@things-factory/auth-base 10.1.213 → 10.1.215

package/dist-server/utils/password-reset-rule.d.ts

@@ -0,0 +1,15 @@
+import { Domain, Refusal } from '@things-factory/shell';
+import { EntityManager } from 'typeorm';
+import { User } from '../service/user/user.js';
+/**
+ * Whom a domain may put back on the default password.
+ *
+ * A person has one password for every domain they work in, and the default password is known to everyone who
+ * was ever handed it. Resetting one is therefore the same as taking the account: the first one to sign in with
+ * the default is sent to set a new password. A domain may do that only to an account that is wholly its own -
+ * one that works in no other domain and owns no domain. The system domain's owner (the super user) and any
+ * domain's owner are refused here, whichever domain asks; so are `admin` accounts, as `inactivateUser` refuses them.
+ *
+ * @returns the refusal, or `null` when `target` may be reset from `domain`. `target` must carry its `domains`.
+ */
+export declare function passwordResetRefusal(target: User, domain: Domain, tx?: EntityManager): Promise<Refusal | null>;

package/dist-server/utils/password-reset-rule.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.passwordResetRefusal = passwordResetRefusal;
+const shell_1 = require("@things-factory/shell");
+const domain_owner_js_1 = require("../service/domain-owner/domain-owner.js");
+/**
+ * Whom a domain may put back on the default password.
+ *
+ * A person has one password for every domain they work in, and the default password is known to everyone who
+ * was ever handed it. Resetting one is therefore the same as taking the account: the first one to sign in with
+ * the default is sent to set a new password. A domain may do that only to an account that is wholly its own -
+ * one that works in no other domain and owns no domain. The system domain's owner (the super user) and any
+ * domain's owner are refused here, whichever domain asks; so are `admin` accounts, as `inactivateUser` refuses them.
+ *
+ * @returns the refusal, or `null` when `target` may be reset from `domain`. `target` must carry its `domains`.
+ */
+async function passwordResetRefusal(target, domain, tx) {
+    if (target.userType == 'admin' || (await ownsAnyDomain(target, tx))) {
+        return new shell_1.Refusal('password-reset-owner-account', {}, "A domain owner's or administrator's password is not reset to the default.");
+    }
+    const elsewhere = (target.domains || []).filter((userDomain) => userDomain.id !== domain.id);
+    if (elsewhere.length > 0) {
+        return new shell_1.Refusal('password-reset-reaches-other-domains', { domains: elsewhere.map((userDomain) => userDomain.name).join(', ') }, `The account also works in ${elsewhere.map((userDomain) => userDomain.name).join(', ')} - its password is not this domain's to reset.`);
+    }
+    return null;
+}
+/** Owner of any domain - through the `DomainOwner` table or the primary owner column (`domain-ownership.ts`). */
+async function ownsAnyDomain(user, tx) {
+    if (await (0, shell_1.getRepository)(shell_1.Domain, tx).exists({ where: { owner: user.id } })) {
+        return true;
+    }
+    return await (0, shell_1.getRepository)(domain_owner_js_1.DomainOwner, tx).exists({ where: { user: { id: user.id } } });
+}
+//# sourceMappingURL=password-reset-rule.js.map

