@tachybase/plugin-password-policy 1.2.10 → 1.2.11

package/dist/client/index.js

@@ -1,4 +1,4 @@
-(function(s,t){typeof exports=="object"&&typeof module!="undefined"?t(exports,require("@tachybase/client"),require("react/jsx-runtime"),require("@tachybase/schema"),require("antd")):typeof define=="function"&&define.amd?define(["exports","@tachybase/client","react/jsx-runtime","@tachybase/schema","antd"],t):(s=typeof globalThis!="undefined"?globalThis:s||self,t(s["@tachybase/plugin-password-policy"]={},s["@tachybase/client"],s.jsxRuntime,s["@tachybase/schema"],s.antd))})(this,function(s,t,n,l,a){"use strict";var j=Object.defineProperty;var g=Object.getOwnPropertySymbols;var K=Object.prototype.hasOwnProperty,$=Object.prototype.propertyIsEnumerable;var f=(s,t,n)=>t in s?j(s,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):s[t]=n,h=(s,t)=>{for(var n in t||(t={}))K.call(t,n)&&f(s,n,t[n]);if(g)for(var n of g(t))$.call(t,n)&&f(s,n,t[n]);return s};var y=(s,t,n)=>new Promise((l,a)=>{var b=e=>{try{d(n.next(e))}catch(u){a(u)}},c=e=>{try{d(n.throw(e))}catch(u){a(u)}},d=e=>e.done?l(e.value):Promise.resolve(e.value).then(b,c);d((n=n.apply(s,t)).next())});const b="password-policy";var c=(o=>(o[o.None=0]="None",o[o.NumberAndLetter=1]="NumberAndLetter",o[o.NumberAndLetterAndSymbol=2]="NumberAndLetterAndSymbol",o[o.NumberAndLetterAndUpperAndLower=3]="NumberAndLetterAndUpperAndLower",o[o.NumberAndLetterAndUpperAndLowerAndSymbol=4]="NumberAndLetterAndUpperAndLowerAndSymbol",o[o.NumberAndLetterAndUpperAndLowerAndSymbol3=5]="NumberAndLetterAndUpperAndLowerAndSymbol3",o))(c||{});function d(){return{t:(r,p={})=>t.i18n.t(r,h({ns:b},p))}}const e=o=>t.tval(o,{ns:b}),u=()=>{const o=t.useAPIClient(),{data:r}=t.useRequest(()=>o.resource("ipFilter").get().then(i=>{var m;return(m=i.data)==null?void 0:m.data}));return{form:l.createForm({values:r})}},v=()=>{const o=l.useForm(),{message:r}=a.App.useApp(),p=t.useAPIClient(),{t:i}=d();return{run(){return y(this,null,function*(){yield o.submit();try{yield p.request({url:"ipFilter:put",method:"post",data:o.values}),r.success(i("Settings saved successfully"))}catch(x){throw r.error(i("Failed to save settings")),x}})}}},k={type:"object",properties:{ipFilter:{"x-component":"FormV2","x-use-component-props":"useIPFilterValues",type:"void",title:e("IP Filter Settings"),properties:{allowFirst:{type:"boolean",title:e("Filter Mode"),default:!0,description:e("Choose how to apply white and black lists"),"x-decorator":"FormItem","x-component":"Radio.Group",enum:[{label:e("Allow first (whitelist priority)"),value:!0},{label:e("Block first (blacklist priority)"),value:!1}]},allowList:{type:"string",title:e("Allow List (Whitelist)"),"x-decorator":"FormItem","x-component":"Input.TextArea","x-component-props":{rows:6,placeholder:`127.0.0.1
+(function(s,t){typeof exports=="object"&&typeof module!="undefined"?t(exports,require("@tachybase/client"),require("react/jsx-runtime"),require("@tachybase/schema"),require("antd")):typeof define=="function"&&define.amd?define(["exports","@tachybase/client","react/jsx-runtime","@tachybase/schema","antd"],t):(s=typeof globalThis!="undefined"?globalThis:s||self,t(s["@tachybase/plugin-password-policy"]={},s["@tachybase/client"],s.jsxRuntime,s["@tachybase/schema"],s.antd))})(this,function(s,t,n,l,d){"use strict";var W=Object.defineProperty;var g=Object.getOwnPropertySymbols;var G=Object.prototype.hasOwnProperty,H=Object.prototype.propertyIsEnumerable;var f=(s,t,n)=>t in s?W(s,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):s[t]=n,h=(s,t)=>{for(var n in t||(t={}))G.call(t,n)&&f(s,n,t[n]);if(g)for(var n of g(t))H.call(t,n)&&f(s,n,t[n]);return s};var y=(s,t,n)=>new Promise((l,d)=>{var b=p=>{try{x(n.next(p))}catch(e){d(e)}},m=p=>{try{x(n.throw(p))}catch(e){d(e)}},x=p=>p.done?l(p.value):Promise.resolve(p.value).then(b,m);x((n=n.apply(s,t)).next())});const b="password-policy";var m=(o=>(o[o.None=0]="None",o[o.NumberAndLetter=1]="NumberAndLetter",o[o.NumberAndLetterAndSymbol=2]="NumberAndLetterAndSymbol",o[o.NumberAndLetterAndUpperAndLower=3]="NumberAndLetterAndUpperAndLower",o[o.NumberAndLetterAndUpperAndLowerAndSymbol=4]="NumberAndLetterAndUpperAndLowerAndSymbol",o[o.NumberAndLetterAndUpperAndLowerAndSymbol3=5]="NumberAndLetterAndUpperAndLowerAndSymbol3",o))(m||{});const x="passwordPolicy";function p(){return{t:(r,a={})=>t.i18n.t(r,h({ns:b},a))}}const e=o=>t.tval(o,{ns:b}),v=()=>{const o=t.useAPIClient(),{data:r}=t.useRequest(()=>o.resource("ipFilter").get().then(i=>{var c;return(c=i.data)==null?void 0:c.data}));return{form:l.createForm({values:r})}},w=()=>{const o=l.useForm(),{message:r}=d.App.useApp(),a=t.useAPIClient(),{t:i}=p();return{run(){return y(this,null,function*(){yield o.submit();try{yield a.request({url:"ipFilter:put",method:"post",data:o.values}),r.success(i("Settings saved successfully"))}catch(u){throw r.error(i("Failed to save settings")),u}})}}},P={type:"object",properties:{ipFilter:{"x-component":"FormV2","x-use-component-props":"useIPFilterValues",type:"void",title:e("IP Filter Settings"),properties:{allowFirst:{type:"boolean",title:e("Filter Mode"),default:!0,description:e("Choose how to apply white and black lists"),"x-decorator":"FormItem","x-component":"Radio.Group",enum:[{label:e("Allow first (whitelist priority)"),value:!0},{label:e("Block first (blacklist priority)"),value:!1}]},allowList:{type:"string",title:e("Allow List (Whitelist)"),"x-decorator":"FormItem","x-component":"Input.TextArea","x-component-props":{rows:6,placeholder:`127.0.0.1
 192.168.0.0/16
 10.0.0.0/8`},description:e("One IP or CIDR per line. Example: 192.168.1.0/24 or 10.0.0.1")},blockList:{type:"string",title:e("Block List (Blacklist)"),"x-decorator":"FormItem","x-component":"Input.TextArea","x-component-props":{rows:6,placeholder:`1.2.3.4
-5.6.0.0/16`},description:e("One IP or CIDR per line. Example: 1.2.3.4 or 5.6.7.0/24")},footer:{type:"void","x-component":"ActionBar",properties:{submit:{title:e("Save"),"x-component":"Action","x-component-props":{type:"primary",useAction:"{{ useSaveIPFilterValues }}"}}}}}}}},w=()=>n.jsx(a.Card,{bordered:!1,children:n.jsx(t.SchemaComponent,{schema:k,scope:{useIPFilterValues:u,useSaveIPFilterValues:v}})}),C=()=>{const o=t.useAPIClient(),{data:r}=t.useRequest(()=>o.resource("passwordAttempt").get().then(i=>{var m;return(m=i.data)==null?void 0:m.data}));return{form:l.createForm({values:r})}},S=()=>{const o=l.useForm(),{message:r}=a.App.useApp(),p=t.useAPIClient(),{t:i}=d();return{run(){return y(this,null,function*(){yield o.submit();try{yield p.request({url:"passwordAttempt:put",method:"post",data:o.values}),r.success(i("Saved successfully"))}catch(x){throw r.error(i("Failed to save settings")),x}})}}},F={type:"object",properties:{passwordAttempt:{"x-component":"FormV2","x-use-component-props":"usePasswordPolicyValues",type:"void",title:e("Password policy"),properties:{maxAttempts:{type:"digit",title:e("Max invalid password sign-in attempts"),description:e("Default value is 5. Set to 0 to disable."),"x-decorator":"FormItem","x-component":"InputNumber","x-validator":{required:!0},"x-component-props":{min:0}},windowSeconds:{type:"digit",title:e("Max invalid password sign-in attempts interval (seconds)"),description:e("Default value is 300 seconds (5 minutes)."),"x-decorator":"FormItem","x-component":"InputNumber","x-validator":{required:!0},"x-component-props":{min:1}},lockSeconds:{type:"digit",title:e("Lockout duration (seconds)"),description:e("Default value is 1800 seconds (30 minutes)."),"x-decorator":"FormItem","x-component":"InputNumber","x-validator":{required:!0},"x-component-props":{min:1}},strictLock:{type:"boolean",title:e("Can not access any api after locked"),description:e("Default value is off."),"x-decorator":"FormItem","x-component":"Checkbox"},footer:{type:"void","x-component":"ActionBar",properties:{submit:{title:'{{t("Submit")}}',"x-component":"Action","x-component-props":{type:"primary",useAction:"{{ useSavePasswordPolicyValues }}"}}}}}}}},P=()=>n.jsx(a.Card,{bordered:!1,children:n.jsx(t.SchemaComponent,{schema:F,scope:{usePasswordPolicyValues:C,useSavePasswordPolicyValues:S}})}),I=()=>{const o=t.useAPIClient(),{data:r}=t.useRequest(()=>o.resource("passwordStrengthConfig").get().then(i=>{var m;return(m=i.data)==null?void 0:m.data}));return{form:l.createForm({values:r})}},L=()=>{const o=l.useForm(),{message:r}=a.App.useApp(),p=t.useAPIClient(),{t:i}=d();return{run(){return y(this,null,function*(){yield o.submit();try{yield p.request({url:"passwordStrengthConfig:put",method:"post",data:o.values}),r.success(i("Saved successfully"))}catch(x){throw r.error(i("Failed to save settings")),x}})}}},T={type:"object",properties:{passwordStrength:{"x-component":"FormV2","x-use-component-props":"usePasswordStrengthValues",type:"void",title:e("Password Strength Settings"),properties:{minLength:{type:"number",title:e("Minimum Password Length"),"x-decorator":"FormItem","x-component":"InputNumber",default:0},strengthLevel:{type:"number",title:e("Password Strength Requirements"),"x-decorator":"FormItem","x-component":"Select",enum:[{label:e("No restrictions"),value:c.None},{label:e("Must contain letters and numbers"),value:c.NumberAndLetter},{label:e("Must contain letters, numbers, and symbols"),value:c.NumberAndLetterAndSymbol},{label:e("Must contain numbers, uppercase and lowercase letters"),value:c.NumberAndLetterAndUpperAndLower},{label:e("Must contain numbers, uppercase and lowercase letters, and symbols"),value:c.NumberAndLetterAndUpperAndLowerAndSymbol},{label:e("Must contain at least 3 of the following: numbers, uppercase letters, lowercase letters, and symbols"),value:c.NumberAndLetterAndUpperAndLowerAndSymbol3}],default:0},notContainUsername:{type:"boolean",title:e("Password cannot contain username"),"x-decorator":"FormItem","x-component":"Checkbox",default:!1},historyCount:{type:"number",title:e("Remember password history (0-24)"),description:e("Number of previous passwords to remember. 