@restingowlorg/owlauth 1.0.1

package/dist/services/magic-link.service.test.js

@@ -0,0 +1,230 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const magic_link_service_1 = require("./magic-link.service");
+describe("MagicLinkService", () => {
+    let service;
+    let mockUserRepo;
+    let mockMagicLinkRepo;
+    let mockCrypto;
+    let mockLogger;
+    beforeEach(() => {
+        mockUserRepo = {
+            findById: jest.fn(),
+            findByEmail: jest.fn(),
+            findByUsername: jest.fn(),
+            create: jest.fn(),
+            updatePassword: jest.fn()
+        };
+        mockMagicLinkRepo = {
+            create: jest.fn(),
+            findAll: jest.fn(),
+            findByTokenHash: jest.fn(),
+            findById: jest.fn(),
+            consume: jest.fn(),
+            invalidateByUserId: jest.fn(),
+            deleteByUserId: jest.fn()
+        };
+        mockCrypto = {
+            hashPassword: jest.fn(),
+            verifyPassword: jest.fn(),
+            generateToken: jest.fn(),
+            hashToken: jest.fn(),
+            verifyToken: jest.fn()
+        };
+        mockLogger = {
+            audit: jest.fn(),
+            info: jest.fn(),
+            warn: jest.fn(),
+            error: jest.fn()
+        };
+        service = new magic_link_service_1.MagicLinkService(mockUserRepo, mockMagicLinkRepo, mockCrypto, mockLogger);
+    });
+    describe("request", () => {
+        const email = "test@example.com";
+        it("should successfully request a magic link", async () => {
+            mockUserRepo.findByEmail.mockResolvedValue({ id: "1", email });
+            mockMagicLinkRepo.invalidateByUserId.mockResolvedValue(true);
+            mockCrypto.generateToken.mockReturnValue("raw_token");
+            mockCrypto.hashToken.mockResolvedValue("hashed_token");
+            mockMagicLinkRepo.create.mockResolvedValue({ id: "link1" });
+            const result = await service.request(email);
+            expect(result.success).toBe(true);
+            if (result.success && result.data) {
+                expect(result.data).toBe("link1.raw_token");
+            }
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockLogger.audit).toHaveBeenCalledWith(expect.objectContaining({ type: "MAGIC_LINK_REQUESTED" }));
+        });
+        it("should fail if user not found", async () => {
+            mockUserRepo.findByEmail.mockResolvedValue(null);
+            const result = await service.request(email);
+            expect(result.success).toBe(false);
+            expect(result.httpCode).toBe(404);
+        });
+        it("should fail if invalidation fails", async () => {
+            mockUserRepo.findByEmail.mockResolvedValue({ id: "1", email });
+            mockMagicLinkRepo.invalidateByUserId.mockResolvedValue(false);
+            const result = await service.request(email);
+            expect(result.success).toBe(false);
+            expect(result.httpCode).toBe(500);
+        });
+        it("should fail if creation fails", async () => {
+            mockUserRepo.findByEmail.mockResolvedValue({ id: "1", email });
+            mockMagicLinkRepo.invalidateByUserId.mockResolvedValue(true);
+            mockCrypto.generateToken.mockReturnValue("t");
+            mockCrypto.hashToken.mockResolvedValue("ht");
+            mockMagicLinkRepo.create.mockResolvedValue(null);
+            const result = await service.request(email);
+            expect(result.success).toBe(false);
+            expect(result.httpCode).toBe(500);
+        });
+        it("should propagate correlationId to auditLogger and error logs during request", async () => {
+            const correlationId = "magic-req-id";
+            mockUserRepo.findByEmail.mockResolvedValue({ id: "1", email });
+            mockMagicLinkRepo.invalidateByUserId.mockResolvedValue(true);
+            mockCrypto.generateToken.mockReturnValue("t");
+            mockCrypto.hashToken.mockResolvedValue("ht");
+            mockMagicLinkRepo.create.mockResolvedValue({ id: "l" });
+            // 1. Audit log on success
+            await service.request(email, { correlationId });
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockLogger.audit).toHaveBeenCalledWith(expect.objectContaining({ type: "MAGIC_LINK_REQUESTED", correlationId }));
+            // 2. Error log on exception
+            const error = new Error("DB Error");
+            mockUserRepo.findByEmail.mockRejectedValue(error);
+            await service.request(email, { correlationId });
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockLogger.error).toHaveBeenCalledWith("Magic link request exception", error, { email }, correlationId);
+        });
+    });
+    describe("verify", () => {
+        it("should successfully verify a token", async () => {
+            const token = "link1.raw_token";
+            mockMagicLinkRepo.findById.mockResolvedValue({
+                id: "link1",
+                userId: "1",
+                tokenHash: "hashed_token",
+                expiresAt: new Date(Date.now() + 3600000),
+                usedAt: null
+            });
+            mockCrypto.verifyToken.mockResolvedValue(true);
+            const result = await service.verify(token);
+            expect(result.success).toBe(true);
+            if (result.success && result.data) {
+                expect(result.data.userId).toBe("1");
+            }
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockLogger.audit).toHaveBeenCalledWith(expect.objectContaining({ type: "MAGIC_LINK_VERIFIED" }));
+        });
+        it("should fail if token is malformed", async () => {