package/dist-server/utils/password-reset-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-rule.js","sourceRoot":"","sources":["../../server/utils/password-reset-rule.ts"],"names":[],"mappings":";;AAiBA,oDAuBC;AAxCD,iDAAsE;AAGtE,6EAAqE;AAGrE;;;;;;;;;;GAUG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAY,EACZ,MAAc,EACd,EAAkB;IAElB,IAAI,MAAM,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,eAAO,CAChB,8BAA8B,EAC9B,EAAE,EACF,2EAA2E,CAC5E,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;IACpG,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,eAAO,CAChB,sCAAsC,EACtC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC9E,6BAA6B,SAAS,CAAC,GAAG,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gDAAgD,CAC/I,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,iHAAiH;AACjH,KAAK,UAAU,aAAa,CAAC,IAAU,EAAE,EAAkB;IACzD,IAAI,MAAM,IAAA,qBAAa,EAAC,cAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,MAAM,IAAA,qBAAa,EAAC,6BAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;AAC1F,CAAC","sourcesContent":["import { Domain, getRepository, Refusal } from '@things-factory/shell'\nimport { EntityManager } from 'typeorm'\n\nimport { DomainOwner } from '../service/domain-owner/domain-owner.js'\nimport { User } from '../service/user/user.js'\n\n/**\n * Whom a domain may put back on the default password.\n *\n * A person has one password for every domain they work in, and the default password is known to everyone who\n * was ever handed it. Resetting one is therefore the same as taking the account: the first one to sign in with\n * the default is sent to set a new password. A domain may do that only to an account that is wholly its own -\n * one that works in no other domain and owns no domain. The system domain's owner (the super user) and any\n * domain's owner are refused here, whichever domain asks; so are `admin` accounts, as `inactivateUser` refuses them.\n *\n * @returns the refusal, or `null` when `target` may be reset from `domain`. `target` must carry its `domains`.\n */\nexport async function passwordResetRefusal(\n  target: User,\n  domain: Domain,\n  tx?: EntityManager\n): Promise<Refusal | null> {\n  if (target.userType == 'admin' || (await ownsAnyDomain(target, tx))) {\n    return new Refusal(\n      'password-reset-owner-account',\n      {},\n      \"A domain owner's or administrator's password is not reset to the default.\"\n    )\n  }\n\n  const elsewhere = (target.domains || []).filter((userDomain: Domain) => userDomain.id !== domain.id)\n  if (elsewhere.length > 0) {\n    return new Refusal(\n      'password-reset-reaches-other-domains',\n      { domains: elsewhere.map((userDomain: Domain) => userDomain.name).join(', ') },\n      `The account also works in ${elsewhere.map((userDomain: Domain) => userDomain.name).join(', ')} - its password is not this domain's to reset.`\n    )\n  }\n\n  return null\n}\n\n/** Owner of any domain - through the `DomainOwner` table or the primary owner column (`domain-ownership.ts`). */\nasync function ownsAnyDomain(user: User, tx?: EntityManager): Promise<boolean> {\n  if (await getRepository(Domain, tx).exists({ where: { owner: user.id } })) {\n    return true\n  }\n\n  return await getRepository(DomainOwner, tx).exists({ where: { user: { id: user.id } } })\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.213",
+  "version": "10.1.215",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "81f23aa18cb584c7d8185e81cca0d688f509cf8c"
+  "gitHead": "7de5e80eb1f4e2e268746aee39f820e7563f454d"
 }