0 means no restriction."),"x-decorator":"FormItem","x-component":"InputNumber","x-component-props":{min:0,max:24},default:0},footer:{type:"void","x-component":"ActionBar",properties:{submit:{title:'{{t("Submit")}}',"x-component":"Action","x-component-props":{type:"primary",useAction:"{{ useSavePasswordStrengthValues }}"}}}}}}}},V=()=>n.jsx(a.Card,{bordered:!1,children:n.jsx(t.SchemaComponent,{schema:T,scope:{usePasswordStrengthValues:I,useSavePasswordStrengthValues:L}})}),N={name:"signInFails",fields:[{type:"string",name:"username",interface:"input",uiSchema:{type:"string",title:'{{ t("Username") }}',"x-read-pretty":!0,"x-component"(){var r;return(r=t.useRecord().user)==null?void 0:r.username}}},{type:"string",name:"nickname",interface:"input",uiSchema:{type:"string",title:'{{ t("Nickname") }}',"x-read-pretty":!0,"x-component"(){var r;return(r=t.useRecord().user)==null?void 0:r.nickname}}},{type:"string",name:"ip",interface:"input",uiSchema:{type:"string",title:"IP","x-read-pretty":!0}},{type:"string",name:"address",interface:"input",uiSchema:{type:"string",title:e("Location"),"x-read-pretty":!0}},{type:"datetime",name:"createdAt",interface:"datetime",uiSchema:{type:"string",title:e("Time"),"x-component":"DatePicker","x-component-props":{showTime:!0},"x-read-pretty":!0}},{name:"user",type:"belongsTo",target:"users",targetKey:"id",foreignKey:"userId",interface:"m2o",uiSchema:{type:"object",title:'{{t("User")}}',"x-component":"AssociationField","x-component-props":{fieldNames:{value:"id",label:"nickname"}},"x-read-pretty":!0}}]},D={type:"void",properties:{signInFails:{type:"void","x-decorator":"TableBlockProvider","x-acl-action":"signInFails:list","x-use-decorator-props":"useTableBlockDecoratorProps","x-decorator-props":{dataSource:"main",collection:"signInFails",action:"list",params:{pageSize:20,appends:["user"]},rowKey:"id",showIndex:!0,dragSort:!1},"x-component":"CardItem",properties:{actions:{type:"void","x-component":"ActionBar","x-component-props":{style:{marginBottom:"var(--tb-spacing)"}},properties:{filter:{type:"void",title:'{{ t("Filter") }}',"x-action":"filter","x-component":"Filter.Action","x-use-component-props":"useFilterActionProps","x-component-props":{icon:"FilterOutlined"},"x-align":"left"},refresh:{type:"void",title:'{{ t("Refresh") }}',"x-action":"refresh","x-component":"Action","x-settings":"actionSettings:refresh","x-component-props":{icon:"ReloadOutlined"},"x-use-component-props":"useRefreshActionProps","x-align":"right"}}},table:{type:"array","x-component":"TableV2","x-use-component-props":"useTableBlockProps","x-component-props":{rowKey:"id",rowSelection:{type:"checkbox"}},properties:{username:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{username:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},nickname:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{nickname:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},ip:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"CollectionField",properties:{ip:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},address:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"CollectionField",properties:{address:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},createdAt:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"CollectionField",properties:{createdAt:{type:"datetime","x-component":"CollectionField","x-read-pretty":!0}}}}}}}}},B=()=>n.jsx(t.ExtendCollectionsProvider,{collections:[N],children:n.jsx(t.SchemaComponent,{schema:D})}),U={name:"userLocks",fields:[{type:"string",name:"username",interface:"input",uiSchema:{type:"string",title:'{{ t("Username") }}',"x-read-pretty":!0,"x-component"(){var r;return(r=t.useRecord().user)==null?void 0:r.username}}},{type:"string",name:"nickname",interface:"input",uiSchema:{type:"string",title:'{{ t("Nickname") }}',"x-read-pretty":!0,"x-component"(){var r;return(r=t.useRecord().user)==null?void 0:r.nickname}}},{type:"datetime",name:"updatedAt",interface:"datetime",uiSchema:{type:"string",title:e("Updated At"),"x-component":"DatePicker","x-component-props":{showTime:!0},"x-read-pretty":!0}},{type:"datetime",name:"expireAt",interface:"datetime",uiSchema:{type:"string",title:e("Lock Expires At"),"x-component":"DatePicker","x-component-props":{showTime:!0},"x-read-pretty":!0}},{name:"user",type:"belongsTo",target:"users",targetKey:"id",foreignKey:"userId",interface:"m2o",uiSchema:{type:"object",title:'{{t("User")}}',"x-component":"AssociationField","x-component-props":{fieldNames:{value:"id",label:"nickname"}},"x-read-pretty":!0}}]},M={type:"void","x-acl-action-props":{skipScopeCheck:!0},"x-acl-action":"userLocks:create","x-decorator":"FormBlockProvider","x-use-decorator-props":"useCreateFormBlockDecoratorProps","x-decorator-props":{dataSource:"main",collection:"userLocks"},"x-component":"CardItem",properties:{form:{type:"void","x-component":"FormV2","x-use-component-props":"useCreateFormBlockProps",properties:{actionBar:{type:"void","x-component":"ActionBar","x-component-props":{style:{marginBottom:"var(--tb-spacing)"}},properties:{submit:{title:'{{t("Submit")}}',"x-action":"submit","x-component":"Action","x-use-component-props":"useCreateActionProps","x-component-props":{type:"primary",htmlType:"submit"},type:"void"}}},userId:{type:"string",title:e("Username or Email"),required:!0,"x-component":"RemoteSelect","x-decorator":"FormItem","x-component-props":{placeholder:e("Please enter username, nickname or email"),fieldNames:{label:"nickname",value:"id"},service:{resource:"users",action:"list",params:{filter:{$or:[{lock:{id:{$notExists:!0}}},{lock:{expireAt:{$lt:"{{ new Date() }}"}}}]},pageSize:20,sort:["-id"],appends:["lock"]}},manual:!1}},expireAt:{type:"string",title:e("Lock Until"),required:!0,"x-component":"DatePicker","x-decorator":"FormItem","x-component-props":{showTime:!0,disabledDate:"{{ (current) => current && current < new Date() }}",placeholder:e("Please select lock expiration time")}}}}}},q={type:"void","x-action":"create","x-acl-action":"create",title:e("Lock New User"),"x-component":"Action","x-decorator":"ACLActionProvider","x-component-props":{openMode:"drawer",type:"primary",icon:"PlusOutlined"},"x-align":"right","x-acl-action-props":{skipScopeCheck:!0},properties:{drawer:{type:"void",title:e("Lock New User"),"x-component":"Action.Container","x-component-props":{className:"tb-action-popup"},properties:{form:M}}}},E={type:"void",title:'{{ t("Edit") }}',"x-action":"update","x-component":"Action.Link","x-component-props":{openMode:"drawer",icon:"EditOutlined"},"x-decorator":"ACLActionProvider",properties:{drawer:{type:"void",title:'{{ t("Edit") }}',"x-component":"Action.Container","x-component-props":{className:"tb-action-popup"},properties:{form:{type:"void","x-acl-action-props":{skipScopeCheck:!1},"x-decorator":"FormBlockProvider","x-use-decorator-props":"useEditFormBlockDecoratorProps","x-decorator-props":{dataSource:"main",collection:"userLocks",action:"get",useParams:"{{ useParamsFromRecord }}",params:{appends:["user"]}},"x-component":"CardItem",properties:{form:{type:"void","x-component":"FormV2","x-use-component-props":"useEditFormBlockProps",properties:{actionBar:{type:"void","x-component":"ActionBar","x-component-props":{style:{marginBottom:"var(--tb-spacing)"}},properties:{submit:{title:'{{t("Submit")}}',"x-action":"submit","x-component":"Action","x-use-component-props":"useUpdateActionProps","x-component-props":{type:"primary",htmlType:"submit"},"x-action-settings":{triggerWorkflows:[],onSuccess:{manualClose:!1,redirecting:!1,successMessage:'{{t("Updated successfully")}}'},skipValidator:!1},type:"void"}}},expireAt:{type:"date",title:e("Lock Until"),required:!0,"x-component":"DatePicker","x-component-props":{showTime:!0,disabledDate:"{{ (current) => current && current < new Date() }}",placeholder:e("Please select lock expiration time")},"x-decorator":"FormItem"}}}}}}}}},O={type:"void",properties:{userLocks:{type:"void","x-decorator":"TableBlockProvider","x-acl-action":"userLocks:list","x-use-decorator-props":"useTableBlockDecoratorProps","x-decorator-props":{dataSource:"main",collection:"userLocks",action:"list",params:{pageSize:20,appends:["user"]},rowKey:"id",showIndex:!0,dragSort:!1},"x-component":"CardItem",properties:{actions:{type:"void","x-component":"ActionBar","x-component-props":{style:{marginBottom:"var(--tb-spacing)"}},properties:{filter:{type:"void",title:'{{ t("Filter") }}',"x-action":"filter","x-component":"Filter.Action","x-use-component-props":"useFilterActionProps","x-component-props":{icon:"FilterOutlined"},"x-align":"left"},refresh:{type:"void",title:'{{ t("Refresh") }}',"x-action":"refresh","x-component":"Action","x-settings":"actionSettings:refresh","x-component-props":{icon:"ReloadOutlined"},"x-use-component-props":"useRefreshActionProps","x-align":"right"},create:q}},table:{type:"array","x-component":"TableV2","x-use-component-props":"useTableBlockProps","x-component-props":{rowKey:"id",rowSelection:{type:"checkbox"}},properties:{username:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{username:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},nickname:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{nickname:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},updatedAt:{type:"void",title:e("Updated At"),"x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{updatedAt:{"x-collection-field":"userLocks.updatedAt","x-component":"CollectionField","x-component-props":{ellipsis:!0,showTime:!0},"x-read-pretty":!0,"x-decorator":null}}},expireAt:{type:"void",title:e("Lock Expires At"),"x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{expireAt:{"x-collection-field":"userLocks.expireAt","x-component":"CollectionField","x-component-props":{ellipsis:!0,showTime:!0},"x-read-pretty":!0,"x-decorator":null}}},actions:{type:"void",title:'{{ t("Actions") }}',"x-action-column":"actions","x-decorator":"TableV2.Column.ActionBar","x-component":"TableV2.Column","x-component-props":{width:200,fixed:"right"},properties:{actions:{type:"void","x-component":"Space","x-component-props":{split:"|"},properties:{edit:E,destroy:{type:"void",title:e("Unlock"),"x-action":"destroy","x-component":"Action.Link","x-component-props":{danger:!0,confirm:{title:e("Unlock User"),content:e("Are you sure you want to unlock this user?")