+            const result = await service.verify("invalid_token");
+            expect(result.success).toBe(false);
+            expect(result.httpCode).toBe(400);
+        });
+        it("should fail if record not found", async () => {
+            mockMagicLinkRepo.findById.mockResolvedValue(null);
+            const result = await service.verify("link1.t");
+            expect(result.success).toBe(false);
+            expect(result.httpCode).toBe(401);
+        });
+        it("should fail if token expired", async () => {
+            mockMagicLinkRepo.findById.mockResolvedValue({
+                expiresAt: new Date(Date.now() - 1000),
+                usedAt: null
+            });
+            const result = await service.verify("link1.t");
+            expect(result.success).toBe(false);
+            expect(result.message).toContain("expired");
+        });
+        it("should fail if token already used", async () => {
+            mockMagicLinkRepo.findById.mockResolvedValue({
+                expiresAt: new Date(Date.now() + 1000),
+                usedAt: new Date()
+            });
+            const result = await service.verify("link1.t");
+            expect(result.success).toBe(false);
+            expect(result.message).toContain("expired"); // Service message is same for both
+        });
+        it("should propagate correlationId to auditLogger and error logs during verification", async () => {
+            const token = "link1.raw_token";
+            const correlationId = "magic-verify-id";
+            // 1. Audit log on failure
+            mockMagicLinkRepo.findById.mockResolvedValue(null);
+            await service.verify(token, { correlationId });
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockLogger.audit).toHaveBeenCalledWith(expect.objectContaining({ type: "MAGIC_LINK_FAILURE", correlationId }));
+            // 2. Error log on exception
+            const error = new Error("DB Error");
+            mockMagicLinkRepo.findById.mockRejectedValue(error);
+            await service.verify(token, { correlationId });
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockLogger.error).toHaveBeenCalledWith("Magic link verify exception", error, undefined, correlationId);
+        });
+    });
+    describe("consume", () => {
+        const token = "link1.raw_token";
+        it("should successfully consume a token", async () => {
+            mockMagicLinkRepo.findById.mockResolvedValue({
+                id: "link1",
+                userId: "123",
+                tokenHash: "ht",
+                expiresAt: new Date(Date.now() + 1000),
+                usedAt: null
+            });
+            mockCrypto.verifyToken.mockResolvedValue(true);
+            mockMagicLinkRepo.consume.mockResolvedValue(true);
+            const result = await service.consume(token);
+            expect(result.success).toBe(true);
+            if (result.success && result.data) {
+                expect(result.data.userId).toBe("123");
+            }
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockMagicLinkRepo.consume).toHaveBeenCalledWith("link1");
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockLogger.audit).toHaveBeenCalledWith(expect.objectContaining({ type: "MAGIC_LINK_CONSUMED" }));
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockLogger.audit).toHaveBeenCalledWith(expect.objectContaining({ type: "LOGIN_SUCCESS", metadata: { method: "magic-link" } }));
+        });
+        it("should fail if verification fails", async () => {
+            mockMagicLinkRepo.findById.mockResolvedValue(null);
+            const result = await service.consume(token);
+            expect(result.success).toBe(false);
+        });
+        it("should fail if consume fails", async () => {
+            mockMagicLinkRepo.findById.mockResolvedValue({
+                id: "link1",
+                userId: "123",
+                expiresAt: new Date(Date.now() + 1000),
+                usedAt: null
+            });
+            mockCrypto.verifyToken.mockResolvedValue(true);
+            mockMagicLinkRepo.consume.mockResolvedValue(false);
+            const result = await service.consume(token);
+            expect(result.success).toBe(false);
+            expect(result.httpCode).toBe(401);
+        });
+        it("should propagate correlationId to auditLogger and error logs during consumption", async () => {
+            const token = "link1.raw_token";
+            const correlationId = "magic-consume-id";
+            // 1. Audit log on failure
+            mockMagicLinkRepo.findById.mockResolvedValue(null);
+            await service.consume(token, { correlationId });
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockLogger.audit).toHaveBeenCalledWith(expect.objectContaining({ type: "MAGIC_LINK_FAILURE", correlationId }));
+            // 2. Error log on exception (test consume's own catch block)
+            mockMagicLinkRepo.findById.mockResolvedValue({
+                id: "link1",
+                userId: "123",
+                tokenHash: "ht",
+                expiresAt: new Date(Date.now() + 1000),
+                usedAt: null
+            });
+            mockCrypto.verifyToken.mockResolvedValue(true);
+            const error = new Error("DB Error on Consume");
+            mockMagicLinkRepo.consume.mockRejectedValue(error);
+            await service.consume(token, { correlationId });
+            // eslint-disable-next-line @typescript-eslint/unbound-method
+            expect(mockLogger.error).toHaveBeenCalledWith("Magic link consume exception", error, undefined, correlationId);
+        });
+    });
+});

