@tomei/sso 0.60.4-dev.1 → 0.60.4-dev.10

package/dist/src/components/login-user/user.js

@@ -100,6 +100,12 @@ class User extends general_1.UserBase {
     set MFAConfig(value) {
         this._MFAConfig = value;
     }
+    get MFABypassYN() {
+        return this._MFABypassYN;
+    }
+    set MFABypassYN(value) {
+        this._MFABypassYN = value;
+    }
     get RecoveryEmail() {
         return this._RecoveryEmail;
     }
@@ -203,6 +209,7 @@ class User extends general_1.UserBase {
             this.LastLoginAt = userInfo.LastLoginAt;
             this.MFAEnabled = userInfo.MFAEnabled;
             this.MFAConfig = userInfo.MFAConfig;
+            this.MFABypassYN = userInfo.MFABypassYN;
             this.RecoveryEmail = userInfo.RecoveryEmail;
             this.FailedLoginAttemptCount = userInfo.FailedLoginAttemptCount;
             this.LastFailedLoginAt = userInfo.LastFailedLoginAt;
@@ -253,6 +260,7 @@ class User extends general_1.UserBase {
                         LastLoginAt: user.LastLoginAt,
                         MFAEnabled: user.MFAEnabled,
                         MFAConfig: user.MFAConfig,
+                        MFABypassYN: user.MFABypassYN,
                         RecoveryEmail: user.RecoveryEmail,
                         FailedLoginAttemptCount: user.FailedLoginAttemptCount,
                         LastFailedLoginAt: user.LastFailedLoginAt,
@@ -312,6 +320,7 @@ class User extends general_1.UserBase {
                         LastLoginAt: user.LastLoginAt,
                         MFAEnabled: user.MFAEnabled,
                         MFAConfig: user.MFAConfig,
+                        MFABypassYN: user.MFABypassYN,
                         RecoveryEmail: user.RecoveryEmail,
                         FailedLoginAttemptCount: user.FailedLoginAttemptCount,
                         LastFailedLoginAt: user.LastFailedLoginAt,
@@ -389,6 +398,7 @@ class User extends general_1.UserBase {
                             LastLoginAt: user.LastLoginAt,
                             MFAEnabled: user.MFAEnabled,
                             MFAConfig: user.MFAConfig,
+                            MFABypassYN: user.MFABypassYN,
                             RecoveryEmail: user.RecoveryEmail,
                             FailedLoginAttemptCount: user.FailedLoginAttemptCount,
                             LastFailedLoginAt: user.LastFailedLoginAt,
@@ -441,7 +451,7 @@ class User extends general_1.UserBase {
                         },
                     });
                     if (!system) {
-                        throw new Error('Invalid credentials.');
+                        throw new Error('Access denied: invalid or unauthorized system.');
                     }
                     const passwordHashService = new password_hash_service_1.PasswordHashService();
                     const isPasswordValid = yield passwordHashService.verify(password, this.Password);
@@ -456,13 +466,13 @@ class User extends general_1.UserBase {
                             this.Status = enum_1.UserStatus.ACTIVE;
                         }
                         else {
-                            throw new Error('Invalid credentials.');
+                            throw new Error('Your account has been locked. Please contact the administrator for assistance.');
                         }
                     }
                 }
                 catch (error) {
                     yield this.incrementFailedLoginAttemptCount(dbTransaction);
-                    throw new Error('Invalid credentials.');
+                    throw error;
                 }
                 const system = yield User._SystemRepository.findOne({
                     where: {
@@ -1076,6 +1086,7 @@ class User extends general_1.UserBase {
                     LastLoginAt: null,
                     MFAEnabled: null,
                     MFAConfig: null,
+                    MFABypassYN: yn_enum_1.YN.No,
                     RecoveryEmail: null,
                     FailedLoginAttemptCount: 0,
                     LastFailedLoginAt: null,
@@ -1164,7 +1175,7 @@ class User extends general_1.UserBase {
                 throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Your account has been locked due to too many failed login attempts, please contact IT Support for instructions on how to unlock your account');
             }
             if (this.Status == enum_1.UserStatus.LOCKED) {
-                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Invalid credentials.');
