@ruiapp/rapid-core 0.3.5 → 0.3.6

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export * from "./utilities/accessControlUtility";
 export * from "./utilities/entityUtility";
 export * from "./utilities/jwtUtility";
 export * from "./utilities/timeUtility";
+export * from "./utilities/passwordUtility";
 export * from "./helpers/licenseHelper";
 export { mapDbRowToEntity } from "./dataAccess/entityMapper";
 export * as bootstrapApplicationConfig from "./bootstrapApplicationConfig";

package/dist/index.js

@@ -9,7 +9,7 @@ var qs = require('qs');
 var dayjs = require('dayjs');
 var jsonwebtoken = require('jsonwebtoken');
 var crypto = require('crypto');
-var bcrypt = require('bcrypt');
+var bcrypt = require('bcryptjs');
 var path = require('path');
 var fs = require('fs');
 var uuid = require('uuid');
@@ -4361,6 +4361,30 @@ async function generateJwtSecretKey() {
     return encode(exportedKey);
 }
 
+/**
+ * Generates password hash.
+ * @param password
+ * @param salt
+ * @returns
+ */
+async function generatePasswordHash(password, salt) {
+    if (!salt) {
+        salt = 10;
+    }
+    const passwordHash = await bcrypt__default["default"].hash(password, salt);
+    return passwordHash;
+}
+/**
+ * Validates the password against the hash.
+ * @param password
+ * @param passwordHash
+ * @returns
+ */
+async function validatePassword(password, passwordHash) {
+    const isMatch = await bcrypt__default["default"].compare(password, passwordHash);
+    return isMatch;
+}
+
 function validateLicense(server) {
     const licenseService = server.getService("licenseService");
     const license = licenseService.getLicense();
@@ -6047,12 +6071,11 @@ async function handler$e(plugin, ctx, options) {
     if (!user) {
         throw new Error("User not found.");
     }
-    const isMatch = await bcrypt__default["default"].compare(oldPassword, user.password);
+    const isMatch = await validatePassword(oldPassword, user.password);
     if (!isMatch) {
         throw new Error("旧密码错误。");
     }
-    const saltRounds = 10;
-    const passwordHash = await bcrypt__default["default"].hash(newPassword, saltRounds);
+    const passwordHash = await generatePasswordHash(newPassword);
     await userDataAccessor.updateById(user.id, {
         password: passwordHash,
     });
@@ -6086,7 +6109,10 @@ async function handler$d(plugin, ctx, options) {
     if (!user) {
         throw new Error("用户名或密码错误。");
     }
-    const isMatch = await bcrypt__default["default"].compare(password, user.password);
+    if (user.state !== "enabled") {
+        throw new Error("用户已被禁用，不允许登录。");
+    }
+    const isMatch = await validatePassword(password, user.password);
     if (!isMatch) {
         throw new Error("用户名或密码错误。");
     }
@@ -6186,8 +6212,7 @@ async function handler$a(plugin, ctx, options) {
     if (!user) {
         throw new Error("User not found.");
     }
-    const saltRounds = 10;
-    const passwordHash = await bcrypt__default["default"].hash(password, saltRounds);
+    const passwordHash = await generatePasswordHash(password);
     await userDataAccessor.updateById(user.id, {
         password: passwordHash,
     });
@@ -8316,6 +8341,7 @@ exports.bootstrapApplicationConfig = bootstrapApplicationConfig$1;
 exports.createJwt = createJwt;
 exports.decodeJwt = decodeJwt;
 exports.generateJwtSecretKey = generateJwtSecretKey;
+exports.generatePasswordHash = generatePasswordHash;
 exports.getEntityRelationTargetId = getEntityRelationTargetId;
 exports.getNowString = getNowString;
 exports.getNowStringWithTimezone = getNowStringWithTimezone;
@@ -8323,4 +8349,5 @@ exports.isAccessAllowed = isAccessAllowed;
 exports.mapDbRowToEntity = mapDbRowToEntity;
 exports.tryValidateLicense = tryValidateLicense;
 exports.validateLicense = validateLicense;
+exports.validatePassword = validatePassword;
 exports.verifyJwt = verifyJwt;

