@riao/authn-password 1.1.0 → 2.0.0

package/CHANGELOG.md

@@ -1 +1 @@
-# authn-password - Changelog
+# authn-password - Changelog

package/LICENSE.md

@@ -1,20 +1,20 @@
-Copyright (c) 2022 authn-password and others
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+Copyright (c) 2022 authn-password and others
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,148 +1,148 @@
-# @riao/authn-password
-
-A TypeScript library that provides password-based authentication for the RIAO Identity and Access Management (IAM) framework. This driver implements secure password hashing and verification using bcrypt.
-
-## Features
-
-- **Secure Password Hashing**: Uses bcrypt for secure password hashing with configurable salt rounds
-- **Principal Management**: Create and manage user principals with associated passwords
-- **Authentication**: Authenticate users with login credentials and passwords
-- **Flexible Hash Implementation**: Supports custom hash implementations via the `Hash` interface
-- **Database Agnostic**: Works with any database supported by the RIAO DBAL (Database Abstraction Layer)
-- **TypeScript Support**: Full TypeScript support with type safety
-
-## Installation
-
-```bash
-npm install @riao/authn-password @riao/iam @riao/dbal
-npm install --save-dev @riao/cli
-```
-
-## Database Migrations
-
-This driver requires the IAM password table to be created in your database. You can use the provided migrations:
-
-```bash
-npx riao migration:create import-iam-tables
-```
-
-Then, add the `AuthenticationPasswordMigrations` to your migration runner:
-
-`database/main/migrations/1234567890-import-iam-tables.ts`
-```typescript
-import { AuthenticationPasswordMigrations } from 'authn-password';
-
-export default AuthenticationPasswordMigrations;
-```
-
-## Quick Start
-
-### Basic Usage
-
-```typescript
-import { PasswordAuthentication } from '@riao/authn-password';
-import { Principal } from '@riao/iam/auth';
-import { Database } from '@riao/dbal';
-
-// Define your user interface
-interface User extends Principal {
-  login: string;
-}
-
-// Create an authentication service class
-class UserAuthentication extends PasswordAuthentication<User> {}
-
-// Initialize with your database
-const db = new YourDatabase();
-await db.init();
-await db.connect();
-
-const authService = new UserAuthentication({ db });
-
-// Create a new user with a password
-const userId = await authService.createPrincipal({
-  login: 'john.doe',
-  type: 'user',
-  name: 'John Doe',
-  password: 'securePassword123',
-});
-
-// Change a password
-await authService.changePassword(userId, 'newPassword123');
-
-// Authenticate a user
-const user = await authService.authenticate({
-  login: 'john.doe',
-  password: 'newPassword123',
-});
-
-if (user) {
-  console.log(`Welcome ${user.name}!`);
-}
-else {
-  console.log('Authentication failed');
-}
-```
-
-## API Reference
-
-### PasswordAuthentication<TPrincipal>
-
-Abstract class that extends `Authentication<TPrincipal>` and adds password-based authentication.
-
-#### Constructor Options
-
-```typescript
-interface PasswordAuthenticationOptions extends AuthOptions {
-  hash?: Hash; // Optional custom hash implementation (defaults to bcrypt)
-}
-```
-
-#### Methods
-
-- **createPrincipal(principal)**: Creates a new principal with a hashed password
-  - Parameters: Principal data with `password` field
-  - Returns: Principal ID
-
-- **authenticate(credentials)**: Authenticates a user with login and password
-  - Parameters: Object with `login` and `password` fields
-  - Returns: Principal object if successful, null if authentication fails
-
-- **passwordsRepo**: Query repository for accessing password records directly
-
-### Password Record Schema
-
-Passwords are stored in the `iam_passwords` table:
-
-```typescript
-interface Password {
-  id?: string;
-  principal_id: string;      // Foreign key to principal
-  password_hash: string;      // Bcrypt hashed password
-  deactivate_timestamp?: string;
-  create_timestamp?: string;
-}
-```
-
-## Configuration
-
-### Custom Hash Implementation
-
-You can provide a custom hash implementation:
-
-```typescript
-import { Hash } from '@riao/iam/hash';
-
-class CustomHash extends Hash {
-  // Implement your custom hashing logic
-}
-
-const authService = new UserAuthentication({
-  db,