}},"x-decorator":"ACLActionProvider","x-use-component-props":"useDestroyActionProps"}}}}}}}}}}},R=()=>n.jsx(t.ExtendCollectionsProvider,{collections:[U],children:n.jsx(t.SchemaComponent,{schema:O})});class A extends t.Plugin{load(){return y(this,null,function*(){this.app.systemSettingsManager.add("security.password-attempt",{icon:"SettingOutlined",title:e("Password policy"),Component:P,aclSnippet:"pm.security.password-attempt"}),this.app.systemSettingsManager.add("security.user-lock",{icon:"UserOutlined",title:e("User lock"),Component:R,aclSnippet:"pm.security.user-lock"}),this.app.systemSettingsManager.add("security.ip-filter",{icon:"GlobalOutlined",title:e("IP policy"),Component:w,aclSnippet:"pm.security.ip-filter"}),this.app.systemSettingsManager.add("security.password-strength",{icon:"LockOutlined",title:e("Password strength"),Component:V,aclSnippet:"pm.security.password-strength"}),this.app.systemSettingsManager.add("security.sign-in-fails",{icon:"HistoryOutlined",title:e("Sign-in fails history"),Component:B,aclSnippet:"pm.security.sign-in-fails"})})}}s.PasswordPolicyClient=A,s.default=A,Object.defineProperties(s,{__esModule:{value:!0},[Symbol.toStringTag]:{value:"Module"}})});
+5.6.0.0/16`},description:e("One IP or CIDR per line. Example: 1.2.3.4 or 5.6.7.0/24")},footer:{type:"void","x-component":"ActionBar",properties:{submit:{title:e("Save"),"x-component":"Action","x-component-props":{type:"primary",useAction:"{{ useSaveIPFilterValues }}"}}}}}}}},S=()=>n.jsx(d.Card,{bordered:!1,children:n.jsx(t.SchemaComponent,{schema:P,scope:{useIPFilterValues:v,useSaveIPFilterValues:w}})}),C=()=>{const o=t.useAPIClient(),{data:r}=t.useRequest(()=>o.resource(x).get().then(i=>{var c;return(c=i.data)==null?void 0:c.data}));return{form:l.createForm({values:r})}},k=()=>{const o=l.useForm(),{message:r}=d.App.useApp(),a=t.useAPIClient(),{t:i}=t.useTranslation();return{run(){return y(this,null,function*(){yield o.submit();try{yield a.request({url:`${x}:set`,method:"post",data:o.values}),r.success(i("Saved successfully"))}catch(u){throw r.error(i("Failed to save settings")),u}})}}},F=()=>({type:"object",properties:{passwordValidityPeriod:{type:"void",title:e("Password validity period"),"x-decorator":"CardItem","x-component":"FormV2","x-use-component-props":"usePasswordPolicyValues",properties:{validityPeriod:{type:"number",title:e("Password validity period (days)"),description:e("Default value is never."),"x-decorator":"FormItem","x-component":"Select","x-component-props":{defaultValue:0,options:[{label:"30",value:30},{label:"60",value:60},{label:"90",value:90},{label:"180",value:180},{label:"365",value:365},{label:e("Never expire"),value:0}]}},footer:{type:"void","x-component":"ActionBar",properties:{submit:{title:'{{t("Submit")}}',"x-component":"Action","x-component-props":{type:"primary",useAction:"{{ useSavePasswordPolicyValues }}"}}}}}}}}),I=()=>{const o=F();return n.jsx(t.SchemaComponent,{schema:o,scope:{usePasswordPolicyValues:C,useSavePasswordPolicyValues:k}})},L=()=>{const o=t.useAPIClient(),{data:r}=t.useRequest(()=>o.resource("passwordAttempt").get().then(i=>{var c;return(c=i.data)==null?void 0:c.data}));return{form:l.createForm({values:r})}},V=()=>{const o=l.useForm(),{message:r}=d.App.useApp(),a=t.useAPIClient(),{t:i}=p();return{run(){return y(this,null,function*(){yield o.submit();try{yield a.request({url:"passwordAttempt:put",method:"post",data:o.values}),r.success(i("Saved successfully"))}catch(u){throw r.error(i("Failed to save settings")),u}})}}},T={type:"object",properties:{passwordAttempt:{"x-component":"FormV2","x-use-component-props":"usePasswordPolicyValues",type:"void",title:e("Password policy"),properties:{maxAttempts:{type:"digit",title:e("Max invalid password sign-in attempts"),description:e("Default value is 5. Set to 0 to disable."),"x-decorator":"FormItem","x-component":"InputNumber","x-validator":{required:!0},"x-component-props":{min:0}},windowSeconds:{type:"digit",title:e("Max invalid password sign-in attempts interval (seconds)"),description:e("Default value is 300 seconds (5 minutes)."),"x-decorator":"FormItem","x-component":"InputNumber","x-validator":{required:!0},"x-component-props":{min:1}},lockSeconds:{type:"digit",title:e("Lockout duration (seconds)"),description:e("Default value is 1800 seconds (30 minutes)."),"x-decorator":"FormItem","x-component":"InputNumber","x-validator":{required:!0},"x-component-props":{min:1}},strictLock:{type:"boolean",title:e("Can not access any api after locked"),description:e("Default value is off."),"x-decorator":"FormItem","x-component":"Checkbox"},footer:{type:"void","x-component":"ActionBar",properties:{submit:{title:'{{t("Submit")}}',"x-component":"Action","x-component-props":{type:"primary",useAction:"{{ useSavePasswordPolicyValues }}"}}}}}}}},N=()=>n.jsx(d.Card,{bordered:!1,children:n.jsx(t.SchemaComponent,{schema:T,scope:{usePasswordPolicyValues:L,useSavePasswordPolicyValues:V}})}),D=()=>{const o=t.useAPIClient(),{data:r}=t.useRequest(()=>o.resource("passwordStrengthConfig").get().then(i=>{var c;return(c=i.data)==null?void 0:c.data}));return{form:l.createForm({values:r})}},B=()=>{const o=l.useForm(),{message:r}=d.App.useApp(),a=t.useAPIClient(),{t:i}=p();return{run(){return y(this,null,function*(){yield o.submit();try{yield a.request({url:"passwordStrengthConfig:put",method:"post",data:o.values}),r.success(i("Saved successfully"))}catch(u){throw r.error(i("Failed to save settings")),u}})}}},U={type:"object",properties:{passwordStrength:{"x-component":"FormV2","x-use-component-props":"usePasswordStrengthValues",type:"void",title:e("Password Strength Settings"),properties:{minLength:{type:"number",title:e("Minimum Password Length"),"x-decorator":"FormItem","x-component":"InputNumber",default:0},strengthLevel:{type:"number",title:e("Password Strength Requirements"),"x-decorator":"FormItem","x-component":"Select",enum:[{label:e("No restrictions"),value:m.None},{label:e("Must contain letters and numbers"),value:m.NumberAndLetter},{label:e("Must contain letters, numbers, and symbols"),value:m.NumberAndLetterAndSymbol},{label:e("Must contain numbers, uppercase and lowercase letters"),value:m.NumberAndLetterAndUpperAndLower},{label:e("Must contain numbers, uppercase and lowercase letters, and symbols"),value:m.NumberAndLetterAndUpperAndLowerAndSymbol},{label:e("Must contain at least 3 of the following: numbers, uppercase letters, lowercase letters, and symbols"),value:m.NumberAndLetterAndUpperAndLowerAndSymbol3}],default:0},notContainUsername:{type:"boolean",title:e("Password cannot contain username"),"x-decorator":"FormItem","x-component":"Checkbox",default:!1},historyCount:{type:"number",title:e("Remember password history (0-24)"),description:e("Number of previous passwords to remember. 0 means no restriction."),"x-decorator":"FormItem","x-component":"InputNumber","x-component-props":{min:0,max:24},default:0},footer:{type:"void","x-component":"ActionBar",properties:{submit:{title:'{{t("Submit")}}',"x-component":"Action","x-component-props":{type:"primary",useAction:"{{ useSavePasswordStrengthValues }}"}}}}}}}},M=()=>n.jsx(d.Card,{bordered:!1,children:n.jsx(t.SchemaComponent,{schema:U,scope:{usePasswordStrengthValues:D,useSavePasswordStrengthValues:B}})}),q={name:"signInFails",fields:[{type:"string",name:"username",interface:"input",uiSchema:{type:"string",title:'{{ t("Username") }}',"x-read-pretty":!0,"x-component"(){var r;return(r=t.useRecord().user)==null?void 0:r.username}}},{type:"string",name:"nickname",interface:"input",uiSchema:{type:"string",title:'{{ t("Nickname") }}',"x-read-pretty":!0,"x-component"(){var r;return(r=t.useRecord().user)==null?void 0:r.nickname}}},{type:"string",name:"ip",interface:"input",uiSchema:{type:"string",title:"IP","x-read-pretty":!0}},{type:"string",name:"address",interface:"input",uiSchema:{type:"string",title:e("Location"),"x-read-pretty":!0}},{type:"datetime",name:"createdAt",interface:"datetime",uiSchema:{type:"string",title:e("Time"),"x-component":"DatePicker","x-component-props":{showTime:!0},"x-read-pretty":!0}},{name:"user",type:"belongsTo",target:"users",targetKey:"id",foreignKey:"userId",interface:"m2o",uiSchema:{type:"object",title:'{{t("User")}}',"x-component":"AssociationField","x-component-props":{fieldNames:{value:"id",label:"nickname"}},"x-read-pretty":!0}}]},O={type:"void",properties:{signInFails:{type:"void","x-decorator":"TableBlockProvider","x-acl-action":"signInFails:list","x-use-decorator-props":"useTableBlockDecoratorProps","x-decorator-props":{dataSource:"main",collection:"signInFails",action:"list",params:{pageSize:20,appends:["user"]},rowKey:"id",showIndex:!0,dragSort:!1},"x-component":"CardItem",properties:{actions:{type:"void","x-component":"ActionBar","x-component-props":{style:{marginBottom:"var(--tb-spacing)"}},properties:{filter:{type:"void",title:'{{ t("Filter") }}',"x-action":"filter","x-component":"Filter.Action","x-use-component-props":"useFilterActionProps","x-component-props":{icon:"FilterOutlined"},"x-align":"left"},refresh:{type:"void",title:'{{ t("Refresh") }}',"x-action":"refresh","x-component":"Action","x-settings":"actionSettings:refresh","x-component-props":{icon:"ReloadOutlined"},"x-use-component-props":"useRefreshActionProps","x-align":"right"}}},table:{type:"array","x-component":"TableV2","x-use-component-props":"useTableBlockProps","x-component-props":{rowKey:"id",rowSelection:{type:"checkbox"}},properties:{username:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{username:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},nickname:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{nickname:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},ip:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"CollectionField",properties:{ip:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},address:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"CollectionField",properties:{address:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},createdAt:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"CollectionField",properties:{createdAt:{type:"datetime","x-component":"CollectionField","x-read-pretty":!0}}}}}}}}},E=()=>n.jsx(t.ExtendCollectionsProvider,{collections:[q],children:n.jsx(t.SchemaComponent,{schema:O})}),R={name:"userLocks",fields:[{type:"string",name:"username",interface:"input",uiSchema:{type:"string",title:'{{ t("Username") }}',"x-read-pretty":!0,"x-component"(){var r;return(r=t.useRecord().user)==null?void 0:r.username}}},{type:"string",name:"nickname",interface:"input",uiSchema:{type:"string",title:'{{ t("Nickname") }}',"x-read-pretty":!0,"x-component"(){var r;return(r=t.useRecord().user)==null?void 0:r.nickname}}},{type:"datetime",name:"updatedAt",interface:"datetime",uiSchema:{type:"string",title:e("Updated At"),"x-component":"DatePicker","x-component-props":{showTime:!0},"x-read-pretty":!0}},{type:"datetime",name:"expireAt",interface:"datetime",uiSchema:{type:"string",title:e("Lock Expires At"),"x-component":"DatePicker","x-component-props":{showTime:!0},"x-read-pretty":!0}},{name:"user",type:"belongsTo",target:"users",targetKey:"id",foreignKey:"userId",interface:"m2o",uiSchema:{type:"object",title:'{{t("User")}}',"x-component":"AssociationField","x-component-props":{fieldNames:{value:"id",label:"nickname"}},"x-read-pretty":!0}}]},j={type:"void","x-acl-action-props":{skipScopeCheck:!0},"x-acl-action":"userLocks:create","x-decorator":"FormBlockProvider","x-use-decorator-props":"useCreateFormBlockDecoratorProps","x-decorator-props":{dataSource:"main",collection:"userLocks"},"x-component":"CardItem",properties:{form:{type:"void","x-component":"FormV2","x-use-component-props":"useCreateFormBlockProps",properties:{actionBar:{type:"void","x-component":"ActionBar","x-component-props":{style:{marginBottom:"var(--tb-spacing)"}},properties:{submit:{title:'{{t("Submit")}}',"x-action":"submit","x-component":"Action","x-use-component-props":"useCreateActionProps","x-component-props":{type:"primary",htmlType:"submit"},type:"void"}}},userId:{type:"string",title:e("Username or Email"),required:!0,"x-component":"RemoteSelect","x-decorator":"FormItem","x-component-props":{placeholder:e("Please enter username, nickname or email"),fieldNames:{label:"nickname",value:"id"},service:{resource:"users",action:"list",params:{filter:{$or:[{lock:{id:{$notExists:!0}}},{lock:{expireAt:{$lt:"{{ new Date() }}"}}}]},pageSize:20,sort:["-id"],appends:["lock"]}},manual:!1}},expireAt:{type:"string",title:e("Lock Until"),required:!0,"x-component":"DatePicker","x-decorator":"FormItem","x-component-props":{showTime:!0,disabledDate:"{{ (current) => current && current < new Date() }}",placeholder:e("Please select lock expiration time")}}}}}},K={type:"void","x-action":"create","x-acl-action":"create",title:e("Lock New User"),"x-component":"Action","x-decorator":"ACLActionProvider","x-component-props":{openMode:"drawer",type:"primary",icon:"PlusOutlined"},"x-align":"right","x-acl-action-props":{skipScopeCheck:!0},properties:{drawer:{type:"void",title:e("Lock New User"),"x-component":"Action.Container","x-component-props":{className:"tb-action-popup"},properties:{form:j}}}},$={type:"void",title:'{{ t("Edit") }}',"x-action":"update","x-component":"Action.Link","x-component-props":{openMode:"drawer",icon:"EditOutlined"},"x-decorator":"ACLActionProvider",properties:{drawer:{type:"void",title:'{{ t("Edit") }}',"x-component":"Action.Container","x-component-props":{className:"tb-action-popup"},properties:{form:{type:"void","x-acl-action-props":{skipScopeCheck:!1},"x-decorator":"FormBlockProvider","x-use-decorator-props":"useEditFormBlockDecoratorProps","x-decorator-props":{dataSource:"main",collection:"userLocks",action:"get",useParams:"{{ useParamsFromRecord }}",params:{appends:["user"]}},"x-component":"CardItem",properties:{form:{type:"void","x-component":"FormV2","x-use-component-props":"useEditFormBlockProps",properties:{actionBar:{type:"void","x-component":"ActionBar","x-component-props":{style:{marginBottom:"var(--tb-spacing)"}},properties:{submit:{title:'{{t("Submit")}}',"x-action":"submit","x-component":"Action","x-use-component-props":"useUpdateActionProps","x-component-props":{type:"primary",htmlType:"submit"},"x-action-settings":{triggerWorkflows:[],onSuccess:{manualClose:!1,redirecting:!1,successMessage:'{{t("Updated successfully")}}'},skipValidator:!1},type:"void"}}},expireAt:{type:"date",title:e("Lock Until"),required:!0,"x-component":"DatePicker","x-component-props":{showTime:!0,disabledDate:"{{ (current) => current && current < new Date() }}",placeholder:e("Please select lock expiration time")},"x-decorator":"FormItem"}}}}}}}}},_={type:"void",properties:{userLocks:{type:"void","x-decorator":"TableBlockProvider","x-acl-action":"userLocks:list","x-use-decorator-props":"useTableBlockDecoratorProps","x-decorator-props":{dataSource:"main",collection:"userLocks",action:"list",params:{pageSize:20,appends:["user"]},rowKey:"id",showIndex:!0,dragSort:!1},"x-component":"CardItem",properties:{actions:{type:"void","x-component":"ActionBar","x-component-props":{style:{marginBottom:"var(--tb-spacing)"}},properties:{filter:{type:"void",title:'{{ t("Filter") }}',"x-action":"filter","x-component":"Filter.Action","x-use-component-props":"useFilterActionProps","x-component-props":{icon:"FilterOutlined"},"x-align":"left"},refresh:{type:"void",title:'{{ t("Refresh") }}',"x-action":"refresh","x-component":"Action","x-settings":"actionSettings:refresh","x-component-props":{icon:"ReloadOutlined"},"x-use-component-props":"useRefreshActionProps","x-align":"right"},create:K}},table:{type:"array","x-component":"TableV2","x-use-component-props":"useTableBlockProps","x-component-props":{rowKey:"id",rowSelection:{type:"checkbox"}},properties:{username:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{username:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},nickname:{type:"void","x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{nickname:{type:"string","x-component":"CollectionField","x-read-pretty":!0}}},updatedAt:{type:"void",title:e("Updated At"),"x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{updatedAt:{"x-collection-field":"userLocks.updatedAt","x-component":"CollectionField","x-component-props":{ellipsis:!0,showTime:!0},"x-read-pretty":!0,"x-decorator":null}}},expireAt:{type:"void",title:e("Lock Expires At"),"x-decorator":"TableV2.Column.Decorator","x-component":"TableV2.Column",properties:{expireAt:{"x-collection-field":"userLocks.expireAt","x-component":"CollectionField","x-component-props":{ellipsis:!0,showTime:!0},"x-read-pretty":!0,"x-decorator":null}}},actions:{type:"void",title:'{{ t("Actions") }}',"x-action-column":"actions","x-decorator":"TableV2.Column.ActionBar","x-component":"TableV2.Column","x-component-props":{width:200,fixed:"right"},properties:{actions:{type:"void","x-component":"Space","x-component-props":{split:"|"},properties:{edit:$,destroy:{type:"void",title:e("Unlock"),"x-action":"destroy","x-component":"Action.Link","x-component-props":{danger:!0,confirm:{title:e("Unlock User"),content:e("Are you sure you want to unlock this user?")}},"x-decorator":"ACLActionProvider","x-use-component-props":"useDestroyActionProps"}}}}}}}}}}},z=()=>n.jsx(t.ExtendCollectionsProvider,{collections:[R],children:n.jsx(t.SchemaComponent,{schema:_})});class A extends t.Plugin{load(){return y(this,null,function*(){this.app.systemSettingsManager.add("security.password-attempt",{icon:"SettingOutlined",title:e("Password policy"),Component:N,aclSnippet:"pm.security.password-attempt"}),this.app.systemSettingsManager.add("security.user-lock",{icon:"UserOutlined",title:e("User lock"),Component:z,aclSnippet:"pm.security.user-lock"}),this.app.systemSettingsManager.add("security.ip-filter",{icon:"GlobalOutlined",title:e("IP policy"),Component:S,aclSnippet:"pm.security.ip-filter"}),this.app.systemSettingsManager.add("security.password-strength",{icon:"LockOutlined",title:e("Password strength"),Component:M,aclSnippet:"pm.security.password-strength"}),this.app.systemSettingsManager.add("security.sign-in-fails",{icon:"HistoryOutlined",title:e("Sign-in fails history"),Component:E,aclSnippet:"pm.security.sign-in-fails"}),this.app.systemSettingsManager.add("security.password-validity-period",{icon:"LockOutlined",title:e("Password validity period"),Component:I,aclSnippet:"pm.security.password-validity-period"})})}}s.PasswordPolicyClient=A,s.default=A,Object.defineProperties(s,{__esModule:{value:!0},[Symbol.toStringTag]:{value:"Module"}})});

