@steedos/accounts 3.0.13-beta.9 → 3.0.13

package/lib/password/accounts-password.js

@@ -1,17 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-var tslib_1 = require("tslib");
-var lodash_1 = require("lodash");
-var server_1 = require("../server");
-var utils_1 = require("./utils");
-var errors_1 = require("./errors");
-var objectql_1 = require("@steedos/objectql");
-var EFFECTIVE_TIME = 10;
-var CODE_LENGTH = 6;
-var MAX_FAILURE_COUNT = 10;
-var _ = require("underscore");
-var moment = require("moment");
-var defaultOptions = {
+const lodash_1 = require("lodash");
+const server_1 = require("../server");
+const utils_1 = require("./utils");
+const errors_1 = require("./errors");
+const objectql_1 = require("@steedos/objectql");
+const EFFECTIVE_TIME = 10;
+const CODE_LENGTH = 6;
+const MAX_FAILURE_COUNT = 10;
+const _ = require("underscore");
+const moment = require("moment");
+const defaultOptions = {
     verifyEmailTokenExpiration: 259200000,
     passwordResetTokenExpiration: 259200000,
     passwordEnrollTokenExpiration: 2592000000,
@@ -19,24 +18,24 @@ var defaultOptions = {
     returnTokensAfterResetPassword: false,
     invalidateAllSessionsAfterPasswordReset: true,
     invalidateAllSessionsAfterPasswordChanged: false,
-    validateEmail: function (email) {
+    validateEmail(email) {
         return !(0, lodash_1.isEmpty)((0, lodash_1.trim)(email)) && (0, utils_1.isEmail)(email);
     },
-    validatePassword: function (password) {
+    validatePassword(password) {
         return !(0, lodash_1.isEmpty)(password);
     },
-    validateUsername: function (username) {
-        var usernameRegex = /^[a-zA-Z][a-zA-Z0-9]*$/;
-        var isValid = username && !(0, lodash_1.isEmpty)((0, lodash_1.trim)(username)) && usernameRegex.test(username);
+    validateUsername(username) {
+        const usernameRegex = /^[a-zA-Z][a-zA-Z0-9]*$/;
+        const isValid = username && !(0, lodash_1.isEmpty)((0, lodash_1.trim)(username)) && usernameRegex.test(username);
         return Boolean(isValid);
     },
     errors: errors_1.errors,
     sendVerificationEmailAfterSignup: false,
 };
-var getPathFragmentPrefix = function () {
-    var config = (0, objectql_1.getSteedosConfig)().email;
-    var defaultPathPrefix = "accounts/a/#";
-    var pathFragmentPrefix = config && config.pathFragmentPrefix
+const getPathFragmentPrefix = function () {
+    const config = (0, objectql_1.getSteedosConfig)().email;
+    const defaultPathPrefix = "accounts/a/#";
+    let pathFragmentPrefix = config && config.pathFragmentPrefix
         ? config.pathFragmentPrefix
         : defaultPathPrefix;
     if (pathFragmentPrefix && !/\/$/.test(pathFragmentPrefix)) {
@@ -44,732 +43,492 @@ var getPathFragmentPrefix = function () {
     }
     return pathFragmentPrefix;
 };
-var AccountsPassword = (function () {
-    function AccountsPassword(options) {
-        if (options === void 0) { options = {}; }
-        this.serviceName = "password";
-        this.options = tslib_1.__assign(tslib_1.__assign({}, defaultOptions), options);
+class AccountsPassword {
+    serviceName = "password";
+    server;
+    options;
+    db;
+    constructor(options = {}) {
+        this.options = { ...defaultOptions, ...options };
     }
-    AccountsPassword.prototype.setStore = function (store) {
+    setStore(store) {
         this.db = store;
-    };
-    AccountsPassword.prototype.authenticate = function (params) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var user, password, token, locale, passwordUnencrypted, isHashPassword, foundUser;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        user = params.user, password = params.password, token = params.token, locale = params.locale;
-                        passwordUnencrypted = params["password-unencrypted"];
-                        isHashPassword = true;
-                        if (passwordUnencrypted && !password) {
-                            password = passwordUnencrypted;
-                            isHashPassword = false;
-                        }
-                        if (!(user && token)) return [3, 2];
-                        return [4, this.codeAuthenticator(user, token, locale)];
-                    case 1: return [2, _a.sent()];
-                    case 2:
-                        if (!user || !password) {
-                            throw new Error(this.options.errors.unrecognizedOptionsForLogin);
-                        }
-                        if ((!(0, lodash_1.isString)(user) && !(0, lodash_1.isPlainObject)(user)) || !(0, lodash_1.isString)(password)) {
-                            throw new Error(this.options.errors.matchFailed);
-                        }
-                        return [4, this.passwordAuthenticator(user, password, isHashPassword)];
-                    case 3:
-                        foundUser = _a.sent();
-                        return [2, foundUser];
-                }
-            });
-        });
-    };
-    AccountsPassword.prototype.findUserByEmail = function (email) {
+    }
+    async authenticate(params) {
+        let { user, password, token, locale } = params;
+        const passwordUnencrypted = params["password-unencrypted"];
+        let isHashPassword = true;
+        if (passwordUnencrypted && !password) {
+            password = passwordUnencrypted;
+            isHashPassword = false;
+        }
+        if (user && token) {
+            return await this.codeAuthenticator(user, token, locale);
+        }
+        if (!user || !password) {
+            throw new Error(this.options.errors.unrecognizedOptionsForLogin);
+        }
+        if ((!(0, lodash_1.isString)(user) && !(0, lodash_1.isPlainObject)(user)) || !(0, lodash_1.isString)(password)) {
+            throw new Error(this.options.errors.matchFailed);
+        }
+        const foundUser = await this.passwordAuthenticator(user, password, isHashPassword);
+        return foundUser;
+    }
+    findUserByEmail(email) {
         return this.db.findUserByEmail(email);
-    };
-    AccountsPassword.prototype.findUserById = function (id) {
+    }
+    findUserById(id) {
         return this.db.findUserById(id);
-    };
-    AccountsPassword.prototype.findUserByUsername = function (username) {
+    }
+    findUserByUsername(username) {
         return this.db.findUserByUsername(username);
-    };
-    AccountsPassword.prototype.getInviteInfo = function (id) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4, this.db.getInviteInfo(id)];
-                    case 1: return [2, _a.sent()];
-                }
-            });
-        });
-    };
-    AccountsPassword.prototype.addEmail = function (userId, newEmail, verified) {
+    }
+    async getInviteInfo(id) {
+        return await this.db.getInviteInfo(id);
+    }
+    addEmail(userId, newEmail, verified) {
         if (!this.options.validateEmail(newEmail)) {
             throw new Error(this.options.errors.invalidEmail);
         }
         return this.db.addEmail(userId, newEmail, verified);
-    };
-    AccountsPassword.prototype.removeEmail = function (userId, email) {
+    }
+    removeEmail(userId, email) {
         return this.db.removeEmail(userId, email);
-    };
-    AccountsPassword.prototype.verifyEmail = function (token) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var user, verificationTokens, tokenRecord, emailRecord;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        if (!token || !(0, lodash_1.isString)(token)) {
-                            throw new Error(this.options.errors.invalidToken);
-                        }
-                        return [4, this.db.findUserByEmailVerificationToken(token)];
-                    case 1:
-                        user = _a.sent();
-                        if (!user) {
-                            throw new Error(this.options.errors.verifyEmailLinkExpired);
-                        }
-                        verificationTokens = (0, utils_1.getUserVerificationTokens)(user);
-                        tokenRecord = (0, lodash_1.find)(verificationTokens, function (t) { return t.token === token; });
-                        if (!tokenRecord ||
-                            this.isTokenExpired(tokenRecord, this.options.verifyEmailTokenExpiration)) {
