@remit/auth-service 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/auth-service",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "better-auth identity service for the self-host stack",
   "type": "module",
   "main": "src/index.ts",
@@ -45,7 +45,8 @@
     "@types/better-sqlite3": "^7.6.13",
     "@remit/data-ports": "*",
     "@remit/drizzle-sqlite-schema": "*",
-    "@remit/api-openapi-types": "*"
+    "@remit/api-openapi-types": "*",
+    "@remit/domain-enums": "*"
   },
   "license": "MIT",
   "publishConfig": {

package/src/auth.ts

@@ -74,6 +74,10 @@ export const ACCOUNT_DISABLED = {
 
 const RESET_TOKEN_TTL_SECONDS = 24 * 60 * 60;
 
+const MIN_PASSWORD_LENGTH = 12;
+
+const MAX_PASSWORD_LENGTH = 128;
+
 const UNKNOWN = "unknown";
 
 const clientIpOf = (ctx: GenericEndpointContext | null): string =>
@@ -180,6 +184,8 @@ export const createAuth = async (
 			enabled: true,
 			autoSignIn: true,
 			disableSignUp: !config.selfSignUpEnabled,
+			minPasswordLength: MIN_PASSWORD_LENGTH,
+			maxPasswordLength: MAX_PASSWORD_LENGTH,
 			resetPasswordTokenExpiresIn: RESET_TOKEN_TTL_SECONDS,
 			revokeSessionsOnPasswordReset: true,
 			onPasswordReset: async ({ user }, request) => {

package/src/people.ts

@@ -5,6 +5,7 @@ import type {
 	StepUpAction,
 } from "@remit/api-openapi-types";
 import { deriveAccountConfigId } from "@remit/data-ports/id";
+import { PeopleErrorCode } from "@remit/domain-enums";
 import { calendarFeedTokens } from "@remit/drizzle-sqlite-schema";
 import { and, asc, count, eq, gt, lte, sql } from "drizzle-orm";
 import type { Auth } from "./auth.js";
@@ -38,13 +39,10 @@ export interface PasswordReset {
 	expiresAt: number;
 }
 
-export type PeopleRefusal =
-	| "caller_disabled"
-	| "not_found"
-	| "step_up_required"
-	| "wrong_password"
-	| "step_up_locked"
-	| "cannot_disable_self";
+export type PeopleErrorCodeValue =
+	(typeof PeopleErrorCode)[keyof typeof PeopleErrorCode];
+
+export type PeopleRefusal = PeopleErrorCodeValue | "not_found";
 
 export interface Refused {
 	ok: false;
@@ -190,7 +188,7 @@ const callerRefusal = (
 		outcome: "RefusedCallerDisabled",
 		clientIp: request.clientIp,
 	});
-	return refused("caller_disabled");
+	return refused(PeopleErrorCode.CallerDisabled);
 };
 
 const stepUpRefusal = (
@@ -218,7 +216,7 @@ const stepUpRefusal = (
 		outcome: "RefusedStepUp",
 		clientIp: request.clientIp,
 	});
-	return refused("step_up_required");
+	return refused(PeopleErrorCode.StepUpRequired);
 };
 
 const issueReset = (
@@ -327,7 +325,8 @@ export const createPeopleDirectory = async (
 						),
 					)
 					.get()?.failures ?? 0;
-			if (failures >= STEP_UP_MAX_FAILURES) return refused("step_up_locked");
+			if (failures >= STEP_UP_MAX_FAILURES)
+				return refused(PeopleErrorCode.StepUpLocked);
 			return ok(
 				store.audit({
 					actor: request.callerId,
@@ -399,7 +398,7 @@ export const createPeopleDirectory = async (
 			const attempt = reserveAttempt(request);
 			if (!attempt.ok) return attempt;
 			if (!(await passwordMatches(request.callerId, request.password))) {
-				return refused("wrong_password");
+				return refused(PeopleErrorCode.WrongPassword);
 			}
 			return grantStepUp(request, attempt.value);
 		},
@@ -435,7 +434,7 @@ export const createPeopleDirectory = async (
 						outcome: "RefusedSelf",
 						clientIp: request.clientIp,
 					});
-					return refused("cannot_disable_self");
+					return refused(PeopleErrorCode.CannotDisableSelf);
 				}
 				const stepUpRefused = stepUpRefusal(
 					store,

package/src/signup.test.ts

@@ -60,4 +60,28 @@ describe("createAuth self-signup gate", () => {
 		const body = (await response.json()) as { code?: string };
 		assert.equal(body.code, "EMAIL_PASSWORD_SIGN_UP_DISABLED");
 	});
+
+	it("refuses an 11-character password", async () => {
+		const auth = await createAuth(
+			{ ...baseConfig, selfSignUpEnabled: true, signInEnabled: true },
+			await openIdentityStore(baseConfig.connectionString),
+		);
+		const request = new Request(
+			"http://localhost:3000/api/auth/sign-up/email",
+			{
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					email: "short@example.com",
+					password: "elevenchars",
+					name: "Short",
+				}),
+			},
+		);
+
+		const response = await auth.handler(request);
+
+		const body = (await response.json()) as { code?: string };
+		assert.equal(body.code, "PASSWORD_TOO_SHORT");
+	});
 });