package/dist/client/password-validity-period/ViewPasswordValidityPeriod.d.ts

@@ -0,0 +1 @@
+export declare const ViewPasswordValidityPeriod: () => import("react/jsx-runtime").JSX.Element;

package/dist/client/password-validity-period/ViewPasswordValidityPeriod.schema.d.ts

@@ -0,0 +1,42 @@
+export declare const getSchemaPasswordValidityPeriod: () => {
+    type: string;
+    properties: {
+        passwordValidityPeriod: {
+            type: string;
+            title: string;
+            'x-decorator': string;
+            'x-component': string;
+            'x-use-component-props': string;
+            properties: {
+                validityPeriod: {
+                    type: string;
+                    title: string;
+                    description: string;
+                    'x-decorator': string;
+                    'x-component': string;
+                    'x-component-props': {
+                        defaultValue: number;
+                        options: {
+                            label: string;
+                            value: number;
+                        }[];
+                    };
+                };
+                footer: {
+                    type: string;
+                    'x-component': string;
+                    properties: {
+                        submit: {
+                            title: string;
+                            'x-component': string;
+                            'x-component-props': {
+                                type: string;
+                                useAction: string;
+                            };
+                        };
+                    };
+                };
+            };
+        };
+    };
+};

package/dist/client/password-validity-period/usePasswordPolicyValues.d.ts

@@ -0,0 +1,3 @@
+export declare const usePasswordPolicyValues: () => {
+    form: import("@tachybase/schema").Form<any>;
+};

package/dist/client/password-validity-period/useSavePasswordPolicyValues.d.ts

@@ -0,0 +1,3 @@
+export declare const useSavePasswordPolicyValues: () => {
+    run(): Promise<void>;
+};

package/dist/constants.d.ts

@@ -9,3 +9,4 @@ export declare enum PasswordStrengthLevel {
 }
 export declare const WINDOW_SECONDS = 300;
 export declare const LOCK_SECONDS = 1800;
+export declare const COLLECTION_PASSWORD_POLICY = "passwordPolicy";

package/dist/constants.js

@@ -17,6 +17,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var constants_exports = {};
 __export(constants_exports, {
+  COLLECTION_PASSWORD_POLICY: () => COLLECTION_PASSWORD_POLICY,
   LOCK_SECONDS: () => LOCK_SECONDS,
   NAMESPACE: () => NAMESPACE,
   PasswordStrengthLevel: () => PasswordStrengthLevel,
@@ -35,8 +36,10 @@ var PasswordStrengthLevel = /* @__PURE__ */ ((PasswordStrengthLevel2) => {
 })(PasswordStrengthLevel || {});
 const WINDOW_SECONDS = 300;
 const LOCK_SECONDS = 1800;
+const COLLECTION_PASSWORD_POLICY = "passwordPolicy";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  COLLECTION_PASSWORD_POLICY,
   LOCK_SECONDS,
   NAMESPACE,
   PasswordStrengthLevel,

package/dist/externalVersion.js

@@ -1,10 +1,10 @@
 module.exports = {
   "react": "18.3.1",
-  "@tachybase/client": "1.2.10",
-  "@tachybase/schema": "1.2.10",
+  "@tachybase/client": "1.2.11",
+  "@tachybase/schema": "1.2.11",
   "antd": "5.22.5",
-  "@tachybase/server": "1.2.10",
-  "@tachybase/actions": "1.2.10",
-  "@tachybase/utils": "1.2.10",
-  "@tachybase/database": "1.2.10"
+  "@tachybase/server": "1.2.11",
+  "@tachybase/actions": "1.2.11",
+  "@tachybase/utils": "1.2.11",
+  "@tachybase/database": "1.2.11"
 };

package/dist/locale/en-US.json

@@ -11,6 +11,7 @@
   "Country": "Country",
   "Days": "Days",
   "Default value is 1800 seconds (30 minutes).": "Default value is 1800 seconds (30 minutes).",
+  "Default value is 30 days.": "Default value is 30 days.",
   "Default value is 30 minutes.": "Default value is 30 minutes.",
   "Default value is 300 seconds (5 minutes).": "Default value is 300 seconds (5 minutes).",
   "Default value is 5 minutes.": "Default value is 5 minutes.",
@@ -51,6 +52,7 @@
   "Must contain letters, numbers, and symbols": "Must contain letters, numbers, and symbols",
   "Must contain numbers, uppercase and lowercase letters": "Must contain numbers, uppercase and lowercase letters",
   "Must contain numbers, uppercase and lowercase letters, and symbols": "Must contain numbers, uppercase and lowercase letters, and symbols",
+  "Never expire": "Never expire",
   "Nickname": "Nickname",
   "No password strength requirements": "No password strength requirements",
   "No restrictions": "No restrictions",
@@ -76,6 +78,8 @@
   "Password strength: Medium": "Password strength: Medium",
   "Password strength: Strong": "Password strength: Strong",
   "Password strength: Very Strong": "Password strength: Very Strong",
+  "Password validity period": "Password validity period",
+  "Password validity period (days)": "Password validity period (days)",
   "Please enter username, nickname or email": "Please enter username, nickname or email",
   "Please input minimum password length": "Please input minimum password length",
   "Please input password history count": "Please input password history count",

package/dist/locale/zh-CN.json

@@ -15,6 +15,7 @@
   "Default value is 300 seconds (5 minutes).": "默认值为300秒（5分钟）。",
   "Default value is 5 minutes.": "默认值为5分钟。",
   "Default value is 5. Set to 0 to disable.": "默认值为5。设置为0表示禁用。",
+  "Default value is never.": "密码过期后，用户将不能登录直到管理员重置密码。默认值为不限制。",
   "Default value is off.": "默认值为关闭。",
   "Edit": "编辑",
   "Edit Lock": "编辑锁定",
@@ -51,6 +52,7 @@
   "Must contain letters, numbers, and symbols": "必须包含字母、数字和符号",
   "Must contain numbers, uppercase and lowercase letters": "必须包含数字、大写和小写字母",
   "Must contain numbers, uppercase and lowercase letters, and symbols": "必须包含数字、大写和小写字母和符号",
+  "Never expire": "永不过期",
   "Nickname": "昵称",
   "No password strength requirements": "无密码强度要求",
   "No restrictions": "无限制",
@@ -76,6 +78,8 @@
   "Password strength: Medium": "密码强度：中等",
   "Password strength: Strong": "密码强度：强",
   "Password strength: Very Strong": "密码强度：非常强",
+  "Password validity period": "密码有效期",
+  "Password validity period (days)": "密码有效期（天）",
   "Please enter username, nickname or email": "请输入用户名、昵称或邮箱",
   "Please input minimum password length": "请输入最小密码长度",
   "Please input password history count": "请输入密码历史数量",

package/dist/node_modules/geoip-lite/package.json

@@ -1 +1 @@
-{"name":"geoip-lite","version":"1.4.10","description":"A light weight native JavaScript implementation of GeoIP API from MaxMind","keywords":["geo","geoip","ip","ipv4","ipv6","geolookup","maxmind","geolite"],"homepage":"https://github.com/geoip-lite/node-geoip","author":"Philip Tellis <philip@bluesmoon.info> (http://bluesmoon.info/)","files":["lib/","data/","test/","scripts/"],"main":"lib/geoip.js","repository":{"type":"git","url":"git://github.com/geoip-lite/node-geoip.git"},"engines":{"node":">=10.3.0"},"scripts":{"pretest":"eslint .","test":"nodeunit --reporter=minimal test/tests.js","updatedb":"node scripts/updatedb.js","updatedb-debug":"node scripts/updatedb.js debug","updatedb-force":"node scripts/updatedb.js force"},"dependencies":{"async":"2.1 - 2.6.4","chalk":"4.1 - 4.1.2","iconv-lite":"0.4.13 - 0.6.3","ip-address":"5.8.9 - 5.9.4","lazy":"1.0.11","rimraf":"2.5.2 - 2.7.1","yauzl":"2.9.2 - 2.10.0"},"config":{"update":true},"devDependencies":{"eslint":"^5.12.1","nodeunit":"^0.11.2"},"license":"Apache-2.0","_lastModified":"2025-06-18T18:06:35.404Z"}
+{"name":"geoip-lite","version":"1.4.10","description":"A light weight native JavaScript implementation of GeoIP API from MaxMind","keywords":["geo","geoip","ip","ipv4","ipv6","geolookup","maxmind","geolite"],"homepage":"https://github.com/geoip-lite/node-geoip","author":"Philip Tellis <philip@bluesmoon.info> (http://bluesmoon.info/)","files":["lib/","data/","test/","scripts/"],"main":"lib/geoip.js","repository":{"type":"git","url":"git://github.com/geoip-lite/node-geoip.git"},"engines":{"node":">=10.3.0"},"scripts":{"pretest":"eslint .","test":"nodeunit --reporter=minimal test/tests.js","updatedb":"node scripts/updatedb.js","updatedb-debug":"node scripts/updatedb.js debug","updatedb-force":"node scripts/updatedb.js force"},"dependencies":{"async":"2.1 - 2.6.4","chalk":"4.1 - 4.1.2","iconv-lite":"0.4.13 - 0.6.3","ip-address":"5.8.9 - 5.9.4","lazy":"1.0.11","rimraf":"2.5.2 - 2.7.1","yauzl":"2.9.2 - 2.10.0"},"config":{"update":true},"devDependencies":{"eslint":"^5.12.1","nodeunit":"^0.11.2"},"license":"Apache-2.0","_lastModified":"2025-06-19T15:41:15.159Z"}

package/dist/server/actions/PasswordPolicyController.d.ts

@@ -0,0 +1,7 @@
+import { Context, Next } from '@tachybase/actions';
+import { PasswordPolicyService } from '../services/PasswordPolicyService';
+export declare class PasswordPolicyController {
+    passwordPolicyService: PasswordPolicyService;
+    getConfig(ctx: Context, next: Next): Promise<any>;
+    setConfiguration(ctx: Context, next: Next): Promise<any>;
+}