package/dist/strategies/CredentialsStrategy.d.ts

@@ -0,0 +1,4 @@
+import { AuthDB, AuthOptions, AuthType, IAuthMethods, IAuthStrategy, Mutable } from "../types";
+export declare class CredentialsAuthStrategy implements IAuthStrategy {
+    register(target: Mutable<Partial<IAuthMethods>>, db: AuthDB, options: AuthOptions<AuthType>): void;
+}

package/dist/strategies/CredentialsStrategy.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialsAuthStrategy = void 0;
+const security_audit_logger_1 = require("../infra/security/security-audit-logger");
+const bcrypt_adapter_1 = require("../infra/security/bcrypt.adapter");
+const auth_service_1 = require("../services/auth.service");
+class CredentialsAuthStrategy {
+    register(target, db, options) {
+        const cryptoAdapter = options.cryptoAdapter || new bcrypt_adapter_1.BcryptAdapter();
+        const service = new auth_service_1.AuthService(db.userRepo, cryptoAdapter, security_audit_logger_1.auditLogger);
+        target.credentials = {
+            signup: (email, username, password, optionsOverride) => {
+                var _a, _b;
+                return service.signup(email, username, password, {
+                    blockedPasswords: (_a = optionsOverride === null || optionsOverride === void 0 ? void 0 : optionsOverride.blockedPasswords) !== null && _a !== void 0 ? _a : options.blockedPasswords,
+                    pwnedPasswordFailClosed: (_b = optionsOverride === null || optionsOverride === void 0 ? void 0 : optionsOverride.pwnedPasswordFailClosed) !== null && _b !== void 0 ? _b : options.pwnedPasswordFailClosed,
+                    correlationId: optionsOverride === null || optionsOverride === void 0 ? void 0 : optionsOverride.correlationId
+                });
+            },
+            login: (email, password, optionsOverride) => service.login(email, password, optionsOverride),
+            changePassword: (userId, currentPass, newPass, optionsOverride) => {
+                var _a, _b;
+                return service.changePassword(userId, currentPass, newPass, {
+                    blockedPasswords: (_a = optionsOverride === null || optionsOverride === void 0 ? void 0 : optionsOverride.blockedPasswords) !== null && _a !== void 0 ? _a : options.blockedPasswords,
+                    pwnedPasswordFailClosed: (_b = optionsOverride === null || optionsOverride === void 0 ? void 0 : optionsOverride.pwnedPasswordFailClosed) !== null && _b !== void 0 ? _b : options.pwnedPasswordFailClosed,
+                    correlationId: optionsOverride === null || optionsOverride === void 0 ? void 0 : optionsOverride.correlationId
+                });
+            }
+        };
+    }
+}
+exports.CredentialsAuthStrategy = CredentialsAuthStrategy;