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Your account has been locked due to too many failed login attempts, please contact IT Support for instructions on how to unlock your account.');
             }
         });
     }
@@ -1337,13 +1348,31 @@ class User extends general_1.UserBase {
                     console.error('Invalid JSON string on MFAConfig:', error);
                 }
             }
-            const isVerified = yield speakeasy.totp.verify({
+            const isCurrentValid = yield speakeasy.totp.verify({
                 secret: userMFAConfig.totp.secret,
                 encoding: 'base32',
                 token: mfaToken,
+                window: 0,
             });
-            if (!isVerified) {
-                return false;
+            if (!isCurrentValid) {
+                const isExpired = yield speakeasy.totp.verify({
+                    secret: userMFAConfig.totp.secret,
+                    encoding: 'base32',
+                    token: mfaToken,
+                    window: 2,
+                });
+                if (isExpired) {
+                    return {
+                        success: false,
+                        reason: 'MFA token has expired. Please try again.',
+                    };
+                }
+                else {
+                    return {
+                        success: false,
+                        reason: 'Invalid MFA token. Check your authenticator app.',
+                    };
+                }
             }
             user.MFAEnabled = 1;
             yield user.save({ transaction: dbTransaction });
@@ -1356,7 +1385,7 @@ class User extends general_1.UserBase {
                 systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
             }
             const systemLogin = userSession.systemLogins.find((e) => e.code === systemCode);
-            return `${userId}:${systemLogin.sessionId}`;
+            return { success: true, sessionId: `${userId}:${systemLogin.sessionId}` };
         });
     }
     verify2FACode(userId, mfaToken, systemCode, dbTransaction) {
@@ -1379,13 +1408,31 @@ class User extends general_1.UserBase {
                     console.error('Invalid JSON string on MFAConfig:', error);
                 }
             }
-            const isVerified = yield speakeasy.totp.verify({
+            const isCurrentValid = yield speakeasy.totp.verify({
                 secret: userMFAConfig.totp.secret,
                 encoding: 'base32',
                 token: mfaToken,
+                window: 0,
             });
-            if (!isVerified) {
-                return false;
+            if (!isCurrentValid) {
+                const isExpired = yield speakeasy.totp.verify({
+                    secret: userMFAConfig.totp.secret,
+                    encoding: 'base32',
+                    token: mfaToken,
+                    window: 2,
+                });
+                if (isExpired) {
+                    return {
+                        success: false,
+                        reason: 'MFA token has expired. Please try again.',
+                    };
+                }
+                else {
+                    return {
+                        success: false,
+                        reason: 'Invalid MFA token. Check your authenticator app.',
+                    };
+                }
             }
             const sessionName = config_1.ApplicationConfig.getComponentConfigValue('sessionName');
             if (!sessionName) {
@@ -1396,7 +1443,7 @@ class User extends general_1.UserBase {
                 systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
             }
             const systemLogin = userSession.systemLogins.find((e) => e.code === systemCode);
-            return `${userId}:${systemLogin.sessionId}`;
+            return { success: true, sessionId: `${userId}:${systemLogin.sessionId}` };
         });
     }
     bypass2FA(systemCode, dbTransaction) {
@@ -1420,7 +1467,10 @@ class User extends general_1.UserBase {
                     systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
                 }
                 const systemLogin = userSession.systemLogins.find((e) => e.code === systemCode);
-                return `${this.UserId}:${systemLogin.sessionId}`;
+                return {
+                    success: true,
+                    sessionId: `${this.UserId}:${systemLogin.sessionId}`,
+                };
             }
             catch (error) {
                 throw error;