-  hash: new CustomHash(),
-});
-```
-
-## Contributing & Development
-
-See [contributing.md](docs/contributing/contributing.md) for information on how to develop or contribute to this project!
+# @riao/authn-password
+
+A TypeScript library that provides password-based authentication for the RIAO Identity and Access Management (IAM) framework. This driver implements secure password hashing and verification using bcrypt.
+
+## Features
+
+- **Secure Password Hashing**: Uses bcrypt for secure password hashing with configurable salt rounds
+- **Principal Management**: Create and manage user principals with associated passwords
+- **Authentication**: Authenticate users with login credentials and passwords
+- **Flexible Hash Implementation**: Supports custom hash implementations via the `Hash` interface
+- **Database Agnostic**: Works with any database supported by the RIAO DBAL (Database Abstraction Layer)
+- **TypeScript Support**: Full TypeScript support with type safety
+
+## Installation
+
+```bash
+npm install @riao/authn-password @riao/iam @riao/dbal
+npm install --save-dev @riao/cli
+```
+
+## Database Migrations
+
+This driver requires the IAM password table to be created in your database. You can use the provided migrations:
+
+```bash
+npx riao migration:create import-iam-tables
+```
+
+Then, add the `AuthenticationPasswordMigrations` to your migration runner:
+
+`database/main/migrations/1234567890-import-iam-tables.ts`
+```typescript
+import { AuthenticationPasswordMigrations } from 'authn-password';
+
+export default AuthenticationPasswordMigrations;
+```
+
+## Quick Start
+
+### Basic Usage
+
+```typescript
+import { PasswordAuthentication } from '@riao/authn-password';
+import { Principal } from '@riao/iam/auth';
+import { Database } from '@riao/dbal';
+
+// Define your user interface
+interface User extends Principal {
+  login: string;
+}
+
+// Create an authentication service class
+class UserAuthentication extends PasswordAuthentication<User> {}
+
+// Initialize with your database
+const db = new YourDatabase();
+await db.init();
+await db.connect();
+
+const authService = new UserAuthentication({ db });
+
+// Create a new user with a password
+const userId = await authService.createPrincipal({
+  login: 'john.doe',
+  type: 'user',
+  name: 'John Doe',
+  password: 'securePassword123',
+});
+
+// Change a password
+await authService.changePassword(userId, 'newPassword123');
+
+// Authenticate a user
+const user = await authService.authenticate({
+  login: 'john.doe',
+  password: 'newPassword123',
+});
+
+if (user) {
+  console.log(`Welcome ${user.name}!`);
+}
+else {
+  console.log('Authentication failed');
+}
+```
+
+## API Reference
+
+### PasswordAuthentication<TPrincipal>
+
+Abstract class that extends `Authentication<TPrincipal>` and adds password-based authentication.
+
+#### Constructor Options
+
+```typescript
+interface PasswordAuthenticationOptions extends AuthOptions {
+  hash?: Hash; // Optional custom hash implementation (defaults to bcrypt)
+}
+```
+
+#### Methods
+
+- **createPrincipal(principal)**: Creates a new principal with a hashed password
+  - Parameters: Principal data with `password` field
+  - Returns: Principal ID
+
+- **authenticate(credentials)**: Authenticates a user with login and password
+  - Parameters: Object with `login` and `password` fields
+  - Returns: Principal object if successful, null if authentication fails
+
+- **passwordsRepo**: Query repository for accessing password records directly
+
+### Password Record Schema
+
+Passwords are stored in the `iam_passwords` table:
+
+```typescript
+interface Password {
+  id?: string;
+  principal_id: string;      // Foreign key to principal
+  password_hash: string;      // Bcrypt hashed password
+  deactivate_timestamp?: string;
+  create_timestamp?: string;
+}
+```
+
+## Configuration
+
+### Custom Hash Implementation
+
+You can provide a custom hash implementation:
+
+```typescript
+import { Hash } from '@riao/crypto';
+
+class CustomHash extends Hash {
+  // Implement your custom hashing logic
+}
+
+const authService = new UserAuthentication({
+  db,
+  hash: new CustomHash(),
+});
+```
+
+## Contributing & Development
+
+See [contributing.md](docs/contributing/contributing.md) for information on how to develop or contribute to this project!