package/tests/password-reset-rule-db.test.ts

@@ -0,0 +1,158 @@
+/**
+ * Whom a domain may put back on the default password.
+ *
+ * `resetPasswordToDefault` asked only that the person belong to the asking domain. A person has one password for
+ * every domain, and the default is known: whoever signs in with it first is sent to set a new one. So a user manager
+ * of any domain could take the account of someone who also works elsewhere, of another domain's owner, and of the
+ * super user (the system domain's owner) the moment that person was a member here.
+ */
+
+import { config } from '@things-factory/env'
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { User } = loadCompiled('service/user/user')
+const { UserMutation } = loadCompiled('service/user/user-mutation')
+const { UserQuery } = loadCompiled('service/user/user-query')
+const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
+
+const DEFAULT_PASSWORD = 'Default!234'
+const OWN_PASSWORD = 'Mine!5678'
+
+let here: any
+let other: any
+let system: any
+
+async function makeUser(domains: any[], extra: any = {}) {
+  const tag = Math.random().toString(36).slice(2, 8)
+  const salt = User.generateSalt()
+  return await getRepository(User).save({
+    username: `u-${tag}`,
+    email: `u-${tag}@example.com`,
+    name: 'Kim',
+    salt,
+    password: User.encode(OWN_PASSWORD, salt),
+    status: 'activated',
+    domains,
+    ...extra
+  })
+}
+
+function context(domain: any) {
+  return { state: { domain, tx: undefined }, t: (key: string) => key } as any
+}
+
+function reset(user: any, domain: any) {
+  return new UserMutation().resetPasswordToDefault(user.username, context(domain))
+}
+
+function mayReset(user: any, domain: any) {
+  return new UserQuery().mayResetPasswordToDefault(user.id, context(domain))
+}
+
+async function stillHasOwnPassword(user: any) {
+  const read = await getRepository(User).findOneBy({ id: user.id })
+  return User.verify(read.password, OWN_PASSWORD, read.salt)
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  config.set('password', undefined)
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  config.set('password', { defaultPassword: DEFAULT_PASSWORD })
+
+  const domainRepository = getRepository(Domain)
+  here = await domainRepository.save({ name: 'Plant A', subdomain: 'plant-a' })
+  other = await domainRepository.save({ name: 'Plant B', subdomain: 'plant-b' })
+  system = await domainRepository.save({ name: 'System', subdomain: 'system' })
+})
+
+describe('a person wholly of this domain', () => {
+  it('is reset to the default, and the screen offers it', async () => {
+    const user = await makeUser([here])
+
+    expect(await mayReset(user, here)).toBe(true)
+    await expect(reset(user, here)).resolves.toBe(true)
+
+    const read = await getRepository(User).findOneBy({ id: user.id })
+    expect(User.verify(read.password, DEFAULT_PASSWORD, read.salt)).toBe(true)
+  })
+})
+
+describe('refused, and the password stays', () => {
+  it('★ someone who also works in another domain', async () => {
+    const user = await makeUser([here, other])
+
+    expect(await mayReset(user, here)).toBe(false)
+    await expect(reset(user, here)).rejects.toMatchObject({
+      code: 'password-reset-reaches-other-domains',
+      params: { domains: 'Plant B' }
+    })
+    expect(await stillHasOwnPassword(user)).toBe(true)
+  })
+
+  it("★ another domain's owner, through the owner table, though a member only here", async () => {
+    const user = await makeUser([here])
+    await getRepository(DomainOwner).save({ domain: other, user })
+
+    expect(await mayReset(user, here)).toBe(false)
+    await expect(reset(user, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+    expect(await stillHasOwnPassword(user)).toBe(true)
+  })
+
+  it("★ another domain's primary owner (the column only)", async () => {
+    const user = await makeUser([here])
+    await getRepository(Domain).update({ id: other.id }, { owner: user.id })
+
+    expect(await mayReset(user, here)).toBe(false)
+    await expect(reset(user, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+    expect(await stillHasOwnPassword(user)).toBe(true)
+  })
+
+  it('★ the super user - asked from the system domain itself', async () => {
+    const superUser = await makeUser([system])
+    await getRepository(Domain).update({ id: system.id }, { owner: superUser.id })
+
+    expect(await mayReset(superUser, system)).toBe(false)
+    await expect(reset(superUser, system)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+    expect(await stillHasOwnPassword(superUser)).toBe(true)
+  })
+
+  it('★ the super user - asked from a domain they are also a member of', async () => {
+    const superUser = await makeUser([system, here])
+    await getRepository(Domain).update({ id: system.id }, { owner: superUser.id })
+
+    expect(await mayReset(superUser, here)).toBe(false)
+    await expect(reset(superUser, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+    expect(await stillHasOwnPassword(superUser)).toBe(true)
+  })
+
+  it("this domain's own owner", async () => {
+    const owner = await makeUser([here])
+    await getRepository(DomainOwner).save({ domain: here, user: owner })
+
+    expect(await mayReset(owner, here)).toBe(false)
+    await expect(reset(owner, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+  })
+
+  it('an admin account, as inactivateUser refuses it', async () => {
+    const admin = await makeUser([here], { userType: 'admin' })
+
+    expect(await mayReset(admin, here)).toBe(false)
+    await expect(reset(admin, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
+  })
+
+  it('the screen is told no for someone who is not a member here', async () => {
+    const stranger = await makeUser([other])
+
+    expect(await mayReset(stranger, here)).toBe(false)
+  })
+})

package/translations/en.json

@@ -29,6 +29,8 @@
   "error.x is not a member of y": "{x} is not a member of {y}",
   "error.x privilege required": "unauthorized! {x} privilege required",
   "error.role-not-assignable-here": "this domain cannot assign the role(s) {roles}.",
+  "error.password-reset-owner-account": "A domain owner's or administrator's password is not reset to the default.",
+  "error.password-reset-reaches-other-domains": "they also work in {domains}, so their password is not this $t(term.domain)'s to reset.",
   "error.x not allowed from this address": "unauthorized! {x} is not allowed from this address",
   "error.x not licensed": "unauthorized! {x} is not licensed on this installation",
   "error.x refused for this request": "unauthorized! {x} is refused for this request",