-                            throw new Error(this.options.errors.verifyEmailLinkExpired);
-                        }
-                        emailRecord = (0, lodash_1.find)(user.emails, function (e) { return e.address === tokenRecord.address; });
-                        if (!emailRecord) {
-                            throw new Error(this.options.errors.verifyEmailLinkUnknownAddress);
-                        }
-                        return [4, this.db.verifyEmail(user.id, emailRecord.address)];
-                    case 2:
-                        _a.sent();
-                        return [2];
-                }
-            });
+    }
+    async verifyEmail(token) {
+        if (!token || !(0, lodash_1.isString)(token)) {
+            throw new Error(this.options.errors.invalidToken);
+        }
+        const user = await this.db.findUserByEmailVerificationToken(token);
+        if (!user) {
+            throw new Error(this.options.errors.verifyEmailLinkExpired);
+        }
+        const verificationTokens = (0, utils_1.getUserVerificationTokens)(user);
+        const tokenRecord = (0, lodash_1.find)(verificationTokens, (t) => t.token === token);
+        if (!tokenRecord ||
+            this.isTokenExpired(tokenRecord, this.options.verifyEmailTokenExpiration)) {
+            throw new Error(this.options.errors.verifyEmailLinkExpired);
+        }
+        const emailRecord = (0, lodash_1.find)(user.emails, (e) => e.address === tokenRecord.address);
+        if (!emailRecord) {
+            throw new Error(this.options.errors.verifyEmailLinkUnknownAddress);
+        }
+        await this.db.verifyEmail(user.id, emailRecord.address);
+    }
+    async resetPassword(token, newPassword, infos) {
+        if (!token || !(0, lodash_1.isString)(token)) {
+            throw new Error(this.options.errors.invalidToken);
+        }
+        if (!newPassword || !(0, lodash_1.isString)(newPassword)) {
+            throw new Error(this.options.errors.invalidNewPassword);
+        }
+        const user = await this.db.findUserByResetPasswordToken(token);
+        if (!user) {
+            throw new Error(this.options.errors.resetPasswordLinkExpired);
+        }
+        const resetTokens = (0, utils_1.getUserResetTokens)(user);
+        const resetTokenRecord = (0, lodash_1.find)(resetTokens, (t) => t.token === token);
+        if (!resetTokenRecord ||
+            this.isTokenExpired(resetTokenRecord, resetTokenRecord.reason === "enroll"
+                ? this.options.passwordEnrollTokenExpiration
+                : this.options.passwordResetTokenExpiration)) {
+            throw new Error(this.options.errors.resetPasswordLinkExpired);
+        }
+        const emails = user.emails || [];
+        if (!(0, lodash_1.includes)(emails.map((email) => email.address), resetTokenRecord.address)) {
+            throw new Error(this.options.errors.resetPasswordLinkUnknownAddress);
+        }
+        const password = await this.hashAndBcryptPassword(newPassword);
+        await this.db.setResetPassword(user.id, resetTokenRecord.address, password, token);
+        this.server.getHooks().emit(server_1.ServerHooks.ResetPasswordSuccess, user);
+        if (resetTokenRecord.reason === "enroll") {
+            await this.db.verifyEmail(user.id, resetTokenRecord.address);
+        }
+        if (this.options.invalidateAllSessionsAfterPasswordReset) {
+            await this.db.invalidateAllSessions(user.id);
+        }
+        if (this.options.notifyUserAfterPasswordChanged) {
+            const address = user.emails && user.emails[0].address;
+            if (address) {
+                const passwordChangedMail = this.server.prepareMail(address, "", this.server.sanitizeUser(user), "", this.server.options.emailTemplates.passwordChanged, this.server.options.emailTemplates.from);
+                await this.server.options.sendMail(passwordChangedMail);
+            }
+        }
+        if (this.options.returnTokensAfterResetPassword) {
+            return this.server.loginWithUser(user, infos);
+        }
+        return null;
+    }
+    async getUserProfile(userId) {
+        const spaceId = (0, objectql_1.getSteedosConfig)().tenant._id;
+        let password_history = 3;
+        let max_login_attempts = 10;
+        let lockout_interval = 15;
+        let enable_MFA = false;
+        let logout_other_clients = false;
+        let login_expiration_in_days = null;
+        let phone_logout_other_clients = false;
+        let phone_login_expiration_in_days = null;
+        const spaceUsers = await (0, objectql_1.getObject)("space_users").find({
+            filters: `(user eq '${userId}') and (space eq '${spaceId}')`,
         });
-    };
-    AccountsPassword.prototype.resetPassword = function (token, newPassword, infos) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var user, resetTokens, resetTokenRecord, emails, password, address, passwordChangedMail;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        if (!token || !(0, lodash_1.isString)(token)) {
-                            throw new Error(this.options.errors.invalidToken);
-                        }
-                        if (!newPassword || !(0, lodash_1.isString)(newPassword)) {
-                            throw new Error(this.options.errors.invalidNewPassword);
-                        }
-                        return [4, this.db.findUserByResetPasswordToken(token)];
-                    case 1:
-                        user = _a.sent();
-                        if (!user) {
-                            throw new Error(this.options.errors.resetPasswordLinkExpired);
-                        }
-                        resetTokens = (0, utils_1.getUserResetTokens)(user);
-                        resetTokenRecord = (0, lodash_1.find)(resetTokens, function (t) { return t.token === token; });
-                        if (!resetTokenRecord ||
-                            this.isTokenExpired(resetTokenRecord, resetTokenRecord.reason === "enroll"
-                                ? this.options.passwordEnrollTokenExpiration
-                                : this.options.passwordResetTokenExpiration)) {
-                            throw new Error(this.options.errors.resetPasswordLinkExpired);
-                        }
-                        emails = user.emails || [];
-                        if (!(0, lodash_1.includes)(emails.map(function (email) { return email.address; }), resetTokenRecord.address)) {
-                            throw new Error(this.options.errors.resetPasswordLinkUnknownAddress);
-                        }
-                        return [4, this.hashAndBcryptPassword(newPassword)];
-                    case 2:
-                        password = _a.sent();
-                        return [4, this.db.setResetPassword(user.id, resetTokenRecord.address, password, token)];
-                    case 3:
-                        _a.sent();
-                        this.server.getHooks().emit(server_1.ServerHooks.ResetPasswordSuccess, user);
-                        if (!(resetTokenRecord.reason === "enroll")) return [3, 5];
-                        return [4, this.db.verifyEmail(user.id, resetTokenRecord.address)];
-                    case 4:
-                        _a.sent();
-                        _a.label = 5;
-                    case 5:
-                        if (!this.options.invalidateAllSessionsAfterPasswordReset) return [3, 7];
-                        return [4, this.db.invalidateAllSessions(user.id)];
-                    case 6:
-                        _a.sent();
-                        _a.label = 7;
-                    case 7:
-                        if (!this.options.notifyUserAfterPasswordChanged) return [3, 9];
-                        address = user.emails && user.emails[0].address;
-                        if (!address) return [3, 9];
-                        passwordChangedMail = this.server.prepareMail(address, "", this.server.sanitizeUser(user), "", this.server.options.emailTemplates.passwordChanged, this.server.options.emailTemplates.from);
-                        return [4, this.server.options.sendMail(passwordChangedMail)];
-                    case 8:
-                        _a.sent();
-                        _a.label = 9;
-                    case 9:
-                        if (this.options.returnTokensAfterResetPassword) {
-                            return [2, this.server.loginWithUser(user, infos)];
-                        }
-                        return [2, null];
-                }
+        if (spaceUsers.length > 0) {
+            const spaceUser = spaceUsers[0];
+            const profiles = await (0, objectql_1.getObject)("permission_set").find({
+                filters: `(name eq '${spaceUser.profile}') and (type eq 'profile') and (space eq '${spaceId}')`,
             });
-        });
-    };
-    AccountsPassword.prototype.getUserProfile = function (userId) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var spaceId, password_history, max_login_attempts, lockout_interval, enable_MFA, logout_other_clients, login_expiration_in_days, phone_logout_other_clients, phone_login_expiration_in_days, spaceUsers, spaceUser, profiles, userProfile;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        spaceId = (0, objectql_1.getSteedosConfig)().tenant._id;
-                        password_history = 3;
-                        max_login_attempts = 10;
-                        lockout_interval = 15;
-                        enable_MFA = false;
-                        logout_other_clients = false;
-                        login_expiration_in_days = null;
-                        phone_logout_other_clients = false;
-                        phone_login_expiration_in_days = null;
-                        return [4, (0, objectql_1.getObject)("space_users").find({
-                                filters: "(user eq '".concat(userId, "') and (space eq '").concat(spaceId, "')"),
-                            })];
-                    case 1:
-                        spaceUsers = _a.sent();
-                        if (!(spaceUsers.length > 0)) return [3, 3];
-                        spaceUser = spaceUsers[0];
-                        return [4, (0, objectql_1.getObject)("permission_set").find({
-                                filters: "(name eq '".concat(spaceUser.profile, "') and (type eq 'profile') and (space eq '").concat(spaceId, "')"),
-                            })];
-                    case 2:
-                        profiles = _a.sent();
-                        if (profiles.length > 0) {
-                            userProfile = profiles[0];
-                            if (_.has(userProfile, "password_history")) {
-                                password_history = Number(userProfile.password_history);
-                            }
-                            if (_.has(userProfile, "max_login_attempts")) {
-                                max_login_attempts = Number(userProfile.max_login_attempts);
-                            }
-                            if (_.has(userProfile, "lockout_interval")) {
-                                lockout_interval = Number(userProfile.lockout_interval);
-                            }
-                            if (_.has(userProfile, "enable_MFA")) {
-                                enable_MFA = userProfile.enable_MFA;
-                            }
-                            if (_.has(userProfile, "logout_other_clients")) {
-                                logout_other_clients = userProfile.logout_other_clients;
-                            }
-                            if (_.has(userProfile, "login_expiration_in_days")) {
-                                login_expiration_in_days = userProfile.login_expiration_in_days;
-                            }
-                            if (_.has(userProfile, "phone_logout_other_clients")) {
-                                phone_logout_other_clients = userProfile.phone_logout_other_clients;
-                            }
-                            if (_.has(userProfile, "phone_login_expiration_in_days")) {
-                                phone_login_expiration_in_days =
-                                    userProfile.phone_login_expiration_in_days;
-                            }
-                        }
-                        _a.label = 3;
-                    case 3: return [2, Object.assign({
-                            space: spaceId,
-                            password_history: password_history,
-                            max_login_attempts: max_login_attempts,
-                            lockout_interval: lockout_interval,
-                            logout_other_clients: logout_other_clients,
-                            enable_MFA: enable_MFA,
-                            login_expiration_in_days: login_expiration_in_days,
-                            phone_logout_other_clients: phone_logout_other_clients,
-                            phone_login_expiration_in_days: phone_login_expiration_in_days,
-                        })];
+            if (profiles.length > 0) {
+                const userProfile = profiles[0];
+                if (_.has(userProfile, "password_history")) {
+                    password_history = Number(userProfile.password_history);
                 }
-            });
-        });
-    };
-    AccountsPassword.prototype.setPassword = function (userId, newPassword) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var password;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4, (0, utils_1.bcryptPassword)(newPassword)];
-                    case 1:
-                        password = _a.sent();
-                        return [2, this.db.setPassword(userId, password)];
+                if (_.has(userProfile, "max_login_attempts")) {
+                    max_login_attempts = Number(userProfile.max_login_attempts);
                 }
-            });
-        });
-    };
-    AccountsPassword.prototype.changePassword = function (userId, oldPassword, newPassword) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var user, saas, passwordHistory, userProfile, validPasswordHistory, _i, validPasswordHistory_1, item, verify, password, address, passwordChangedMail;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        if (!this.options.validatePassword(newPassword)) {
-                            throw new Error(this.options.errors.invalidPassword);
-                        }
-                        return [4, this.passwordAuthenticator({ id: userId }, oldPassword)];
-                    case 1:
-                        user = _a.sent();
-                        saas = (0, objectql_1.getSteedosConfig)().tenant.saas;
-                        if (!!saas) return [3, 6];
-                        passwordHistory = user.services.password_history || [];
-                        return [4, this.getUserProfile(userId)];
-                    case 2:
-                        userProfile = _a.sent();
-                        validPasswordHistory = _.last(passwordHistory, userProfile.password_history);
-                        _i = 0, validPasswordHistory_1 = validPasswordHistory;
-                        _a.label = 3;
-                    case 3:
-                        if (!(_i < validPasswordHistory_1.length)) return [3, 6];
-                        item = validPasswordHistory_1[_i];
-                        return [4, (0, utils_1.verifyPassword)(newPassword, item)];
-                    case 4:
-                        verify = _a.sent();
-                        if (verify) {
-                            throw new Error("最近 " + userProfile.password_history + " 次密码不能相同");
-                        }
-                        _a.label = 5;
-                    case 5:
-                        _i++;
-                        return [3, 3];
-                    case 6: return [4, (0, utils_1.bcryptPassword)(newPassword)];
-                    case 7:
-                        password = _a.sent();
-                        return [4, this.db.setPassword(userId, password)];
-                    case 8:
-                        _a.sent();
-                        this.server.getHooks().emit(server_1.ServerHooks.ChangePasswordSuccess, user);
-                        if (!this.options.invalidateAllSessionsAfterPasswordChanged) return [3, 10];
-                        return [4, this.db.invalidateAllSessions(user.id)];