package/authentication-password.d.ts

@@ -1,15 +1,18 @@
 import { DatabaseRecordId, QueryRepository } from '@riao/dbal';
-import { Hash } from '@riao/iam/hash';
+import { Hash } from '@riao/crypto';
 import { Principal } from '@riao/iam/auth';
-import { Authentication } from '@riao/iam/authentication';
-import { AuthOptions } from '@riao/iam/auth/auth';
+import { Authentication, AuthenticationOptions } from '@riao/iam/authentication';
 import { Password } from './password';
-export interface PasswordAuthenticationOptions extends AuthOptions {
+export interface PasswordAuthenticationOptions extends AuthenticationOptions {
     hash?: Hash;
+    maxFailedAttempts?: number;
+    lockoutDurationMs?: number;
 }
 export declare abstract class PasswordAuthentication<TPrincipal extends Principal> extends Authentication<TPrincipal> {
     passwordsRepo: QueryRepository<Password>;
     protected hash: Hash;
+    protected readonly maxFailedAttempts: number;
+    protected readonly lockoutDurationMs: number;
     constructor(options: PasswordAuthenticationOptions);
     createPrincipal(principal: Omit<TPrincipal, 'id' | 'create_timestamp'> & {
         password: string;
@@ -18,6 +21,8 @@ export declare abstract class PasswordAuthentication<TPrincipal extends Principa
     authenticate(credentials: Partial<TPrincipal & {
         password: string;
     }>): Promise<TPrincipal | null>;
+    protected recordPasswordFailure(password: Password): Promise<void>;
+    protected resetPasswordFailures(passwordId: DatabaseRecordId): Promise<void>;
     protected revokePasswords(principalId: DatabaseRecordId): Promise<void>;
     protected insertPassword(principalId: DatabaseRecordId, hash: string): Promise<void>;
 }

package/authentication-password.js

@@ -1,14 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PasswordAuthentication = void 0;
-const hash_1 = require("@riao/iam/hash");
+const crypto_1 = require("@riao/crypto");
 const authentication_1 = require("@riao/iam/authentication");
 class PasswordAuthentication extends authentication_1.Authentication {
     passwordsRepo;
     hash;
+    maxFailedAttempts;
+    lockoutDurationMs;
     constructor(options) {
         super(options);
-        this.hash = options.hash ?? new hash_1.Hash();
+        this.hash = options.hash ?? new crypto_1.Hash();
+        this.maxFailedAttempts = Math.max(1, options.maxFailedAttempts ?? 5);
+        this.lockoutDurationMs = options.lockoutDurationMs ?? 15 * 60 * 1000;
         this.passwordsRepo = options.db.getQueryRepository({
             table: 'iam_passwords',
             identifiedBy: 'id',
@@ -22,13 +26,19 @@ class PasswordAuthentication extends authentication_1.Authentication {
         return principalId;
     }
     async changePassword(principalId, newPassword) {
-        // eslint-disable-next-line no-console
-        console.log('Changing password for principal ID:', principalId, newPassword);
         const hash = await this.hash.make(newPassword);
         await this.revokePasswords(principalId);
         await this.insertPassword(principalId, hash);
     }
     async authenticate(credentials) {
+        const attempt = {
+            scheme: 'password',
+            subject: String(credentials.login ?? ''),
+        };
+        const protection = await this.beforeAuthenticationAttempt(attempt);
+        if (!protection.allowed) {
+            return null;
+        }
         const principal = await this.findActivePrincipal({
             where: {
                 login: credentials.login,
@@ -44,8 +54,67 @@ class PasswordAuthentication extends authentication_1.Authentication {
         if (!passwordRecord) {
             return null;
         }
+        if (passwordRecord.locked_until &&
+            passwordRecord.locked_until <= new Date()) {
+            await this.passwordsRepo.update({
+                set: {
+                    failed_authentication_count: 0,
+                    locked_until: null,
+                },
+                where: { id: passwordRecord.id },
+            });
+        }
+        else if (passwordRecord.locked_until &&
+            passwordRecord.locked_until > new Date()) {
+            return null;
+        }
         const isValid = await this.hash.check(credentials.password, passwordRecord?.password_hash);
-        return isValid ? principal : null;
+        if (!isValid) {
+            await this.recordAuthenticationFailure(attempt);
+            await this.recordPasswordFailure(passwordRecord);
+            return null;
+        }
+        await this.recordAuthenticationSuccess(attempt);
+        await this.resetPasswordFailures(passwordRecord.id);
+        return principal;
+    }
+    async recordPasswordFailure(password) {
+        if (password.locked_until &&
+            password.locked_until <= new Date()) {
+            await this.passwordsRepo.update({
+                set: {
+                    failed_authentication_count: 0,
+                    locked_until: null,
+                },
+                where: { id: password.id },
+            });
+        }
+        await this.passwordsRepo.increment({
+            column: 'failed_authentication_count',
+            where: { id: password.id },
+        });
+        const updatedPassword = await this.passwordsRepo.findOne({
+            where: { id: password.id },
+        });
+        if (updatedPassword &&
+            (updatedPassword.failed_authentication_count ?? 0) >=
+                this.maxFailedAttempts) {
+            await this.passwordsRepo.update({
+                set: {
+                    locked_until: new Date(Date.now() + this.lockoutDurationMs),
+                },
+                where: { id: password.id },
+            });
+        }
+    }
+    async resetPasswordFailures(passwordId) {
+        await this.passwordsRepo.update({
+            set: {
+                failed_authentication_count: 0,
+                locked_until: null,
+            },
+            where: { id: passwordId },
+        });
     }
     async revokePasswords(principalId) {
         await this.passwordsRepo.update({
@@ -61,6 +130,8 @@ class PasswordAuthentication extends authentication_1.Authentication {
             record: {
                 principal_id: principalId,
                 password_hash: hash,
+                failed_authentication_count: 0,
+                locked_until: null,
             },
         });
     }