package/dist/strategies/CredentialsStrategy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/strategies/CredentialsStrategy.test.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const CredentialsStrategy_1 = require("./CredentialsStrategy");
+describe("CredentialsAuthStrategy", () => {
+    let strategy;
+    let mockDb;
+    let mockOptions;
+    beforeEach(() => {
+        strategy = new CredentialsStrategy_1.CredentialsAuthStrategy();
+        mockDb = {
+            userRepo: {},
+            close: jest.fn()
+        };
+        mockOptions = {
+            adapter: {}
+        };
+    });
+    it("should register signup, login, and changePassword methods under target.credentials", () => {
+        const target = {};
+        strategy.register(target, mockDb, mockOptions);
+        expect(target.credentials).toBeDefined();
+        if (target.credentials) {
+            expect(target.credentials.signup).toBeDefined();
+            expect(target.credentials.login).toBeDefined();
+            expect(target.credentials.changePassword).toBeDefined();
+            expect(typeof target.credentials.signup).toBe("function");
+        }
+    });
+});

package/dist/strategies/MagicLinkStrategy.d.ts

@@ -0,0 +1,4 @@
+import { AuthDB, AuthOptions, AuthType, IAuthMethods, IAuthStrategy, Mutable } from "../types";
+export declare class MagicLinkAuthStrategy implements IAuthStrategy {
+    register(target: Mutable<Partial<IAuthMethods>>, db: AuthDB, options: AuthOptions<AuthType>): void;
+}

package/dist/strategies/MagicLinkStrategy.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MagicLinkAuthStrategy = void 0;
+const security_audit_logger_1 = require("../infra/security/security-audit-logger");
+const bcrypt_adapter_1 = require("../infra/security/bcrypt.adapter");
+const magic_link_service_1 = require("../services/magic-link.service");
+class MagicLinkAuthStrategy {
+    register(target, db, options) {
+        const cryptoAdapter = options.cryptoAdapter || new bcrypt_adapter_1.BcryptAdapter();
+        if (!db.magicLinkRepo) {
+            throw new Error("MagicLinkRepository is required for MagicLinkAuthStrategy");
+        }
+        const service = new magic_link_service_1.MagicLinkService(db.userRepo, db.magicLinkRepo, cryptoAdapter, security_audit_logger_1.auditLogger);
+        target.magicLink = {
+            request: (email, optionsOverride) => service.request(email, optionsOverride),
+            verify: (token, optionsOverride) => service.verify(token, optionsOverride),
+            consume: (token, optionsOverride) => service.consume(token, optionsOverride)
+        };
+    }
+}
+exports.MagicLinkAuthStrategy = MagicLinkAuthStrategy;

package/dist/strategies/MagicLinkStrategy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/strategies/MagicLinkStrategy.test.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const MagicLinkStrategy_1 = require("./MagicLinkStrategy");
+describe("MagicLinkAuthStrategy", () => {
+    let strategy;
+    let mockDb;
+    let mockOptions;
+    beforeEach(() => {
+        strategy = new MagicLinkStrategy_1.MagicLinkAuthStrategy();
+        mockDb = {
+            userRepo: {},
+            magicLinkRepo: {},
+            close: jest.fn()
+        };
+        mockOptions = {
+            adapter: {}
+        };
+    });
+    it("should register request, verify, and consume methods under target.magicLink", () => {
+        const target = {};
+        strategy.register(target, mockDb, mockOptions);
+        expect(target.magicLink).toBeDefined();
+        if (target.magicLink) {
+            expect(target.magicLink.request).toBeDefined();
+            expect(target.magicLink.verify).toBeDefined();
+            expect(target.magicLink.consume).toBeDefined();
+            expect(typeof target.magicLink.request).toBe("function");
+        }
+    });
+    it("should throw if magicLinkRepo is missing", () => {
+        const target = {};
+        const dbWithoutRepo = {
+            userRepo: {},
+            close: jest.fn()
+        };
+        expect(() => strategy.register(target, dbWithoutRepo, mockOptions)).toThrow("MagicLinkRepository is required for MagicLinkAuthStrategy");
+    });
+});