-                    case 9:
-                        _a.sent();
-                        _a.label = 10;
-                    case 10:
-                        if (!this.options.notifyUserAfterPasswordChanged) return [3, 12];
-                        address = user.emails && user.emails[0].address;
-                        if (!address) return [3, 12];
-                        passwordChangedMail = this.server.prepareMail(address, "", this.server.sanitizeUser(user), "", this.server.options.emailTemplates.passwordChanged, this.server.options.emailTemplates.from);
-                        return [4, this.server.options.sendMail(passwordChangedMail)];
-                    case 11:
-                        _a.sent();
-                        _a.label = 12;
-                    case 12: return [2];
+                if (_.has(userProfile, "lockout_interval")) {
+                    lockout_interval = Number(userProfile.lockout_interval);
                 }
-            });
-        });
-    };
-    AccountsPassword.prototype.sendVerificationEmail = function (address) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var user, code, token, resetPasswordMail;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        if (!address || !(0, lodash_1.isString)(address)) {
-                            throw new Error(this.options.errors.invalidEmail);
-                        }
-                        return [4, this.db.findUserByEmail(address)];
-                    case 1:
-                        user = _a.sent();
-                        if (!user) {
-                            if (this.server.options.ambiguousErrorMessages) {
-                                return [2];
-                            }
-                            throw new Error(this.options.errors.userNotFound);
-                        }
-                        if (user.email_verified)
-                            return [2];
-                        code = (0, server_1.generateRandomCode)();
-                        token = (0, server_1.generateRandomToken)();
-                        return [4, this.db.addEmailVerificationToken(user.id, address, token, code)];
-                    case 2:
-                        _a.sent();
-                        resetPasswordMail = this.server.prepareMail(address, code, this.server.sanitizeUser(user), getPathFragmentPrefix() + "verify-email", this.server.options.emailTemplates.verifyEmail, this.server.options.emailTemplates.from);
-                        return [4, this.server.options.sendMail(resetPasswordMail)];
-                    case 3:
-                        _a.sent();
-                        return [2];
+                if (_.has(userProfile, "enable_MFA")) {
+                    enable_MFA = userProfile.enable_MFA;
                 }
-            });
-        });
-    };
-    AccountsPassword.prototype.sendResetPasswordEmail = function (address) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var user, token, resetPasswordMail;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        if (!address || !(0, lodash_1.isString)(address)) {
-                            throw new Error(this.options.errors.invalidEmail);
-                        }
-                        return [4, this.db.findUserByEmail(address)];
-                    case 1:
-                        user = _a.sent();
-                        if (!user) {
-                            if (this.server.options.ambiguousErrorMessages) {
-                                return [2];
-                            }
-                            throw new Error(this.options.errors.userNotFound);
-                        }
-                        token = (0, server_1.generateRandomToken)();
-                        return [4, this.db.addResetPasswordToken(user.id, address, token, "reset")];
-                    case 2:
-                        _a.sent();
-                        resetPasswordMail = this.server.prepareMail(address, token, this.server.sanitizeUser(user), getPathFragmentPrefix() + "reset-password", this.server.options.emailTemplates.resetPassword, this.server.options.emailTemplates.from);
-                        return [4, this.server.options.sendMail(resetPasswordMail)];
-                    case 3:
-                        _a.sent();
-                        return [2];
+                if (_.has(userProfile, "logout_other_clients")) {
+                    logout_other_clients = userProfile.logout_other_clients;
                 }
-            });
-        });
-    };
-    AccountsPassword.prototype.sendEnrollmentEmail = function (address) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var user, token, enrollmentMail;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        if (!address || !(0, lodash_1.isString)(address)) {
-                            throw new Error(this.options.errors.invalidEmail);
-                        }
-                        return [4, this.db.findUserByEmail(address)];
-                    case 1:
-                        user = _a.sent();
-                        if (!user) {
-                            throw new Error(this.options.errors.userNotFound);
-                        }
-                        token = (0, server_1.generateRandomToken)();
-                        return [4, this.db.addResetPasswordToken(user.id, address, token, "enroll")];
-                    case 2:
-                        _a.sent();
-                        enrollmentMail = this.server.prepareMail(address, token, this.server.sanitizeUser(user), getPathFragmentPrefix() + "enroll-account", this.server.options.emailTemplates.enrollAccount, this.server.options.emailTemplates.from);
-                        return [4, this.server.options.sendMail(enrollmentMail)];
-                    case 3:
-                        _a.sent();
-                        return [2];
+                if (_.has(userProfile, "login_expiration_in_days")) {
+                    login_expiration_in_days = userProfile.login_expiration_in_days;
                 }
-            });
+                if (_.has(userProfile, "phone_logout_other_clients")) {
+                    phone_logout_other_clients = userProfile.phone_logout_other_clients;
+                }
+                if (_.has(userProfile, "phone_login_expiration_in_days")) {
+                    phone_login_expiration_in_days =
+                        userProfile.phone_login_expiration_in_days;
+                }
+            }
+        }
+        return Object.assign({
+            space: spaceId,
+            password_history: password_history,
+            max_login_attempts: max_login_attempts,
+            lockout_interval: lockout_interval,
+            logout_other_clients,
+            enable_MFA,
+            login_expiration_in_days,
+            phone_logout_other_clients,
+            phone_login_expiration_in_days,
         });
-    };
-    AccountsPassword.prototype.createUser = function (user) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var _a, _b, _c, _d, r, userId_1, e_1;
-            var _this = this;
-            return tslib_1.__generator(this, function (_e) {
-                switch (_e.label) {
-                    case 0:
-                        if (!user.email && !user.mobile) {
-                            throw new Error(this.options.errors.emailOrMobileRequired);
-                        }
-                        if (user.username && !this.options.validateUsername(user.username)) {
-                            throw new Error(this.options.errors.invalidUsername);
-                        }
-                        if (user.email && !this.options.validateEmail(user.email)) {
-                            throw new Error(this.options.errors.invalidEmail);
-                        }
-                        _a = user.mobile;
-                        if (!_a) return [3, 2];
-                        return [4, this.db.findUserByMobile(user.mobile)];
-                    case 1:
-                        _a = (_e.sent());
-                        _e.label = 2;
-                    case 2:
-                        if (_a) {
-                            throw new Error(this.options.errors.mobileAlreadyExists);