package/authentication-password.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication-password.js","sourceRoot":"","sources":["../../src/authentication-password.ts"],"names":[],"mappings":";;;AACA,yCAAsC;AAEtC,6DAA0D;AAQ1D,MAAsB,sBAEpB,SAAQ,+BAA0B;IAC5B,aAAa,CAA4B;IAEtC,IAAI,CAAO;IAErB,YAAmB,OAAsC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,WAAI,EAAE,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAW;YAC5D,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,IAAI;SAClB,CAAC,CAAC;IACJ,CAAC;IAEe,KAAK,CAAC,eAAe,CACpC,SAEC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAQ,SAAmC,CAAC,QAAQ,CAAC;QAErD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAE7C,OAAO,WAAW,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,cAAc,CAC1B,WAA6B,EAC7B,WAAmB;QAEnB,sCAAsC;QACtC,OAAO,CAAC,GAAG,CACV,qCAAqC,EACrC,WAAW,EACX,WAAW,CACX,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE/C,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,YAAY,CACxB,WAAuD;QAEvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC;YAChD,KAAK,EAAc;gBAClB,KAAK,EAAE,WAAW,CAAC,KAAK;aACxB;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;YACjE,OAAO,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC,WAAW,CAAC,QAAkB,EAC9B,cAAc,EAAE,aAAuB,CACvC,CAAC;QAEF,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAES,KAAK,CAAC,eAAe,CAC9B,WAA6B;QAE7B,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAC/B,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,IAAI,EAAE,EAAE;YACzC,KAAK,EAAE;gBACN,YAAY,EAAE,WAAqB;gBACnC,oBAAoB,EAAE,IAAI;aAC1B;SACD,CAAC,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,cAAc,CAC7B,WAA6B,EAC7B,IAAY;QAEZ,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE;gBACP,YAAY,EAAE,WAAqB;gBACnC,aAAa,EAAE,IAAI;aACnB;SACD,CAAC,CAAC;IACJ,CAAC;CACD;AAnGD,wDAmGC"}
+{"version":3,"file":"authentication-password.js","sourceRoot":"","sources":["../../src/authentication-password.ts"],"names":[],"mappings":";;;AACA,yCAAoC;AAEpC,6DAIkC;AASlC,MAAsB,sBAEpB,SAAQ,+BAA0B;IAC5B,aAAa,CAA4B;IAEtC,IAAI,CAAO;IACF,iBAAiB,CAAS;IAC1B,iBAAiB,CAAS;IAE7C,YAAmB,OAAsC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,aAAI,EAAE,CAAC;QACvC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAChC,CAAC,EACD,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAC9B,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAW;YAC5D,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,IAAI;SAClB,CAAC,CAAC;IACJ,CAAC;IAEe,KAAK,CAAC,eAAe,CACpC,SAEC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAQ,SAAmC,CAAC,QAAQ,CAAC;QAErD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAE7C,OAAO,WAAW,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,cAAc,CAC1B,WAA6B,EAC7B,WAAmB;QAEnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE/C,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,YAAY,CACxB,WAAuD;QAEvD,MAAM,OAAO,GAA0B;YACtC,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;SACxC,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC;YAChD,KAAK,EAAc;gBAClB,KAAK,EAAE,WAAW,CAAC,KAAK;aACxB;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;YACjE,OAAO,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IACC,cAAc,CAAC,YAAY;YAC3B,cAAc,CAAC,YAAY,IAAI,IAAI,IAAI,EAAE,EACxC,CAAC;YACF,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;gBAC/B,GAAG,EAAE;oBACJ,2BAA2B,EAAE,CAAC;oBAC9B,YAAY,EAAE,IAAI;iBAClB;gBACD,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE;aAChC,CAAC,CAAC;QACJ,CAAC;aACI,IACJ,cAAc,CAAC,YAAY;YAC3B,cAAc,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,EACvC,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC,WAAW,CAAC,QAAkB,EAC9B,cAAc,EAAE,aAAuB,CACvC,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IAClB,CAAC;IAES,KAAK,CAAC,qBAAqB,CAAC,QAAkB;QACvD,IACC,QAAQ,CAAC,YAAY;YACrB,QAAQ,CAAC,YAAY,IAAI,IAAI,IAAI,EAAE,EAClC,CAAC;YACF,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;gBAC/B,GAAG,EAAE;oBACJ,2BAA2B,EAAE,CAAC;oBAC9B,YAAY,EAAE,IAAI;iBAClB;gBACD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;aAC1B,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,6BAA6B;YACrC,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;SAC1B,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;SAC1B,CAAC,CAAC;QACH,IACC,eAAe;YACf,CAAC,eAAe,CAAC,2BAA2B,IAAI,CAAC,CAAC;gBACjD,IAAI,CAAC,iBAAiB,EACtB,CAAC;YACF,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;gBAC/B,GAAG,EAAE;oBACJ,YAAY,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC;iBAC3D;gBACD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;aAC1B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAES,KAAK,CAAC,qBAAqB,CACpC,UAA4B;QAE5B,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAC/B,GAAG,EAAE;gBACJ,2BAA2B,EAAE,CAAC;gBAC9B,YAAY,EAAE,IAAI;aAClB;YACD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAoB,EAAE;SACnC,CAAC,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,eAAe,CAC9B,WAA6B;QAE7B,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAC/B,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,IAAI,EAAE,EAAE;YACzC,KAAK,EAAE;gBACN,YAAY,EAAE,WAAqB;gBACnC,oBAAoB,EAAE,IAAI;aAC1B;SACD,CAAC,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,cAAc,CAC7B,WAA6B,EAC7B,IAAY;QAEZ,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE;gBACP,YAAY,EAAE,WAAqB;gBACnC,aAAa,EAAE,IAAI;gBACnB,2BAA2B,EAAE,CAAC;gBAC9B,YAAY,EAAE,IAAI;aAClB;SACD,CAAC,CAAC;IACJ,CAAC;CACD;AA1LD,wDA0LC"}