package/translations/es.json

@@ -29,6 +29,8 @@
   "error.x is not a member of y": "{x} no es miembro de {y}",
   "error.x privilege required": "¡no autorizado! se requiere el privilegio {x}",
   "error.role-not-assignable-here": "este dominio no puede asignar los roles {roles}.",
+  "error.password-reset-owner-account": "la contraseña de un propietario o administrador no se restablece al valor predeterminado.",
+  "error.password-reset-reaches-other-domains": "también trabaja en {domains}; este dominio no puede restablecer su contraseña.",
   "error.x not allowed from this address": "¡no autorizado! {x} no está permitido desde esta dirección",
   "error.x not licensed": "¡no autorizado! {x} no tiene licencia en esta instalación",
   "error.x refused for this request": "¡no autorizado! {x} se ha denegado para esta solicitud",

package/translations/ja.json

@@ -29,6 +29,8 @@
   "error.x is not a member of y": "{x}は{y}のメンバーではありません.",
   "error.x privilege required": "権限がありません。{x} 権限が必要です。",
   "error.role-not-assignable-here": "この$t(term.domain)では付与できないロールです: {roles}",
+  "error.password-reset-owner-account": "$t(term.domain)のオーナーや管理者のパスワードは初期値にリセットしません。",
+  "error.password-reset-reaches-other-domains": "{domains}でも利用している方のため、この$t(term.domain)ではパスワードをリセットできません。",
   "error.x not allowed from this address": "権限がありません。このアドレスからは {x} 権限を使えません。",
   "error.x not licensed": "権限がありません。このインストールのライセンスには {x} 権限がありません。",
   "error.x refused for this request": "権限がありません。このリクエストでは {x} 権限が許可されていません。",

package/translations/ko.json

@@ -29,6 +29,8 @@
   "error.x is not a member of y": "{x}은(는) {y}의 멤버가 아닙니다.",
   "error.x privilege required": "권한이 없습니다. {x} 권한이 필요합니다.",
   "error.role-not-assignable-here": "이 $t(term.domain)에서 줄 수 없는 역할입니다: {roles}",
+  "error.password-reset-owner-account": "$t(term.domain) 오너나 관리자의 비밀번호는 기본값으로 초기화하지 않습니다.",
+  "error.password-reset-reaches-other-domains": "{domains}에서도 일하는 사람이라 이 $t(term.domain)에서 비밀번호를 초기화할 수 없습니다.",
   "error.x not allowed from this address": "권한이 없습니다. 이 주소에서는 {x} 권한을 사용할 수 없습니다.",
   "error.x not licensed": "권한이 없습니다. 이 설치의 라이선스에는 {x} 권한이 없습니다.",
   "error.x refused for this request": "권한이 없습니다. 이 요청에는 {x} 권한이 허용되지 않습니다.",

package/translations/ms.json

@@ -29,6 +29,8 @@
   "error.x is not a member of y": "{x} bukan ahli {y}",
   "error.x privilege required": "tidak dibenarkan! kebenaran {x} diperlukan",
   "error.role-not-assignable-here": "$t(term.domain) ini tidak boleh memberikan peranan: {roles}",
+  "error.password-reset-owner-account": "Kata laluan pemilik $t(term.domain) atau pentadbir tidak ditetapkan semula kepada lalai.",
+  "error.password-reset-reaches-other-domains": "Pengguna ini juga bekerja di {domains}, jadi $t(term.domain) ini tidak boleh menetapkan semula kata laluannya.",
   "error.x not allowed from this address": "tidak dibenarkan! kebenaran {x} tidak dibenarkan dari alamat ini",
   "error.x not licensed": "tidak dibenarkan! kebenaran {x} tiada dalam lesen pemasangan ini",
   "error.x refused for this request": "tidak dibenarkan! kebenaran {x} ditolak untuk permintaan ini",

package/translations/zh.json

@@ -29,6 +29,8 @@
   "error.x is not a member of y": "{x}不是{y}的成员",
   "error.x privilege required": "没有权限。需要 {x} 权限。",
   "error.role-not-assignable-here": "此$t(term.domain)不能分配的角色: {roles}",
+  "error.password-reset-owner-account": "不会将$t(term.domain)所有者或管理员的密码重置为默认值。",
+  "error.password-reset-reaches-other-domains": "该用户也在{domains}中工作，此$t(term.domain)不能重置其密码。",
   "error.x not allowed from this address": "没有权限。从此地址不能使用 {x} 权限。",
   "error.x not licensed": "没有权限。此安装的许可证不包含 {x} 权限。",
   "error.x refused for this request": "没有权限。此请求不允许 {x} 权限。",