package/dist/utilities/passwordUtility.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generates password hash.
+ * @param password
+ * @param salt
+ * @returns
+ */
+export declare function generatePasswordHash(password: string, salt?: number | string): Promise<string>;
+/**
+ * Validates the password against the hash.
+ * @param password
+ * @param passwordHash
+ * @returns
+ */
+export declare function validatePassword(password: string, passwordHash: string): Promise<boolean>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ruiapp/rapid-core",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -19,7 +19,7 @@
     "typescript": "^4.8.4"
   },
   "dependencies": {
-    "bcrypt": "^5.1.1",
+    "bcryptjs": "^3.0.2",
     "cron": "^3.1.7",
     "dayjs": "^1.11.7",
     "jsonwebtoken": "^9.0.2",

package/src/index.ts

@@ -14,6 +14,7 @@ export * from "./utilities/accessControlUtility";
 export * from "./utilities/entityUtility";
 export * from "./utilities/jwtUtility";
 export * from "./utilities/timeUtility";
+export * from "./utilities/passwordUtility";
 
 export * from "./helpers/licenseHelper";
 

package/src/plugins/auth/actionHandlers/changePassword.ts

@@ -1,6 +1,6 @@
-import bcrypt from "bcrypt";
 import { ActionHandlerContext } from "~/core/actionHandler";
 import { RapidPlugin } from "~/core/server";
+import { generatePasswordHash, validatePassword } from "~/utilities/passwordUtility";
 
 export const code = "changePassword";
 
@@ -38,13 +38,12 @@ export async function handler(plugin: RapidPlugin, ctx: ActionHandlerContext, op
     throw new Error("User not found.");
   }
 
-  const isMatch = await bcrypt.compare(oldPassword, user.password);
+  const isMatch = await validatePassword(oldPassword, user.password);
   if (!isMatch) {
     throw new Error("旧密码错误。");
   }
 
-  const saltRounds = 10;
-  const passwordHash = await bcrypt.hash(newPassword, saltRounds);
+  const passwordHash = await generatePasswordHash(newPassword);
 
   await userDataAccessor.updateById(user.id, {
     password: passwordHash,

package/src/plugins/auth/actionHandlers/createSession.ts

@@ -1,9 +1,9 @@
-import bcrypt from "bcrypt";
 import { setCookie } from "~/deno-std/http/cookie";
 import { createJwt } from "~/utilities/jwtUtility";
 import { ActionHandlerContext } from "~/core/actionHandler";
 import { RapidPlugin } from "~/core/server";
 import { validateLicense } from "~/helpers/licenseHelper";
+import { validatePassword } from "~/utilities/passwordUtility";
 
 export interface UserAccessToken {
   sub: "userAccessToken";
@@ -37,7 +37,11 @@ export async function handler(plugin: RapidPlugin, ctx: ActionHandlerContext, op
     throw new Error("用户名或密码错误。");
   }
 
-  const isMatch = await bcrypt.compare(password, user.password);
+  if (user.state !== "enabled") {
+    throw new Error("用户已被禁用，不允许登录。");
+  }
+
+  const isMatch = await validatePassword(password, user.password);
   if (!isMatch) {
     throw new Error("用户名或密码错误。");
   }

package/src/plugins/auth/actionHandlers/resetPassword.ts

@@ -1,6 +1,6 @@
-import bcrypt from "bcrypt";
 import { ActionHandlerContext } from "~/core/actionHandler";
 import { RapidPlugin } from "~/core/server";
+import { generatePasswordHash } from "~/utilities/passwordUtility";
 
 export const code = "resetPassword";
 
@@ -27,8 +27,7 @@ export async function handler(plugin: RapidPlugin, ctx: ActionHandlerContext, op
     throw new Error("User not found.");
   }
 
-  const saltRounds = 10;
-  const passwordHash = await bcrypt.hash(password, saltRounds);
+  const passwordHash = await generatePasswordHash(password);
 
   await userDataAccessor.updateById(user.id, {
     password: passwordHash,

package/src/utilities/passwordUtility.ts

@@ -0,0 +1,26 @@
+import bcrypt from "bcryptjs";
+
+/**
+ * Generates password hash.
+ * @param password
+ * @param salt
+ * @returns
+ */
+export async function generatePasswordHash(password: string, salt?: number | string): Promise<string> {
+  if (!salt) {
+    salt = 10;
+  }
+  const passwordHash = await bcrypt.hash(password, salt);
+  return passwordHash;
+}
+
+/**
+ * Validates the password against the hash.
+ * @param password
+ * @param passwordHash
+ * @returns
+ */
+export async function validatePassword(password: string, passwordHash: string): Promise<boolean> {
+  const isMatch = await bcrypt.compare(password, passwordHash);
+  return isMatch;
+}