package/migrations/001-create-passwords-table.js

@@ -25,6 +25,17 @@ class CreatePasswordsTable extends dbal_1.Migration {
                     type: dbal_1.ColumnType.TIMESTAMP,
                     required: false,
                 },
+                {
+                    name: 'failed_authentication_count',
+                    type: dbal_1.ColumnType.INT,
+                    required: true,
+                    default: 0,
+                },
+                {
+                    name: 'locked_until',
+                    type: dbal_1.ColumnType.TIMESTAMP,
+                    required: false,
+                },
             ],
         });
     }

package/migrations/001-create-passwords-table.js.map

@@ -1 +1 @@
-{"version":3,"file":"001-create-passwords-table.js","sourceRoot":"","sources":["../../../src/migrations/001-create-passwords-table.ts"],"names":[],"mappings":";;;AAAA,wDAIgC;AAChC,qCAAmD;AAEnD,MAAa,oBAAqB,SAAQ,gBAAS;IACzC,KAAK,CAAC,EAAE;QAChB,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YAC1B,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE;gBACR,2BAAa;gBACb;oBACC,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,iBAAU,CAAC,IAAI;oBACrB,EAAE,EAAE;wBACH,eAAe,EAAE,gBAAgB;wBACjC,gBAAgB,EAAE,IAAI;wBACtB,QAAQ,EAAE,SAAS;qBACnB;iBACD;gBACD,EAAE,GAAG,4BAAc,EAAE,IAAI,EAAE,eAAe,EAAE;gBAC5C,mCAAqB;gBACrB;oBACC,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,iBAAU,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK;iBACf;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QAClB,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,eAAe;SACvB,CAAC,CAAC;IACJ,CAAC;CACD;AA/BD,oDA+BC"}
+{"version":3,"file":"001-create-passwords-table.js","sourceRoot":"","sources":["../../../src/migrations/001-create-passwords-table.ts"],"names":[],"mappings":";;;AAAA,wDAIgC;AAChC,qCAAmD;AAEnD,MAAa,oBAAqB,SAAQ,gBAAS;IACzC,KAAK,CAAC,EAAE;QAChB,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YAC1B,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE;gBACR,2BAAa;gBACb;oBACC,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,iBAAU,CAAC,IAAI;oBACrB,EAAE,EAAE;wBACH,eAAe,EAAE,gBAAgB;wBACjC,gBAAgB,EAAE,IAAI;wBACtB,QAAQ,EAAE,SAAS;qBACnB;iBACD;gBACD,EAAE,GAAG,4BAAc,EAAE,IAAI,EAAE,eAAe,EAAE;gBAC5C,mCAAqB;gBACrB;oBACC,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,iBAAU,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK;iBACf;gBACD;oBACC,IAAI,EAAE,6BAA6B;oBACnC,IAAI,EAAE,iBAAU,CAAC,GAAG;oBACpB,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,CAAC;iBACV;gBACD;oBACC,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,iBAAU,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK;iBACf;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QAClB,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,eAAe;SACvB,CAAC,CAAC;IACJ,CAAC;CACD;AA1CD,oDA0CC"}

package/migrations/002-add-password-authentication-protection.d.ts

@@ -0,0 +1,5 @@
+import { Migration } from '@riao/dbal';
+export declare class AddPasswordAuthenticationProtection extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}