-                        }
-                        _b = user.username;
-                        if (!_b) return [3, 4];
-                        return [4, this.db.findUserByUsername(user.username)];
-                    case 3:
-                        _b = (_e.sent());
-                        _e.label = 4;
-                    case 4:
-                        if (_b) {
-                            throw new Error(this.options.errors.usernameAlreadyExists);
-                        }
-                        _c = user.email;
-                        if (!_c) return [3, 6];
-                        return [4, this.db.findUserByEmail(user.email)];
-                    case 5:
-                        _c = (_e.sent());
-                        _e.label = 6;
-                    case 6:
-                        if (_c) {
-                            throw new Error(this.options.errors.emailAlreadyExists);
-                        }
-                        if (!user.password && !user.verifyCode) {
-                            throw new Error(this.options.errors.invalidVerifyParam);
-                        }
-                        if (!user.password) return [3, 9];
-                        if (!this.options.validatePassword(user.password)) {
-                            throw new Error(this.options.errors.invalidPassword);
-                        }
-                        _d = user;
-                        return [4, (0, utils_1.bcryptPassword)(user.password)];
-                    case 7: return [4, _e.sent()];
-                    case 8:
-                        _d.password = _e.sent();
-                        _e.label = 9;
-                    case 9:
-                        if (!user.verifyCode) return [3, 11];
-                        return [4, this.db.checkVerificationCode(user, user.verifyCode)];
-                    case 10:
-                        r = _e.sent();
-                        if (!r) {
-                            throw new Error(this.options.errors.invalidVerifyCode);
-                        }
-                        delete user.verifyCode;
-                        if (user.email)
-                            user.email_verified = true;
-                        if (user.mobile)
-                            user.mobile_verified = true;
-                        _e.label = 11;
-                    case 11:
-                        _e.trys.push([11, 13, , 15]);
-                        return [4, this.db.createUser(user)];
-                    case 12:
-                        userId_1 = _e.sent();
-                        (0, lodash_1.defer)(function () { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-                            var userRecord;
-                            return tslib_1.__generator(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0:
-                                        if (this.options.sendVerificationEmailAfterSignup &&
-                                            user.email &&
-                                            !user.email_verified)
-                                            this.sendVerificationEmail(user.email);
-                                        return [4, this.db.findUserById(userId_1)];
-                                    case 1:
-                                        userRecord = (_a.sent());
-                                        this.server.getHooks().emit(server_1.ServerHooks.CreateUserSuccess, userRecord);
-                                        return [2];
-                                }
-                            });
-                        }); });
-                        return [2, userId_1];
-                    case 13:
-                        e_1 = _e.sent();
-                        return [4, this.server.getHooks().emit(server_1.ServerHooks.CreateUserError, user)];
-                    case 14:
-                        _e.sent();
-                        throw e_1;
-                    case 15: return [2];
+    }
+    async checkPasswordExpiry(userId) {
+        const config = (0, objectql_1.getSteedosConfig)();
+        const tenant = config?.tenant;
+        if (!tenant || !tenant._id) {
+            return;
+        }
+        const spaceId = tenant._id;
+        const spaces = await (0, objectql_1.getObject)("spaces").find({
+            filters: [['_id', '=', spaceId]],
+            fields: ['password_expiry_days']
+        });
+        if (!spaces || spaces.length === 0) {
+            return;
+        }
+        const space = spaces[0];
+        const passwordExpiryDays = space.password_expiry_days;
+        if (!passwordExpiryDays || passwordExpiryDays <= 0) {
+            return;
+        }
+        const user = await this.db.findUserById(userId);
+        const passwordModifiedAt = user.password_modified_at;
+        if (!passwordModifiedAt) {
+            return;
+        }
+        const daysSinceModified = moment().diff(moment(passwordModifiedAt), 'days');
+        if (daysSinceModified >= passwordExpiryDays) {
+            await this.db.updateUser(userId, {
+                $set: { password_expired: true }
+            });
+        }
+    }
+    async setPassword(userId, newPassword) {
+        const password = await (0, utils_1.bcryptPassword)(newPassword);
+        return this.db.setPassword(userId, password);
+    }
+    async changePassword(userId, oldPassword, newPassword) {
+        if (!this.options.validatePassword(newPassword)) {
+            throw new Error(this.options.errors.invalidPassword);
+        }
+        const user = await this.passwordAuthenticator({ id: userId }, oldPassword);
+        const saas = (0, objectql_1.getSteedosConfig)().tenant.saas;
+        if (!saas) {
+            const passwordHistory = user.services.password_history || [];
+            const userProfile = await this.getUserProfile(userId);
+            const validPasswordHistory = _.last(passwordHistory, userProfile.password_history);
+            for (const item of validPasswordHistory) {
+                var verify = await (0, utils_1.verifyPassword)(newPassword, item);
+                if (verify) {
+                    throw new Error("最近 " + userProfile.password_history + " 次密码不能相同");
                 }
+            }
+        }
+        const password = await (0, utils_1.bcryptPassword)(newPassword);
+        await this.db.setPassword(userId, password);
+        this.server.getHooks().emit(server_1.ServerHooks.ChangePasswordSuccess, user);
+        if (this.options.invalidateAllSessionsAfterPasswordChanged) {
+            await this.db.invalidateAllSessions(user.id);
+        }
+        if (this.options.notifyUserAfterPasswordChanged) {
+            const address = user.emails && user.emails[0].address;
+            if (address) {
+                const passwordChangedMail = this.server.prepareMail(address, "", this.server.sanitizeUser(user), "", this.server.options.emailTemplates.passwordChanged, this.server.options.emailTemplates.from);
+                await this.server.options.sendMail(passwordChangedMail);
+            }
+        }
+    }
+    async sendVerificationEmail(address) {
+        if (!address || !(0, lodash_1.isString)(address)) {
+            throw new Error(this.options.errors.invalidEmail);
+        }
+        const user = await this.db.findUserByEmail(address);
+        if (!user) {
+            if (this.server.options.ambiguousErrorMessages) {
+                return;
+            }
+            throw new Error(this.options.errors.userNotFound);
+        }
+        if (user.email_verified)
+            return;
+        const code = (0, server_1.generateRandomCode)();
+        const token = (0, server_1.generateRandomToken)();
+        await this.db.addEmailVerificationToken(user.id, address, token, code);
+        const resetPasswordMail = this.server.prepareMail(address, code, this.server.sanitizeUser(user), getPathFragmentPrefix() + "verify-email", this.server.options.emailTemplates.verifyEmail, this.server.options.emailTemplates.from);
+        await this.server.options.sendMail(resetPasswordMail);
+    }
+    async sendResetPasswordEmail(address) {
+        if (!address || !(0, lodash_1.isString)(address)) {