package/dist/server/actions/PasswordPolicyController.js

@@ -0,0 +1,124 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decoratorStart = (base) => [, , , __create((base == null ? void 0 : base[__knownSymbol("metadata")]) ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== void 0 && typeof fn !== "function" ? __typeError("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({ kind: __decoratorStrings[kind], name, metadata, addInitializer: (fn) => done._ ? __typeError("Already initialized") : fns.push(__expectFn(fn || null)) });
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length; i < n; i++) flags & 1 ? fns[i].call(self) : value = fns[i].call(self, value);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var fn, it, done, ctx, access, k = flags & 7, s = !!(flags & 8), p = !!(flags & 16);
+  var j = k > 3 ? array.length + 1 : k ? s ? 1 : 2 : 0, key = __decoratorStrings[k + 5];
+  var initializers = k > 3 && (array[j - 1] = []), extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
+    return __privateGet(this, extra);
+  }, set [name](x) {
+    return __privateSet(this, extra, x);
+  } }, name));
+  k ? p && k < 4 && __name(extra, (k > 2 ? "set " : k > 1 ? "get " : "") + name) : __name(target, name);
+  for (var i = decorators.length - 1; i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    if (k) {
+      ctx.static = s, ctx.private = p, access = ctx.access = { has: p ? (x) => __privateIn(target, x) : (x) => name in x };
+      if (k ^ 3) access.get = p ? (x) => (k ^ 1 ? __privateGet : __privateMethod)(x, target, k ^ 4 ? extra : desc.get) : (x) => x[name];
+      if (k > 2) access.set = p ? (x, y) => __privateSet(x, target, y, k ^ 4 ? extra : desc.set) : (x, y) => x[name] = y;
+    }
+    it = (0, decorators[i])(k ? k < 4 ? p ? extra : desc[key] : k > 4 ? void 0 : { get: desc.get, set: desc.set } : target, ctx), done._ = 1;
+    if (k ^ 4 || it === void 0) __expectFn(it) && (k > 4 ? initializers.unshift(it) : k ? p ? extra = it : desc[key] = it : target = it);
+    else if (typeof it !== "object" || it === null) __typeError("Object expected");
+    else __expectFn(fn = it.get) && (desc.get = fn), __expectFn(fn = it.set) && (desc.set = fn), __expectFn(fn = it.init) && initializers.unshift(fn);
+  }
+  return k || __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateIn = (member, obj) => Object(obj) !== obj ? __typeError('Cannot use the "in" operator on this value') : member.has(obj);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+var PasswordPolicyController_exports = {};
+__export(PasswordPolicyController_exports, {
+  PasswordPolicyController: () => PasswordPolicyController
+});
+module.exports = __toCommonJS(PasswordPolicyController_exports);
+var import_utils = require("@tachybase/utils");
+var import_constants = require("../../constants");
+var import_PasswordPolicyService = require("../services/PasswordPolicyService");
+var _setConfiguration_dec, _getConfig_dec, _passwordPolicyService_dec, _PasswordPolicyController_decorators, _init;
+_PasswordPolicyController_decorators = [(0, import_utils.Controller)(import_constants.COLLECTION_PASSWORD_POLICY)], _passwordPolicyService_dec = [(0, import_utils.Inject)(() => import_PasswordPolicyService.PasswordPolicyService)], _getConfig_dec = [(0, import_utils.Action)("get")], _setConfiguration_dec = [(0, import_utils.Action)("set")];
+class PasswordPolicyController {
+  constructor() {
+    __runInitializers(_init, 5, this);
+    this.passwordPolicyService = __runInitializers(_init, 8, this), __runInitializers(_init, 11, this);
+  }
+  async getConfig(ctx, next) {
+    const repo = ctx.db.getRepository(import_constants.COLLECTION_PASSWORD_POLICY);
+    const data = await repo.findOne();
+    ctx.body = data;
+    return next();
+  }
+  async setConfiguration(ctx, next) {
+    const params = ctx.action.params;
+    let transaction;
+    try {
+      const transaction2 = await ctx.db.sequelize.transaction();
+      const repo = ctx.db.getRepository(import_constants.COLLECTION_PASSWORD_POLICY);
+      const existOne = await repo.findOne({
+        transaction: transaction2
+      });
+      let data;
+      if (!existOne) {
+        data = await repo.create({
+          values: params.values,
+          transaction: transaction2
+        });
+      } else {
+        data = await repo.update({
+          filterByTk: params.values.id,
+          values: params.values,
+          transaction: transaction2
+        });
+      }
+      await transaction2.commit();
+      ctx.body = data;
+    } catch (err) {
+      ctx.app.logger.error("put password policy config error", err);
+      transaction == null ? void 0 : transaction.rollback();
+    }
+    return next();
+  }
+}
+_init = __decoratorStart(null);
+__decorateElement(_init, 1, "getConfig", _getConfig_dec, PasswordPolicyController);
+__decorateElement(_init, 1, "setConfiguration", _setConfiguration_dec, PasswordPolicyController);
+__decorateElement(_init, 5, "passwordPolicyService", _passwordPolicyService_dec, PasswordPolicyController);
+PasswordPolicyController = __decorateElement(_init, 0, "PasswordPolicyController", _PasswordPolicyController_decorators, PasswordPolicyController);
+__runInitializers(_init, 1, PasswordPolicyController);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PasswordPolicyController
+});

package/dist/server/collections/passwordPolicy.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@tachybase/database").CollectionOptions;
+export default _default;

package/dist/server/collections/passwordPolicy.js

@@ -0,0 +1,41 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var passwordPolicy_exports = {};
+__export(passwordPolicy_exports, {
+  default: () => passwordPolicy_default
+});
+module.exports = __toCommonJS(passwordPolicy_exports);
+var import_database = require("@tachybase/database");
+var import_constants = require("../../constants");
+var passwordPolicy_default = (0, import_database.defineCollection)({
+  dumpRules: {
+    group: "user"
+  },
+  name: import_constants.COLLECTION_PASSWORD_POLICY,
+  createdAt: true,
+  updatedAt: true,
+  createdBy: true,
+  updatedBy: true,
+  fields: [
+    {
+      type: "integer",
+      name: "validityPeriod"
+      // 密码有效期:天
+    }
+  ]
+});

package/dist/server/plugin.js

@@ -69,11 +69,13 @@ module.exports = __toCommonJS(plugin_exports);
 var import_server = require("@tachybase/server");
 var import_IpFilterController = require("./actions/IpFilterController");
 var import_PasswordAttemptController = require("./actions/PasswordAttemptController");
+var import_PasswordPolicyController = require("./actions/PasswordPolicyController");
 var import_PasswordStrengthController = require("./actions/PasswordStrengthController");
 var import_SignInFailsController = require("./actions/SignInFailsController");
 var import_UserLocksController = require("./actions/UserLocksController");
 var import_IPFilterService = require("./services/IPFilterService");
 var import_PasswordAttemptService = require("./services/PasswordAttemptService");
+var import_PasswordPolicyService = require("./services/PasswordPolicyService");
 var import_PasswordStrengthService = require("./services/PasswordStrengthService");
 var _PluginPasswordPolicyServer_decorators, _init, _a;
 _PluginPasswordPolicyServer_decorators = [(0, import_server.InjectedPlugin)({
@@ -82,9 +84,10 @@ _PluginPasswordPolicyServer_decorators = [(0, import_server.InjectedPlugin)({
     import_UserLocksController.UserLocksController,
     import_IpFilterController.IpFilterController,
     import_PasswordStrengthController.PasswordStrengthController,
-    import_SignInFailsController.SignInFailsController
+    import_SignInFailsController.SignInFailsController,
+    import_PasswordPolicyController.PasswordPolicyController
   ],
-  Services: [import_PasswordAttemptService.PasswordAttemptService, import_IPFilterService.IPFilterService, import_PasswordStrengthService.PasswordStrengthService]
+  Services: [import_PasswordAttemptService.PasswordAttemptService, import_IPFilterService.IPFilterService, import_PasswordStrengthService.PasswordStrengthService, import_PasswordPolicyService.PasswordPolicyService]
 })];
 class PluginPasswordPolicyServer extends (_a = import_server.Plugin) {
   async load() {
@@ -108,6 +111,10 @@ class PluginPasswordPolicyServer extends (_a = import_server.Plugin) {
       name: `pm.security.sign-in-fails`,
       actions: ["signInFails:*"]
     });
+    this.app.acl.registerSnippet({
+      name: `pm.security.password-policy`,
+      actions: ["passwordPolicy:*"]
+    });
     this.app.acl.addFixedParams("userLocks", "list", () => {
       return {
         filter: {

package/dist/server/services/PasswordPolicyService.d.ts

@@ -0,0 +1,75 @@
+import Database from '@tachybase/database';
+import { Application } from '@tachybase/server';
+export declare class PasswordPolicyService {
+    db: Database;
+    app: Application;
+    private logger;
+    private config;
+    private failureRecords;
+    private readonly CACHE_PREFIX;
+    private readonly CACHE_TTL;
+    load(): Promise<void>;
+    /**
+     * 获取用户锁定信息的缓存键
+     * @param userId 用户ID
+     * @returns 缓存键
+     */
+    private getUserLockCacheKey;
+    /**
+     * 初始化被锁定用户的缓存
+     */
+    private initLockedUsersCache;
+    /**
+     * 设置监听userLocks表变动的事件
+     */
+    private setupLockedUsersListener;
+    /**
+     * 清空用户的登录失败记录
+     * @param userId 用户ID
+     */
+    private clearUserFailRecords;
+    /**
+     * 检查用户是否被锁定
+     * @param userId 用户ID
+     * @returns 如果用户被锁定，返回true；否则返回false
+     */
+    private isUserLocked;
+    /**
+     * 从数据库检查并缓存用户锁定状态
+     * @param userId 用户ID
+     * @returns 如果用户被锁定，返回true；否则返回false
+     */
+    private checkAndCacheLockedUser;
+    /**
+     * 在后台刷新用户锁定缓存
+     * @param userId 用户ID
+     */
+    private refreshLockedUserCache;
+    refreshConfig(config: any): Promise<void>;
+    addMiddleWare(): void;
+    /**
+     * 从数据库加载最近的失败记录到内存
+     */
+    private loadRecentRecords;
+    /**
+     * 获取IP地址的地理位置信息
+     * @param ip IP地址
+     * @returns 地理位置信息
+     */
+    private getGeoLocation;
+    /**
+     * 记录登录失败
+     * @param username 用户名
+     */
+    recordFailedAttempt(user: any, ip: string): Promise<void>;
+    private recordFailedAttemptToDb;
+    /**
+     * 获取最近的失败次数（从内存缓存中获取）
+     */
+    private getRecentFailureCount;
+    /**
+     * 重置用户的失败记录
+     * @param username 用户名
+     */
+    resetFailedAttempts(userId: number): Promise<void>;
+}