package/dist/types/index.d.ts

@@ -0,0 +1,224 @@
+import { UserRepository, MagicLinkRepository } from "../repositories/contracts";
+import { PostgresUserSchema } from "../infra/databases/postgresql/schema";
+import { ObjectId } from "mongodb";
+export type AuthType = "credentials" | "magicLink";
+export interface InitPostgresOptions {
+    postgresUrl: string;
+    userTableName: string;
+    userSchema?: string;
+    magicLinkTableName?: string;
+    magicLinkSchema?: string;
+}
+export type InitMongoOptions = {
+    mongoUri: string;
+    magicLinkCollectionName?: string;
+    userCollectionName: string;
+};
+export interface IDatabaseAdapter {
+    connect(options: BaseAuthOptions): Promise<AuthDB>;
+}
+export interface ICryptoAdapter {
+    hashPassword(password: string): Promise<string>;
+    verifyPassword(password: string, hash: string): Promise<boolean>;
+    generateToken(length?: number): string;
+    hashToken(token: string): Promise<string>;
+    verifyToken(token: string, hash: string): Promise<boolean>;
+}
+export type BaseAuthOptions<T extends AuthType = AuthType> = {
+    authTypes?: T[];
+    blockedPasswords?: string[];
+    magicLinkBaseUrl?: string;
+    cryptoAdapter?: ICryptoAdapter;
+    customMaskingKeys?: string[];
+    pwnedPasswordFailClosed?: boolean;
+};
+export type Mutable<T> = {
+    -readonly [P in keyof T]: T[P];
+};
+export interface IAuthStrategy {
+    register(target: Mutable<Partial<IAuthMethods>>, db: AuthDB, options: AuthOptions<AuthType>): void;
+}
+export type AuthResult<T = unknown> = {
+    success: true;
+    data: T;
+    httpCode: number;
+    message: string;
+} | {
+    success: false;
+    data?: undefined;
+    httpCode: number;
+    message: string;
+};
+export type AuthOptions<T extends AuthType = AuthType> = BaseAuthOptions<T> & {
+    adapter: IDatabaseAdapter;
+};
+export type AuthLogLevel = "info" | "warn" | "error";
+export type User = {
+    id: string;
+    email: string;
+    username: string;
+    password: string;
+};
+export type AuthUser = {
+    id: string;
+    email: string;
+    username?: string;
+};
+export type AuthRequest = Request & {
+    user?: AuthUser;
+};
+export type TableColumn = {
+    column_name: string;
+    is_nullable?: "YES" | "NO";
+    data_type?: string;
+};
+export type ColumnRow = {
+    column_name: string;
+};
+export type AuthDB = {
+    userRepo: UserRepository;
+    magicLinkRepo?: MagicLinkRepository;
+    close: () => Promise<void>;
+};
+export type SignupInput = {
+    email: string;
+    username: string;
+    password: string;
+};
+export type LoginInput = {
+    email: string;
+    password: string;
+};
+export type MagicLinkRow = {
+    id: number | string;
+    user_id: number | string;
+    token: string;
+    expires_at: Date;
+    used_at: Date | null;
+    created_at: Date;
+};
+export type MagicLinkToken = {
+    id: number | string;
+    userId: string | number;
+    tokenHash: string;
+    expiresAt: Date;
+    usedAt: Date | null;
+    createdAt: Date;
+};
+export type CreateMagicLinkInput = {
+    userId: string;
+    tokenHash: string;
+    expiresAt: Date;
+    usedAt?: Date;
+};
+export interface CreateUserInput {
+    email: string;
+    passwordHash: string;
+    username: string;
+}
+export interface ICredentialsMethods {
+    readonly signup: (email: string, username: string, password: string, options?: {
+        blockedPasswords?: string[];
+        pwnedPasswordFailClosed?: boolean;
+        correlationId?: string;
+    }) => Promise<AuthResult<SignupResult>>;
+    readonly login: (email: string, password: string, options?: {
+        correlationId?: string;
+    }) => Promise<AuthResult<LoginResult>>;
+    readonly changePassword: (userId: string | number, currentPassword: string, newPassword: string, options?: {
+        blockedPasswords?: string[];
+        pwnedPasswordFailClosed?: boolean;
+        correlationId?: string;
+    }) => Promise<AuthResult<ChangePasswordResult>>;
+}
+export interface IMagicLinkMethods {
+    readonly request: (email: string, options?: {
+        correlationId?: string;
+    }) => Promise<AuthResult<RequestMagicLinkResult>>;
+    readonly verify: (token: string, options?: {
+        correlationId?: string;
+    }) => Promise<AuthResult<VerifyMagicLinkResult>>;
+    readonly consume: (token: string, options?: {
+        correlationId?: string;
+    }) => Promise<AuthResult<ConsumeMagicLinkResult>>;
+}
+export interface IAuthMethods {
+    credentials: ICredentialsMethods;
+    magicLink: IMagicLinkMethods;
+}
+export type IAuthManager<T extends AuthType = AuthType> = {
+    [K in T]: IAuthMethods[K];
+} & {
+    readonly disconnectDB: () => Promise<void>;
+};
+export interface IMongoMagicLinkDoc {
+    _id?: ObjectId;
+    user_id: ObjectId;
+    token: string;
+    expires_at: Date;
+    used_at: Date | null;
+    created_at: Date;
+    updated_at: Date;
+}
+export interface IMongoUserDoc {
+    _id?: ObjectId;
+    email: string;
+    username: string;
+    password: string;
+    created_at?: Date;
+    updated_at?: Date;
+}
+export interface FKRow {
+    referenced_table: string;
+    referenced_column: string;
+}
+export interface TableExistsRow {
+    exists: boolean;
+}
+export interface ColumnInfoRow {
+    column_name: string;
+    is_nullable: "YES" | "NO";
+}
+export interface PrimaryKeyRow {
+    column_name: string;
+    data_type: string;
+}
+export type UserId = string | number;
+export type LoginResult = {
+    user: SafeUser;
+};
+export type SignupResult = {
+    user: SafeUser;
+};
+export type ChangePasswordResult = {
+    user: SafeUser;
+};
+export type RequestMagicLinkResult = string;
+export type VerifyMagicLinkResult = {
+    isValid: boolean;
+    userId: string;
+    tokenId: string;
+};
+export type ConsumeMagicLinkResult = {
+    userId: string;
+};
+export type SafeUser = {
+    id: string | number;
+    email: string;
+    username: string;
+};
+export type UserColumn = (typeof PostgresUserSchema.requiredColumns)[number];
+export type SecurityEventType = "LOGIN_SUCCESS" | "LOGIN_FAILURE" | "SIGNUP" | "SIGNUP_FAILURE" | "PASSWORD_CHANGE" | "MAGIC_LINK_REQUESTED" | "MAGIC_LINK_VERIFIED" | "MAGIC_LINK_CONSUMED" | "MAGIC_LINK_FAILURE";
+export type SecurityEvent = {
+    type: SecurityEventType;
+    userId?: string | number;
+    email?: string;
+    metadata?: Record<string, unknown>;
+    correlationId?: string;
+};
+export interface IAuditLogger {
+    info(message: string, context?: unknown, correlationId?: string): void;
+    warn(message: string, context?: unknown, correlationId?: string): void;
+    error(message: string, error: unknown, context?: unknown, correlationId?: string): void;
+    audit(event: SecurityEvent): void;
+}