@@ -1750,6 +1800,7 @@ class User extends general_1.UserBase {
                 LastLoginAt: user.LastLoginAt,
                 MFAEnabled: user.MFAEnabled,
                 MFAConfig: user.MFAConfig,
+                MFABypassYN: user.MFABypassYN,
                 RecoveryEmail: user.RecoveryEmail,
                 FailedLoginAttemptCount: user.FailedLoginAttemptCount,
                 LastFailedLoginAt: user.LastFailedLoginAt,
@@ -1832,6 +1883,7 @@ class User extends general_1.UserBase {
                     LastLoginAt: user.LastLoginAt,
                     MFAEnabled: user.MFAEnabled,
                     MFAConfig: user.MFAConfig,
+                    MFABypassYN: user.MFABypassYN,
                     RecoveryEmail: user.RecoveryEmail,
                     FailedLoginAttemptCount: user.FailedLoginAttemptCount,
                     LastFailedLoginAt: user.LastFailedLoginAt,
@@ -1877,6 +1929,7 @@ class User extends general_1.UserBase {
                     LastLoginAt: this.LastLoginAt,
                     MFAEnabled: this.MFAEnabled,
                     MFAConfig: this.MFAConfig,
+                    MFABypassYN: this.MFABypassYN,
                     RecoveryEmail: this.RecoveryEmail,
                     FailedLoginAttemptCount: this.FailedLoginAttemptCount,
                     LastFailedLoginAt: this.LastFailedLoginAt,
@@ -1906,6 +1959,7 @@ class User extends general_1.UserBase {
                     LastLoginAt: this.LastLoginAt,
                     MFAEnabled: this.MFAEnabled,
                     MFAConfig: this.MFAConfig,
+                    MFABypassYN: this.MFABypassYN,
                     RecoveryEmail: this.RecoveryEmail,
                     FailedLoginAttemptCount: this.FailedLoginAttemptCount,
                     LastFailedLoginAt: this.LastFailedLoginAt,
@@ -1967,6 +2021,7 @@ class User extends general_1.UserBase {
                     LastLoginAt: this.LastLoginAt,
                     MFAEnabled: this.MFAEnabled,
                     MFAConfig: this.MFAConfig,
+                    MFABypassYN: this.MFABypassYN,
                     RecoveryEmail: this.RecoveryEmail,
                     FailedLoginAttemptCount: this.FailedLoginAttemptCount,
                     LastFailedLoginAt: this.LastFailedLoginAt,
@@ -1996,6 +2051,7 @@ class User extends general_1.UserBase {
                     LastLoginAt: this.LastLoginAt,
                     MFAEnabled: this.MFAEnabled,
                     MFAConfig: this.MFAConfig,
+                    MFABypassYN: this.MFABypassYN,
                     RecoveryEmail: this.RecoveryEmail,
                     FailedLoginAttemptCount: this.FailedLoginAttemptCount,
                     LastFailedLoginAt: this.LastFailedLoginAt,
@@ -2122,6 +2178,293 @@ class User extends general_1.UserBase {
             }
         });
     }
+    enable2FABypass(loginUser, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                if (this.MFABypassYN === yn_enum_1.YN.Yes) {
+                    throw new general_1.ClassError('User', 'UserErrMsg0X', 'Bypass already enabled.', 'enable2FABypass');
+                }
+                const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+                const isPrivileged = yield loginUser.checkPrivileges(systemCode, 'MANAGE_MFA');
+                if (!isPrivileged) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'You do not have permission to enable MFA bypass.');
+                }
+                const entityValueBefore = {
+                    UserId: this.UserId,
+                    UserName: this.UserName,
+                    FullName: this.FullName,
+                    IDNo: this.IDNo,
+                    IDType: this.IDType,
+                    ContactNo: this.ContactNo,
+                    Email: this.Email,
+                    Password: this.Password,
+                    Status: this.Status,
+                    DefaultPasswordChangedYN: this.DefaultPasswordChangedYN,
+                    FirstLoginAt: this.FirstLoginAt,
+                    LastLoginAt: this.LastLoginAt,
+                    MFAEnabled: this.MFAEnabled,
+                    MFAConfig: this.MFAConfig,
+                    MFABypassYN: this.MFABypassYN,
+                    RecoveryEmail: this.RecoveryEmail,
+                    FailedLoginAttemptCount: this.FailedLoginAttemptCount,
+                    LastFailedLoginAt: this.LastFailedLoginAt,
+                    LastPasswordChangedAt: this.LastPasswordChangedAt,
+                    NeedToChangePasswordYN: this.NeedToChangePasswordYN,