package/migrations/002-add-password-authentication-protection.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddPasswordAuthenticationProtection = void 0;
+const dbal_1 = require("@riao/dbal");
+class AddPasswordAuthenticationProtection extends dbal_1.Migration {
+    async up() {
+        await this.ddl.addColumns({
+            table: 'iam_passwords',
+            columns: [
+                {
+                    name: 'failed_authentication_count',
+                    type: dbal_1.ColumnType.INT,
+                    required: true,
+                    default: 0,
+                },
+            ],
+        });
+        await this.ddl.addColumns({
+            table: 'iam_passwords',
+            columns: [
+                {
+                    name: 'locked_until',
+                    type: dbal_1.ColumnType.TIMESTAMP,
+                    required: false,
+                },
+            ],
+        });
+    }
+    async down() {
+        await this.ddl.dropColumn({
+            table: 'iam_passwords',
+            column: 'locked_until',
+        });
+        await this.ddl.dropColumn({
+            table: 'iam_passwords',
+            column: 'failed_authentication_count',
+        });
+    }
+}
+exports.AddPasswordAuthenticationProtection = AddPasswordAuthenticationProtection;
+//# sourceMappingURL=002-add-password-authentication-protection.js.map

package/migrations/002-add-password-authentication-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"002-add-password-authentication-protection.js","sourceRoot":"","sources":["../../../src/migrations/002-add-password-authentication-protection.ts"],"names":[],"mappings":";;;AAAA,qCAAmD;AAEnD,MAAa,mCAAoC,SAAQ,gBAAS;IACxD,KAAK,CAAC,EAAE;QAChB,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACzB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,6BAA6B;oBACnC,IAAI,EAAE,iBAAU,CAAC,GAAG;oBACpB,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,CAAC;iBACV;aACD;SACD,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACzB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,iBAAU,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK;iBACf;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QAClB,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACzB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,cAAc;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACzB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,6BAA6B;SACrC,CAAC,CAAC;IACJ,CAAC;CACD;AAnCD,kFAmCC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@riao/authn-password",
-	"version": "1.1.0",
+	"version": "2.0.0",
 	"description": "Password driver for Riao",
 	"typescript-template": {
 		"base": "1.0.1",
@@ -9,8 +9,9 @@
 	},
 	"scripts": {},
 	"dependencies": {
-		"@riao/dbal": "^3.8.0",
-		"@riao/iam": "^3.0.0",
+		"@riao/crypto": "^1.1.1",
+		"@riao/dbal": "^3.12.0",
+		"@riao/iam": "^4.0.0",
 		"bcrypt": "^6.0.0"
 	},
 	"repository": {

package/password.d.ts

@@ -4,4 +4,6 @@ export interface Password {
     password_hash: string;
     create_timestamp: Date;
     deactivate_timestamp?: Date | null;
+    failed_authentication_count?: number;
+    locked_until?: Date | null;
 }