+            throw new Error(this.options.errors.invalidEmail);
+        }
+        const user = await this.db.findUserByEmail(address);
+        if (!user) {
+            if (this.server.options.ambiguousErrorMessages) {
+                return;
+            }
+            throw new Error(this.options.errors.userNotFound);
+        }
+        const token = (0, server_1.generateRandomToken)();
+        await this.db.addResetPasswordToken(user.id, address, token, "reset");
+        const resetPasswordMail = this.server.prepareMail(address, token, this.server.sanitizeUser(user), getPathFragmentPrefix() + "reset-password", this.server.options.emailTemplates.resetPassword, this.server.options.emailTemplates.from);
+        await this.server.options.sendMail(resetPasswordMail);
+    }
+    async sendEnrollmentEmail(address) {
+        if (!address || !(0, lodash_1.isString)(address)) {
+            throw new Error(this.options.errors.invalidEmail);
+        }
+        const user = await this.db.findUserByEmail(address);
+        if (!user) {
+            throw new Error(this.options.errors.userNotFound);
+        }
+        const token = (0, server_1.generateRandomToken)();
+        await this.db.addResetPasswordToken(user.id, address, token, "enroll");
+        const enrollmentMail = this.server.prepareMail(address, token, this.server.sanitizeUser(user), getPathFragmentPrefix() + "enroll-account", this.server.options.emailTemplates.enrollAccount, this.server.options.emailTemplates.from);
+        await this.server.options.sendMail(enrollmentMail);
+    }
+    async createUser(user) {
+        if (!user.email && !user.mobile) {
+            throw new Error(this.options.errors.emailOrMobileRequired);
+        }
+        if (user.username && !this.options.validateUsername(user.username)) {
+            throw new Error(this.options.errors.invalidUsername);
+        }
+        if (user.email && !this.options.validateEmail(user.email)) {
+            throw new Error(this.options.errors.invalidEmail);
+        }
+        if (user.mobile && (await this.db.findUserByMobile(user.mobile))) {
+            throw new Error(this.options.errors.mobileAlreadyExists);
+        }
+        if (user.username && (await this.db.findUserByUsername(user.username))) {
+            throw new Error(this.options.errors.usernameAlreadyExists);
+        }
+        if (user.email && (await this.db.findUserByEmail(user.email))) {
+            throw new Error(this.options.errors.emailAlreadyExists);
+        }
+        if (!user.password && !user.verifyCode) {
+            throw new Error(this.options.errors.invalidVerifyParam);
+        }
+        if (user.password) {
+            if (!this.options.validatePassword(user.password)) {
+                throw new Error(this.options.errors.invalidPassword);
+            }
+            user.password = await await (0, utils_1.bcryptPassword)(user.password);
+        }
+        if (user.verifyCode) {
+            const r = await this.db.checkVerificationCode(user, user.verifyCode);
+            if (!r) {
+                throw new Error(this.options.errors.invalidVerifyCode);
+            }
+            delete user.verifyCode;
+            if (user.email)
+                user.email_verified = true;
+            if (user.mobile)
+                user.mobile_verified = true;
+        }
+        try {
+            const userId = await this.db.createUser(user);
+            (0, lodash_1.defer)(async () => {
+                if (this.options.sendVerificationEmailAfterSignup &&
+                    user.email &&
+                    !user.email_verified)
+                    this.sendVerificationEmail(user.email);
+                const userRecord = (await this.db.findUserById(userId));
+                this.server.getHooks().emit(server_1.ServerHooks.CreateUserSuccess, userRecord);
             });
-        });
-    };
-    AccountsPassword.prototype.isTokenExpired = function (tokenRecord, expiryDate) {
+            return userId;
+        }
+        catch (e) {
+            await this.server.getHooks().emit(server_1.ServerHooks.CreateUserError, user);
+            throw e;
+        }
+    }
+    isTokenExpired(tokenRecord, expiryDate) {
         return Number(tokenRecord.when) + expiryDate < Date.now();
-    };
-    AccountsPassword.prototype.verifyUserPasswordByEmail = function (email, password) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4, this.passwordAuthenticator({ email: email }, password)];
-                    case 1: return [2, _a.sent()];
+    }
+    async verifyUserPasswordByEmail(email, password) {
+        return await this.passwordAuthenticator({ email: email }, password);
+    }
+    async foundUser(user) {
+        const { username, email, id, mobile } = typeof user == "string"
+            ? this.toMobileAndEmail({ user })
+            : this.toMobileAndEmail({ ...user });
+        let foundUser = null;
+        if (id) {
+            foundUser = await this.db.findUserById(id);
+        }
+        else if (username) {
+            foundUser = await this.db.findUserByUsername(username);
+        }
+        else if (mobile) {
+            foundUser = await this.db.findUserByMobile(mobile);
+        }
+        else if (email) {
+            foundUser = await this.db.findUserByEmail(email);
+        }
+        return foundUser;
+    }
+    async passwordAuthenticator(user, password, isHashPassword = true) {
+        const { username, email, id, mobile } = typeof user == "string"
+            ? this.toMobileAndEmail({ user })
+            : this.toMobileAndEmail({ ...user });
+        let foundUser = null;
+        if (id) {
+            foundUser = await this.db.findUserById(id);
+        }
+        else if (username) {
+            foundUser = await this.db.findUserByUsername(username);
+        }
+        else if (mobile) {
+            foundUser = await this.db.findUserByMobile(mobile);
+        }
+        else if (email) {
+            foundUser = await this.db.findUserByEmail(email);
+        }
+        if (!foundUser) {
+            throw new Error(this.server.options.ambiguousErrorMessages
+                ? this.options.errors.invalidCredentials
+                : this.options.errors.userNotFound);
+        }
+        const hash = await this.db.findPasswordHash(foundUser.id);
+        if (!hash) {
+            throw new Error(this.options.errors.noPasswordSet);
+        }
+        const saas = (0, objectql_1.getSteedosConfig)().tenant.saas;
+        if (!saas) {
+            const locked = foundUser.lockout;
+            const login_failed_lockout_time = foundUser.login_failed_lockout_time;
+            if (locked) {
+                if (!login_failed_lockout_time) {
+                    throw new Error("账户已锁定，请联系管理员");
                 }
-            });
-        });
-    };
-    AccountsPassword.prototype.foundUser = function (user) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var _a, username, email, id, mobile, foundUser;
-            return tslib_1.__generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0:
-                        _a = typeof user == "string"
-                            ? this.toMobileAndEmail({ user: user })
-                            : this.toMobileAndEmail(tslib_1.__assign({}, user)), username = _a.username, email = _a.email, id = _a.id, mobile = _a.mobile;
-                        foundUser = null;
-                        if (!id) return [3, 2];
-                        return [4, this.db.findUserById(id)];
-                    case 1:
-                        foundUser = _b.sent();
-                        return [3, 8];
-                    case 2:
-                        if (!username) return [3, 4];
-                        return [4, this.db.findUserByUsername(username)];
-                    case 3:
-                        foundUser = _b.sent();
-                        return [3, 8];
-                    case 4:
-                        if (!mobile) return [3, 6];
-                        return [4, this.db.findUserByMobile(mobile)];
-                    case 5:
-                        foundUser = _b.sent();
-                        return [3, 8];
-                    case 6:
-                        if (!email) return [3, 8];
