;
-    /** Rotates a one-time refresh token; replay revokes the complete token family. */
-    rotateRefreshToken(refreshToken: string, context: DyNTS_AccountSessionContext_Interface): Promise<DyNTS_AccountSessionTokenPair_Interface>;
-    /** Revokes one server-side session. */
-    revokeSession(sessionId: string, reasonCode: string): Promise<void>;
-    /** Revokes every session belonging to one subject. */
-    revokeAllSubjectSessions(subjectId: string, reasonCode: string): Promise<void>;
-    /** Returns a user-safe session projection without token hashes. */
-    listSubjectSessions(subjectId: string): Promise<DyNTS_AccountSessionView_Interface[]>;
-    private createMaterial;
-    private toTokenPair;
-    private hashToken;
-    private validateSettings;
-    private validateContext;
-    private validateRevocation;
-    private isFutureDate;
-    private buildUnauthorized;
-}
+import { DyNTS_AccountSessionClaims_Interface } from './_models/account-session-claims.interface';
+import { DyNTS_AccountSessionContext_Interface } from './_models/account-session-context.interface';
+import { DyNTS_AccountSessionSettings_Interface } from './_models/account-session-settings.interface';
+import { DyNTS_AccountSessionTokenPair_Interface } from './_models/account-session-token-pair.interface';
+import { DyNTS_AccountSessionView_Interface } from './_models/account-session-view.interface';
+/**
+ * Opaque, server-revocable account session families with one-time refresh rotation and replay detection.
+ */
+export declare class DyNTS_AccountSession_ControlService {
+    private readonly adapter;
+    private readonly accessTtlMs;
+    private readonly refreshTtlMs;
+    private readonly tokenBytes;
+    private readonly maxRefreshRotations;
+    private readonly clock;
+    /** Creates a validated session service over an atomic persistence adapter. */
+    constructor(set: DyNTS_AccountSessionSettings_Interface);
+    /** Atomically persists a new session family before returning its raw credentials. */
+    issueSession(subjectId: string, authorizationVersion: number, context: DyNTS_AccountSessionContext_Interface): Promise<DyNTS_AccountSessionTokenPair_Interface>;
+    /** Resolves an opaque access token through the server-side active-session record. */
+    authenticateAccessToken(accessToken: string): Promise<DyNTS_AccountSessionClaims_Interface>;
+    /** Rotates a one-time refresh token; replay revokes the complete token family. */
+    rotateRefreshToken(refreshToken: string, context: DyNTS_AccountSessionContext_Interface): Promise<DyNTS_AccountSessionTokenPair_Interface>;
+    /** Revokes one server-side session. */
+    revokeSession(sessionId: string, reasonCode: string): Promise<void>;
+    /** Revokes every session belonging to one subject. */
+    revokeAllSubjectSessions(subjectId: string, reasonCode: string): Promise<void>;
+    /** Returns a user-safe session projection without token hashes. */
+    listSubjectSessions(subjectId: string): Promise<DyNTS_AccountSessionView_Interface[]>;
+    private createMaterial;
+    private toTokenPair;
+    private hashToken;
+    private validateSettings;
+    private validateContext;
+    private validateRevocation;
+    private isFutureDate;
+    private buildUnauthorized;
+}
 //# sourceMappingURL=account-session.control-service.d.ts.map