package/dist/server/services/PasswordPolicyService.js

@@ -0,0 +1,595 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decoratorStart = (base) => [, , , __create((base == null ? void 0 : base[__knownSymbol("metadata")]) ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== void 0 && typeof fn !== "function" ? __typeError("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({ kind: __decoratorStrings[kind], name, metadata, addInitializer: (fn) => done._ ? __typeError("Already initialized") : fns.push(__expectFn(fn || null)) });
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length; i < n; i++) flags & 1 ? fns[i].call(self) : value = fns[i].call(self, value);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var fn, it, done, ctx, access, k = flags & 7, s = !!(flags & 8), p = !!(flags & 16);
+  var j = k > 3 ? array.length + 1 : k ? s ? 1 : 2 : 0, key = __decoratorStrings[k + 5];
+  var initializers = k > 3 && (array[j - 1] = []), extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
+    return __privateGet(this, extra);
+  }, set [name](x) {
+    return __privateSet(this, extra, x);
+  } }, name));
+  k ? p && k < 4 && __name(extra, (k > 2 ? "set " : k > 1 ? "get " : "") + name) : __name(target, name);
+  for (var i = decorators.length - 1; i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    if (k) {
+      ctx.static = s, ctx.private = p, access = ctx.access = { has: p ? (x) => __privateIn(target, x) : (x) => name in x };
+      if (k ^ 3) access.get = p ? (x) => (k ^ 1 ? __privateGet : __privateMethod)(x, target, k ^ 4 ? extra : desc.get) : (x) => x[name];
+      if (k > 2) access.set = p ? (x, y) => __privateSet(x, target, y, k ^ 4 ? extra : desc.set) : (x, y) => x[name] = y;
+    }
+    it = (0, decorators[i])(k ? k < 4 ? p ? extra : desc[key] : k > 4 ? void 0 : { get: desc.get, set: desc.set } : target, ctx), done._ = 1;
+    if (k ^ 4 || it === void 0) __expectFn(it) && (k > 4 ? initializers.unshift(it) : k ? p ? extra = it : desc[key] = it : target = it);
+    else if (typeof it !== "object" || it === null) __typeError("Object expected");
+    else __expectFn(fn = it.get) && (desc.get = fn), __expectFn(fn = it.set) && (desc.set = fn), __expectFn(fn = it.init) && initializers.unshift(fn);
+  }
+  return k || __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateIn = (member, obj) => Object(obj) !== obj ? __typeError('Cannot use the "in" operator on this value') : member.has(obj);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+var PasswordPolicyService_exports = {};
+__export(PasswordPolicyService_exports, {
+  PasswordPolicyService: () => PasswordPolicyService
+});
+module.exports = __toCommonJS(PasswordPolicyService_exports);
+var import_utils = require("@tachybase/utils");
+var geoip = __toESM(require("geoip-lite"));
+var import_constants = require("../../constants");
+var _logger_dec, _app_dec, _db_dec, _PasswordPolicyService_decorators, _init;
+_PasswordPolicyService_decorators = [(0, import_utils.Service)()], _db_dec = [(0, import_utils.Db)()], _app_dec = [(0, import_utils.App)()], _logger_dec = [(0, import_utils.InjectLog)()];
+class PasswordPolicyService {
+  constructor() {
+    this.db = __runInitializers(_init, 8, this), __runInitializers(_init, 11, this);
+    this.app = __runInitializers(_init, 12, this), __runInitializers(_init, 15, this);
+    this.logger = __runInitializers(_init, 16, this), __runInitializers(_init, 19, this);
+    this.config = void 0;
+    // 内存缓存，用于存储最近的失败记录
+    this.failureRecords = /* @__PURE__ */ new Map();
+    // 缓存前缀
+    this.CACHE_PREFIX = import_constants.COLLECTION_PASSWORD_POLICY;
+    // 缓存过期时间（毫秒）
+    this.CACHE_TTL = 5 * 60 * 1e3;
+  }
+  // 5分钟
+  async load() {
+    this.addMiddleWare();
+    this.app.on("afterStart", async () => {
+      const config = await this.db.getRepository(import_constants.COLLECTION_PASSWORD_POLICY).findOne();
+      await this.refreshConfig(config);
+      await this.initLockedUsersCache();
+      this.setupLockedUsersListener();
+    });
+    this.db.on(`${import_constants.COLLECTION_PASSWORD_POLICY}.afterSave`, async (model) => {
+      await this.refreshConfig(model);
+    });
+  }
+  /**
+   * 获取用户锁定信息的缓存键
+   * @param userId 用户ID
+   * @returns 缓存键
+   */
+  getUserLockCacheKey(userId) {
+    return `${this.CACHE_PREFIX}:locked:${userId}`;
+  }
+  /**
+   * 初始化被锁定用户的缓存
+   */
+  async initLockedUsersCache() {
+    try {
+      const now = /* @__PURE__ */ new Date();
+      const lockedUsersRepo = this.db.getRepository("userLocks");
+      const lockedUsers = await lockedUsersRepo.find({
+        filter: {
+          expireAt: {
+            $gt: now
+          }
+        }
+      });
+      for (const user of lockedUsers) {
+        const userId = user.get("userId");
+        const expireAt = user.get("expireAt");
+        await this.app.cache.set(
+          this.getUserLockCacheKey(userId),
+          {
+            id: userId,
+            expireAt,
+            lastChecked: now
+          },
+          this.CACHE_TTL
+        );
+      }
+      this.logger.info(`Loaded ${lockedUsers.length} locked users into cache`);
+    } catch (error) {
+      this.logger.error("Failed to load locked users into cache:", error);
+    }
+  }
+  /**
+   * 设置监听userLocks表变动的事件
+   */
+  setupLockedUsersListener() {
+    this.app.db.on("userLocks.afterCreate", async (model) => {
+      const userId = model.get("userId");
+      const expireAt = model.get("expireAt");
+      await this.app.cache.set(
+        this.getUserLockCacheKey(userId),
+        {
+          id: userId,
+          expireAt,
+          lastChecked: /* @__PURE__ */ new Date()
+        },
+        this.CACHE_TTL
+      );
+      this.logger.info(`Added user ${userId} to locked users cache`);
+    });
+    this.app.db.on("userLocks.afterUpdate", async (model) => {
+      const userId = model.get("userId");
+      if (!userId && model.previous("userId")) {
+        const userId2 = model.previous("userId");
+        await this.app.cache.del(this.getUserLockCacheKey(userId2));
+        await this.clearUserFailRecords(userId2);
+        this.logger.info(`Removed user ${userId2} from locked users cache (deleted)`);
+        return;
+      }
+      const expireAt = model.get("expireAt");
+      const now = /* @__PURE__ */ new Date();
+      if (expireAt > now) {
+        await this.app.cache.set(
+          this.getUserLockCacheKey(userId),
+          {
+            id: userId,
+            expireAt,
+            lastChecked: now
+          },
+          this.CACHE_TTL
+        );
+        this.logger.info(`Updated user ${userId} in locked users cache`);
+      } else {
+        await this.app.cache.del(this.getUserLockCacheKey(userId));
+        await this.clearUserFailRecords(userId);
+        this.logger.info(`Removed user ${userId} from locked users cache (expired)`);
+      }
+    });
+    this.app.db.on("userLocks.afterDestroy", async (model) => {
+      const userId = model.get("userId");
+      await this.app.cache.del(this.getUserLockCacheKey(userId));
+      await this.clearUserFailRecords(userId);
+      this.logger.info(`Removed user ${userId} from locked users cache (deleted)`);
+    });
+  }
+  /**
+   * 清空用户的登录失败记录
+   * @param userId 用户ID
+   */
+  async clearUserFailRecords(userId) {
+    try {
+      await this.db.getRepository("signInFails").update({
+        filter: {
+          userId
+        },
+        values: {
+          status: false
+        }
+      });
+      this.failureRecords.delete(userId);
+      this.logger.info(`Cleared sign-in failure records for user ${userId}`);
+    } catch (error) {
+      this.logger.error(`Failed to clear sign-in failure records for user ${userId}:`, error);
+    }
+  }
+  /**
+   * 检查用户是否被锁定
+   * @param userId 用户ID
+   * @returns 如果用户被锁定，返回true；否则返回false
+   */
+  async isUserLocked(userId) {
+    const now = /* @__PURE__ */ new Date();
+    const cacheKey = this.getUserLockCacheKey(userId);
+    const cachedInfo = await this.app.cache.get(cacheKey);
+    if (cachedInfo) {
+      const isCacheExpired = now.getTime() - cachedInfo.lastChecked.getTime() > this.CACHE_TTL;
+      if (isCacheExpired) {
+        this.refreshLockedUserCache(userId);
+      }
+      if (!cachedInfo.expireAt) {
+        return false;
+      }
+      if (cachedInfo.expireAt > now) {
+        return true;
+      } else {
+        cachedInfo.expireAt = null;
+        cachedInfo.lastChecked = now;
+        await this.app.cache.set(cacheKey, cachedInfo, this.CACHE_TTL);
+        await this.clearUserFailRecords(userId);
+        return false;
+      }
+    }
+    return await this.checkAndCacheLockedUser(userId);
+  }
+  /**
+   * 从数据库检查并缓存用户锁定状态
+   * @param userId 用户ID
+   * @returns 如果用户被锁定，返回true；否则返回false
+   */
+  async checkAndCacheLockedUser(userId) {
+    var _a;
+    try {
+      const now = /* @__PURE__ */ new Date();
+      const userRepository = this.db.getRepository("users");
+      const user = await userRepository.findOne({
+        fields: ["id"],
+        filter: { id: userId },
+        appends: ["lock"]
+      });
+      const cacheKey = this.getUserLockCacheKey(userId);
+      if (user && ((_a = user.lock) == null ? void 0 : _a.expireAt) && user.lock.expireAt > now) {
+        await this.app.cache.set(
+          cacheKey,
+          {
+            id: userId,
+            expireAt: user.lock.expireAt,
+            lastChecked: now
+          },
+          this.CACHE_TTL
+        );
+        return true;
+      } else {
+        await this.app.cache.set(
+          cacheKey,
+          {
+            id: userId,
+            expireAt: null,
+            // null表示未被锁定
+            lastChecked: now
+          },
+          this.CACHE_TTL
+        );
+        return false;
+      }
+    } catch (error) {
+      this.logger.error(`Error checking locked status for user ${userId}:`, error);
+      return false;
+    }
+  }
+  /**
+   * 在后台刷新用户锁定缓存
+   * @param userId 用户ID
+   */
+  async refreshLockedUserCache(userId) {
+    var _a;
+    try {
+      const now = /* @__PURE__ */ new Date();
+      const userRepository = this.db.getRepository("users");
+      const user = await userRepository.findOne({
+        fields: ["id"],
+        filter: { id: userId },
+        appends: ["lock"]
+      });
+      const cacheKey = this.getUserLockCacheKey(userId);
+      if (user && ((_a = user.lock) == null ? void 0 : _a.expireAt) && user.lock.expireAt > now) {
+        await this.app.cache.set(