-                        return [4, this.db.findUserByEmail(email)];
-                    case 7:
-                        foundUser = _b.sent();
-                        _b.label = 8;
-                    case 8: return [2, foundUser];
+                else {
+                    if (moment(login_failed_lockout_time).isAfter(new Date())) {
+                        throw new Error("账户已锁定，请联系管理员");
+                    }
                 }
-            });
-        });
-    };
-    AccountsPassword.prototype.passwordAuthenticator = function (user_1, password_1) {
-        return tslib_1.__awaiter(this, arguments, void 0, function (user, password, isHashPassword) {
-            var _a, username, email, id, mobile, foundUser, hash, saas, locked, login_failed_lockout_time, hashAlgorithm, pass, isPasswordValid, userProfile, login_failed_lockout_time, user_2, lockout_interval, login_failed_lockout_time_1;
-            if (isHashPassword === void 0) { isHashPassword = true; }
-            return tslib_1.__generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0:
-                        _a = typeof user == "string"
-                            ? this.toMobileAndEmail({ user: user })
-                            : this.toMobileAndEmail(tslib_1.__assign({}, user)), username = _a.username, email = _a.email, id = _a.id, mobile = _a.mobile;
-                        foundUser = null;
-                        if (!id) return [3, 2];
-                        return [4, this.db.findUserById(id)];
-                    case 1:
-                        foundUser = _b.sent();
-                        return [3, 8];
-                    case 2:
-                        if (!username) return [3, 4];
-                        return [4, this.db.findUserByUsername(username)];
-                    case 3:
-                        foundUser = _b.sent();
-                        return [3, 8];
-                    case 4:
-                        if (!mobile) return [3, 6];
-                        return [4, this.db.findUserByMobile(mobile)];
-                    case 5:
-                        foundUser = _b.sent();
-                        return [3, 8];
-                    case 6:
-                        if (!email) return [3, 8];
-                        return [4, this.db.findUserByEmail(email)];
-                    case 7:
-                        foundUser = _b.sent();
-                        _b.label = 8;
-                    case 8:
-                        if (!foundUser) {
-                            throw new Error(this.server.options.ambiguousErrorMessages
-                                ? this.options.errors.invalidCredentials
-                                : this.options.errors.userNotFound);
-                        }
-                        return [4, this.db.findPasswordHash(foundUser.id)];
-                    case 9:
-                        hash = _b.sent();
-                        if (!hash) {
-                            throw new Error(this.options.errors.noPasswordSet);
-                        }
-                        saas = (0, objectql_1.getSteedosConfig)().tenant.saas;
-                        if (!saas) {
-                            locked = foundUser.lockout;
-                            login_failed_lockout_time = foundUser.login_failed_lockout_time;
-                            if (locked) {
-                                if (!login_failed_lockout_time) {
-                                    throw new Error("账户已锁定，请联系管理员");
-                                }
-                                else {
-                                    if (moment(login_failed_lockout_time).isAfter(new Date())) {
-                                        throw new Error("账户已锁定，请联系管理员");
-                                    }
-                                }
-                            }
-                        }
-                        hashAlgorithm = this.options.passwordHashAlgorithm;
-                        pass = null;
-                        if (isHashPassword) {
-                            pass = password;
-                        }
-                        else {
-                            pass = hashAlgorithm ? (0, utils_1.hashPassword)(password, hashAlgorithm) : password;
-                        }
-                        return [4, (0, utils_1.verifyPassword)(pass, hash)];
-                    case 10:
-                        isPasswordValid = _b.sent();
-                        if (!!isPasswordValid) return [3, 19];
-                        if (!!saas) return [3, 18];
-                        return [4, this.getUserProfile(foundUser.id)];
-                    case 11:
-                        userProfile = _b.sent();
-                        login_failed_lockout_time = foundUser.login_failed_lockout_time;
-                        if (!(userProfile.lockout_interval != 0 &&
-                            moment(login_failed_lockout_time).isBefore(new Date()))) return [3, 13];
-                        return [4, this.db.updateUser(foundUser.id, {
-                                $set: { login_failed_number: 1 },
-                            })];
-                    case 12:
-                        _b.sent();
-                        return [3, 15];
-                    case 13: return [4, this.db.updateUser(foundUser.id, {
-                            $inc: { login_failed_number: 1 },
-                        })];
-                    case 14:
-                        _b.sent();
-                        _b.label = 15;
-                    case 15: return [4, this.db.findUserById(foundUser.id)];
-                    case 16:
-                        user_2 = _b.sent();
-                        if (!(user_2.login_failed_number >= userProfile.max_login_attempts)) return [3, 18];
-                        lockout_interval = userProfile.lockout_interval;
-                        login_failed_lockout_time_1 = null;
-                        if (lockout_interval === 0) {
-                            login_failed_lockout_time_1 = null;
-                        }
-                        else {
-                            login_failed_lockout_time_1 = new Date(moment().add(userProfile.lockout_interval, "m"));
-                        }
-                        return [4, this.db.updateUser(foundUser.id, {
-                                $set: {
-                                    lockout: true,
-                                    login_failed_lockout_time: login_failed_lockout_time_1,
-                                },
-                            })];
-                    case 17:
-                        _b.sent();
-                        _b.label = 18;
-                    case 18: throw new Error(this.server.options.ambiguousErrorMessages
-                        ? this.options.errors.invalidCredentials
-                        : this.options.errors.incorrectPassword);
-                    case 19: return [4, this.db.updateUser(foundUser.id, {
-                            $set: { lockout: false, login_failed_number: 0 },
-                            $unset: { login_failed_lockout_time: 1 },
-                        })];
-                    case 20:
-                        _b.sent();
-                        _b.label = 21;
-                    case 21: return [2, foundUser];
+            }
+        }
+        const hashAlgorithm = this.options.passwordHashAlgorithm;
+        let pass = null;
+        if (isHashPassword) {
+            pass = password;
+        }
+        else {
+            pass = hashAlgorithm ? (0, utils_1.hashPassword)(password, hashAlgorithm) : password;
+        }
+        const isPasswordValid = await (0, utils_1.verifyPassword)(pass, hash);
+        if (!isPasswordValid) {
+            if (!saas) {
+                const userProfile = await this.getUserProfile(foundUser.id);
+                const login_failed_lockout_time = foundUser.login_failed_lockout_time;
+                if (userProfile.lockout_interval != 0 &&
+                    moment(login_failed_lockout_time).isBefore(new Date())) {
+                    await this.db.updateUser(foundUser.id, {
+                        $set: { login_failed_number: 1 },