package/dist/types/index.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/utils/check-blocked-passwords.d.ts

@@ -0,0 +1 @@
+export declare function containsBlockedPasswords(password: string, email: string, username: string, blockedList?: string[]): boolean;

package/dist/utils/check-blocked-passwords.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.containsBlockedPasswords = containsBlockedPasswords;
+function containsBlockedPasswords(password, email, username, blockedList = []) {
+    const pwd = password.toLowerCase();
+    const emailLocal = email.split("@")[0].toLowerCase();
+    const uname = username.toLowerCase();
+    const blockedTerms = [emailLocal, uname, ...blockedList.map((w) => w.toLowerCase())];
+    return blockedTerms.some((term) => term && pwd.includes(term));
+}

package/dist/utils/check-blocked-passwords.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/check-blocked-passwords.test.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const check_blocked_passwords_1 = require("./check-blocked-passwords");
+describe("containsBlockedPasswords", () => {
+    const email = "testuser@example.com";
+    const username = "testuser";
+    const blockedList = ["password", "123456", "admin"];
+    it("should return true if password contains the username", () => {
+        expect((0, check_blocked_passwords_1.containsBlockedPasswords)("mytestuser123", email, username)).toBe(true);
+    });
+    it("should return true if password contains the email local part", () => {
+        expect((0, check_blocked_passwords_1.containsBlockedPasswords)("testuser_secure", email, username)).toBe(true);
+    });
+    it("should return true if password contains a term from the blocked list", () => {
+        expect((0, check_blocked_passwords_1.containsBlockedPasswords)("i_love_password", email, username, blockedList)).toBe(true);
+    });
+    it("should return false if password is secure and independent", () => {
+        expect((0, check_blocked_passwords_1.containsBlockedPasswords)("Secure-Pwd-2024!", email, username, blockedList)).toBe(false);
+    });
+    it("should be case-insensitive", () => {
+        expect((0, check_blocked_passwords_1.containsBlockedPasswords)("TESTUSER", email, username)).toBe(true);
+        expect((0, check_blocked_passwords_1.containsBlockedPasswords)("ADMIN_LOGIN", email, username, blockedList)).toBe(true);
+    });
+    it("should handle empty blocked list", () => {
+        expect((0, check_blocked_passwords_1.containsBlockedPasswords)("admin", email, username, [])).toBe(false);
+    });
+});