+          cacheKey,
+          {
+            id: userId,
+            expireAt: user.lock.expireAt,
+            lastChecked: now
+          },
+          this.CACHE_TTL
+        );
+      } else {
+        const existingInfo = await this.app.cache.get(cacheKey);
+        if (existingInfo) {
+          existingInfo.expireAt = null;
+          existingInfo.lastChecked = now;
+          await this.app.cache.set(cacheKey, existingInfo, this.CACHE_TTL);
+        } else {
+          await this.app.cache.set(
+            cacheKey,
+            {
+              id: userId,
+              expireAt: null,
+              lastChecked: now
+            },
+            this.CACHE_TTL
+          );
+        }
+      }
+    } catch (error) {
+      this.logger.error(`Error refreshing locked cache for user ${userId}:`, error);
+    }
+  }
+  async refreshConfig(config) {
+    this.config = {
+      windowSeconds: (config == null ? void 0 : config.get("windowSeconds")) || import_constants.WINDOW_SECONDS,
+      // 默认5分钟
+      maxAttempts: (config == null ? void 0 : config.get("maxAttempts")) ?? 0,
+      // 默认0，表示不启用防护
+      lockSeconds: (config == null ? void 0 : config.get("lockSeconds")) || import_constants.LOCK_SECONDS,
+      // 默认30分钟
+      strictLock: (config == null ? void 0 : config.get("strictLock")) || false
+      // 锁定时候禁止任意api
+    };
+    if (this.config.maxAttempts > 0) {
+      await this.loadRecentRecords();
+    } else {
+      this.logger.info("Sign-in failure protection is disabled (maxAttempts = 0)");
+    }
+  }
+  addMiddleWare() {
+    this.app.resourcer.use(
+      async (ctx, next) => {
+        var _a;
+        const { resourceName, actionName } = ctx.action.params;
+        if (resourceName === "auth" && actionName === "signIn") {
+          const { account, password, email } = ctx.action.params.values;
+          if (account && password) {
+            const filter = email ? { email } : {
+              $or: [{ username: account }, { email: account }]
+            };
+            const userRepository = ctx.db.getRepository("users");
+            const user = await userRepository.findOne({
+              fields: ["id", "password"],
+              filter,
+              appends: ["lock"]
+            });
+            if (user) {
+              if (((_a = user.lock) == null ? void 0 : _a.expireAt) && user.lock.expireAt > /* @__PURE__ */ new Date()) {
+                ctx.throw(403, ctx.t("User has been locked", { ns: import_constants.NAMESPACE }));
+              }
+              const field = userRepository.collection.getField("password");
+              const valid = await field.verify(password, user.password);
+              if (!valid) {
+                await this.recordFailedAttempt(user, ctx.state.clientIp);
+              } else {
+                await this.resetFailedAttempts(user.id);
+              }
+            }
+          }
+        }
+        await next();
+      },
+      {
+        tag: "lockUserByPasswordPolicy",
+        before: "auth"
+      }
+    );
+    this.app.resourcer.use(
+      async (ctx, next) => {
+        if (this.config.strictLock && ctx.state.currentUser) {
+          const userId = ctx.state.currentUser.id;
+          const isLocked = await this.isUserLocked(userId);
+          if (isLocked) {
+            ctx.throw(403, ctx.t("User has been locked", { ns: import_constants.NAMESPACE }));
+          }
+        }
+        await next();
+      },
+      { tag: "lockAllResource", after: "auth", before: "acl" }
+    );
+  }
+  /**
+   * 从数据库加载最近的失败记录到内存
+   */
+  async loadRecentRecords() {
+    try {
+      const cutoffTime = /* @__PURE__ */ new Date();
+      cutoffTime.setSeconds(cutoffTime.getSeconds() - Math.max(this.config.windowSeconds, this.config.lockSeconds));
+      const records = await this.db.getRepository("signInFails").find({
+        filter: {
+          createdAt: {
+            $gt: cutoffTime
+          },
+          status: true
+        }
+      });
+      this.failureRecords.clear();
+      records.forEach((record) => {
+        const userId = record.get("userId");
+        const createdAt = record.get("createdAt");
+        const userRecords = this.failureRecords.get(userId) || [];
+        userRecords.push({ userId, createdAt });
+        this.failureRecords.set(userId, userRecords);
+      });
+      this.logger.info(`Loaded ${records.length} recent sign-in failure records into cache`);
+    } catch (error) {
+      this.logger.error("Failed to load recent sign-in failure records:", error);
+    }
+  }
+  /**
+   * 获取IP地址的地理位置信息
+   * @param ip IP地址
+   * @returns 地理位置信息
+   */
+  getGeoLocation(ip) {
+    try {
+      if (!ip || ip === "127.0.0.1" || ip === "localhost" || ip.startsWith("192.168.") || ip.startsWith("10.")) {
+        return { country: "Local", region: "Local", city: "Local" };
+      }
+      const geo = geoip.lookup(ip);
+      if (!geo) {
+        return {};
+      }
+      return {
+        country: geo.country,
+        region: geo.region,
+        city: geo.city
+      };
+    } catch (error) {
+      this.logger.error(`Failed to get geo location for IP ${ip}:`, error);
+      return {};
+    }
+  }
+  /**
+   * 记录登录失败
+   * @param username 用户名
+   */
+  async recordFailedAttempt(user, ip) {
+    var _a, _b;
+    try {
+      const now = /* @__PURE__ */ new Date();
+      if (this.config.maxAttempts === 0) {
+        await this.recordFailedAttemptToDb(user, ip, now, false);
+        return;
+      }
+      if (((_a = user.lock) == null ? void 0 : _a.expireAt) && now > user.lock.expireAt) {
+        await this.resetFailedAttempts(user.id);
+      } else if (this.getRecentFailureCount(user.id) + 1 >= this.config.maxAttempts) {
+        if (!((_b = user.lock) == null ? void 0 : _b.expireAt) || now > user.lock.expireAt) {
+          const lockExpireAt = new Date(now);
+          lockExpireAt.setSeconds(lockExpireAt.getSeconds() + this.config.lockSeconds);
+          await this.db.sequelize.transaction(async (transaction) => {
+            const existOne = await this.db.getRepository("userLocks").findOne({
+              filter: {
+                userId: user.id
+              },
+              transaction
+            });
+            if (existOne) {
+              await existOne.update(
+                {
+                  expireAt: lockExpireAt
+                },
+                {
+                  transaction
+                }
+              );
+            } else {
+              await this.db.getRepository("userLocks").create({
+                values: {
+                  userId: user.id,
+                  expireAt: lockExpireAt
+                },
+                transaction
+              });
+            }
+          });
+          await this.app.cache.set(
+            this.getUserLockCacheKey(user.id),
+            {
+              id: user.id,
+              expireAt: lockExpireAt,
+              lastChecked: now
+            },
+            this.CACHE_TTL
+          );
+        }
+      }
+      const record = await this.recordFailedAttemptToDb(user, ip, now, true);
+      if (this.failureRecords.get(user.id)) {
+        this.failureRecords.get(user.id).push({
+          userId: user.id,
+          createdAt: record.get("createdAt")
+        });
+      } else {
+        this.failureRecords.set(user.id, [
+          {
+            userId: user.id,
+            createdAt: record.get("createdAt")
+          }
+        ]);
+      }
+    } catch (error) {
+      this.logger.error("Failed to record sign-in failure:", error);
+      throw error;
+    }
+  }
+  async recordFailedAttemptToDb(user, ip, now, recordUser = false) {
+    let geoLocation = {};
+    if (ip) {
+      geoLocation = this.getGeoLocation(ip);
+    }
+    const address = `${geoLocation.country || ""} ${geoLocation.region || ""} ${geoLocation.city || ""}`.trim();
+    return this.db.getRepository("signInFails").create({
+      values: {
+        userId: user.id,
+        status: recordUser,
+        ip,
+        address,
+        createdAt: now
+      }
+    });
+  }
+  /**
+   * 获取最近的失败次数（从内存缓存中获取）
+   */
+  getRecentFailureCount(userId) {
+    if (this.config.maxAttempts === 0) {
+      return 0;
+    }
+    const userRecords = this.failureRecords.get(userId) || [];
+    const windowStart = /* @__PURE__ */ new Date();
+    windowStart.setSeconds(windowStart.getSeconds() - this.config.windowSeconds);
+    return userRecords.filter((record) => record.createdAt > windowStart).length;
+  }
+  /**
+   * 重置用户的失败记录
+   * @param username 用户名
+   */
+  async resetFailedAttempts(userId) {
+    if (this.config.maxAttempts === 0) {
+      return;
+    }
+    try {
+      await this.db.getRepository("userLocks").destroy({
+        filter: {
+          userId
+        }
+      });
+      this.logger.info(`Reset sign-in failure records for user ${userId}`);
+    } catch (error) {
+      this.logger.error(`Failed to reset sign-in failure records for user ${userId}:`, error);
+      throw error;
+    }
+  }
+}
+_init = __decoratorStart(null);
+__decorateElement(_init, 5, "db", _db_dec, PasswordPolicyService);
+__decorateElement(_init, 5, "app", _app_dec, PasswordPolicyService);
+__decorateElement(_init, 5, "logger", _logger_dec, PasswordPolicyService);
+PasswordPolicyService = __decorateElement(_init, 0, "PasswordPolicyService", _PasswordPolicyService_decorators, PasswordPolicyService);
+__runInitializers(_init, 1, PasswordPolicyService);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PasswordPolicyService
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tachybase/plugin-password-policy",
   "displayName": "Password policy",
-  "version": "1.2.10",
+  "version": "1.2.11",
   "description": "Password policy, including password strength, password attempt limit, password lock time, ip whitelist/blacklist, etc.",
   "keywords": [
     "Security"
@@ -14,12 +14,12 @@
     "ipaddr.js": "^2.1.0"
   },
   "peerDependencies": {
-    "@tachybase/client": "1.2.10",
-    "@tachybase/database": "1.2.10",
-    "@tachybase/actions": "1.2.10",
-    "@tachybase/schema": "1.2.10",
-    "@tachybase/server": "1.2.10",
-    "@tachybase/utils": "1.2.10"
+    "@tachybase/actions": "1.2.11",
+    "@tachybase/client": "1.2.11",
+    "@tachybase/database": "1.2.11",
+    "@tachybase/schema": "1.2.11",
+    "@tachybase/utils": "1.2.11",
+    "@tachybase/server": "1.2.11"
   },
   "description.zh-CN": "密码策略, 包含密码强度、密码尝试次数限制、密码锁定时间、ip黑白名单等",
   "displayName.zh-CN": "密码策略"