+                    });
                 }
-            });
-        });
-    };
-    AccountsPassword.prototype.codeAuthenticator = function (user, token, locale) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var _a, username, email, mobile, id, foundUser;
-            return tslib_1.__generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0:
-                        _a = (0, lodash_1.isString)(user)
-                            ? this.toMobileAndEmail({ user: user })
-                            : this.toMobileAndEmail(tslib_1.__assign({}, user)), username = _a.username, email = _a.email, mobile = _a.mobile, id = _a.id;
-                        return [4, this.db.findUserByVerificationCode({ email: email, mobile: mobile }, token)];
-                    case 1:
-                        foundUser = _b.sent();
-                        if (!foundUser) {
-                            throw new Error(this.server.options.ambiguousErrorMessages
-                                ? this.options.errors.invalidCode
-                                : this.options.errors.userNotFound);
-                        }
-                        return [2, foundUser];
+                else {
+                    await this.db.updateUser(foundUser.id, {
+                        $inc: { login_failed_number: 1 },
+                    });
                 }
+                const user = await this.db.findUserById(foundUser.id);
+                if (user.login_failed_number >= userProfile.max_login_attempts) {
+                    let lockout_interval = userProfile.lockout_interval;
+                    let login_failed_lockout_time = null;
+                    if (lockout_interval === 0) {
+                        login_failed_lockout_time = null;
+                    }
+                    else {
+                        login_failed_lockout_time = new Date(moment().add(userProfile.lockout_interval, "m"));
+                    }
+                    await this.db.updateUser(foundUser.id, {
+                        $set: {
+                            lockout: true,
+                            login_failed_lockout_time: login_failed_lockout_time,
+                        },
+                    });
+                }
+            }
+            throw new Error(this.server.options.ambiguousErrorMessages
+                ? this.options.errors.invalidCredentials
+                : this.options.errors.incorrectPassword);
+        }
+        else {
+            await this.db.updateUser(foundUser.id, {
+                $set: { lockout: false, login_failed_number: 0 },
+                $unset: { login_failed_lockout_time: 1 },
             });
-        });
-    };
-    AccountsPassword.prototype.hashAndBcryptPassword = function (password) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var hashAlgorithm, hashedPassword;
-            return tslib_1.__generator(this, function (_a) {
-                hashAlgorithm = this.options.passwordHashAlgorithm;
-                hashedPassword = hashAlgorithm
-                    ? (0, utils_1.hashPassword)(password, hashAlgorithm)
-                    : password;
-                return [2, (0, utils_1.bcryptPassword)(hashedPassword)];
-            });
-        });
-    };
-    AccountsPassword.prototype.toMobileAndEmail = function (_a) {
-        var user = _a.user, username = _a.username, email = _a.email, mobile = _a.mobile, id = _a.id;
+        }
+        await this.checkPasswordExpiry(foundUser.id);
+        return foundUser;
+    }
+    async codeAuthenticator(user, token, locale) {
+        const { username, email, mobile, id } = (0, lodash_1.isString)(user)
+            ? this.toMobileAndEmail({ user })
+            : this.toMobileAndEmail({ ...user });
+        let foundUser = await this.db.findUserByVerificationCode({ email: email, mobile: mobile }, token);
+        if (!foundUser) {
+            throw new Error(this.server.options.ambiguousErrorMessages
+                ? this.options.errors.invalidCode
+                : this.options.errors.userNotFound);
+        }
+        return foundUser;
+    }
+    async hashAndBcryptPassword(password) {
+        const hashAlgorithm = this.options.passwordHashAlgorithm;
+        const hashedPassword = hashAlgorithm
+            ? (0, utils_1.hashPassword)(password, hashAlgorithm)
+            : password;
+        return (0, utils_1.bcryptPassword)(hashedPassword);
+    }
+    toMobileAndEmail({ user, username, email, mobile, id }) {
         if (user && !username && !email && !mobile) {
             if ((0, utils_1.isEmail)(user)) {
                 email = user;
@@ -778,49 +537,32 @@ var AccountsPassword = (function () {
                 mobile = user;
             }
         }
-        return { username: username, email: email, mobile: mobile, id: id };
-    };
-    AccountsPassword.prototype.sendVerificationCode = function (user) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var code, result, verificationCodeMail, result, sms;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        code = (0, server_1.generateRandomCode)();
-                        if (!user.email) return [3, 3];
-                        return [4, this.db.addVerificationCode(user, code, {
-                                MAX_FAILURE_COUNT: MAX_FAILURE_COUNT,
-                                EFFECTIVE_TIME: EFFECTIVE_TIME,
-                            })];
-                    case 1:
-                        result = _a.sent();
-                        verificationCodeMail = this.server.prepareMail(user.email, result.code, null, getPathFragmentPrefix() + "verify-email", this.server.options.emailTemplates.verificationCode, this.server.options.emailTemplates.from);
-                        return [4, this.server.options.sendMail(verificationCodeMail)];
-                    case 2:
-                        _a.sent();
-                        return [2, result.owner];
-                    case 3:
-                        if (!user.mobile) return [3, 6];
-                        return [4, this.db.addVerificationCode(user, code, {
-                                MAX_FAILURE_COUNT: MAX_FAILURE_COUNT,
-                                EFFECTIVE_TIME: EFFECTIVE_TIME,
-                            })];
-                    case 4:
-                        result = _a.sent();
-                        sms = {
-                            mobile: user.mobile,
-                            message: "\u60A8\u7684\u9A8C\u8BC1\u7801\u4E3A\uFF1A".concat(result.code, "\uFF0C\u8BE5\u9A8C\u8BC1\u7801").concat(EFFECTIVE_TIME, "\u5206\u949F\u5185\u6709\u6548\uFF0C\u8BF7\u52FF\u6CC4\u6F0F\u4E8E\u4ED6\u4EBA\uFF01"),
-                        };
-                        return [4, this.server.options.sendSMS(sms)];
-                    case 5:
-                        _a.sent();
-                        return [2, result.owner];
-                    case 6: return [2];
-                }
+        return { username, email, mobile, id };
+    }
+    async sendVerificationCode(user) {
+        const code = (0, server_1.generateRandomCode)();
+        if (user.email) {
+            const result = await this.db.addVerificationCode(user, code, {
+                MAX_FAILURE_COUNT,
+                EFFECTIVE_TIME,
             });
-        });
-    };
-    return AccountsPassword;
-}());
+            const verificationCodeMail = this.server.prepareMail(user.email, result.code, null, getPathFragmentPrefix() + "verify-email", this.server.options.emailTemplates.verificationCode, this.server.options.emailTemplates.from);
+            await this.server.options.sendMail(verificationCodeMail);
+            return result.owner;
+        }
+        else if (user.mobile) {
+            const result = await this.db.addVerificationCode(user, code, {
+                MAX_FAILURE_COUNT,
+                EFFECTIVE_TIME,
+            });
+            const sms = {
+                mobile: user.mobile,
+                message: `您的验证码为：${result.code}，该验证码${EFFECTIVE_TIME}分钟内有效，请勿泄漏于他人！`,
+            };
+            await this.server.options.sendSMS(sms);
+            return result.owner;
+        }
+    }
+}
 exports.default = AccountsPassword;
 //# sourceMappingURL=accounts-password.js.map