+                    CreatedById: this.CreatedById,
+                    CreatedAt: this.CreatedAt,
+                    UpdatedById: this.UpdatedById,
+                    UpdatedAt: this.UpdatedAt,
+                    PasscodeHash: this.PasscodeHash,
+                    PasscodeUpdatedAt: this.PasscodeUpdatedAt,
+                };
+                this.MFABypassYN = yn_enum_1.YN.Yes;
+                this.UpdatedAt = new Date();
+                this.UpdatedById = loginUser.UserId;
+                yield User._Repository.update({
+                    MFABypassYN: this.MFABypassYN,
+                    UpdatedAt: this.UpdatedAt,
+                    UpdatedById: this.UpdatedById,
+                }, {
+                    where: {
+                        UserId: this.UserId,
+                    },
+                    transaction: dbTransaction,
+                });
+                const entityValueAfter = {
+                    UserId: this.UserId,
+                    UserName: this.UserName,
+                    FullName: this.FullName,
+                    IDNo: this.IDNo,
+                    IDType: this.IDType,
+                    ContactNo: this.ContactNo,
+                    Email: this.Email,
+                    Password: this.Password,
+                    Status: this.Status,
+                    DefaultPasswordChangedYN: this.DefaultPasswordChangedYN,
+                    FirstLoginAt: this.FirstLoginAt,
+                    LastLoginAt: this.LastLoginAt,
+                    MFAEnabled: this.MFAEnabled,
+                    MFAConfig: this.MFAConfig,
+                    MFABypassYN: this.MFABypassYN,
+                    RecoveryEmail: this.RecoveryEmail,
+                    FailedLoginAttemptCount: this.FailedLoginAttemptCount,
+                    LastFailedLoginAt: this.LastFailedLoginAt,
+                    LastPasswordChangedAt: this.LastPasswordChangedAt,
+                    NeedToChangePasswordYN: this.NeedToChangePasswordYN,
+                    CreatedById: this.CreatedById,
+                    CreatedAt: this.CreatedAt,
+                    UpdatedById: this.UpdatedById,
+                    UpdatedAt: this.UpdatedAt,
+                    PasscodeHash: this.PasscodeHash,
+                    PasscodeUpdatedAt: this.PasscodeUpdatedAt,
+                };
+                const activity = new activity_history_1.Activity();
+                activity.ActivityId = activity.createId();
+                activity.Action = activity_history_1.ActionEnum.UPDATE;
+                activity.Description = `Enable 2FA Bypass For User ${this.Email}`;
+                activity.EntityType = this.ObjectType;
+                activity.EntityId = this.UserId.toString();
+                activity.EntityValueBefore = JSON.stringify(entityValueBefore);
+                activity.EntityValueAfter = JSON.stringify(entityValueAfter);
+                yield activity.create(loginUser.ObjectId, dbTransaction);
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    disable2FABypass(loginUser, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                if (this.MFABypassYN === yn_enum_1.YN.No) {
+                    throw new general_1.ClassError('User', 'UserErrMsg0X', 'Bypass already disabled.', 'disable2FABypass');
+                }
+                const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+                const isPrivileged = yield loginUser.checkPrivileges(systemCode, 'MANAGE_MFA');
+                if (!isPrivileged) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'You do not have permission to enable MFA bypass.');
+                }
+                const entityValueBefore = {
+                    UserId: this.UserId,
+                    UserName: this.UserName,
+                    FullName: this.FullName,
+                    IDNo: this.IDNo,
+                    IDType: this.IDType,
+                    ContactNo: this.ContactNo,
+                    Email: this.Email,
+                    Password: this.Password,
+                    Status: this.Status,
+                    DefaultPasswordChangedYN: this.DefaultPasswordChangedYN,
+                    FirstLoginAt: this.FirstLoginAt,
+                    LastLoginAt: this.LastLoginAt,
+                    MFAEnabled: this.MFAEnabled,
+                    MFAConfig: this.MFAConfig,
+                    MFABypassYN: this.MFABypassYN,
+                    RecoveryEmail: this.RecoveryEmail,
+                    FailedLoginAttemptCount: this.FailedLoginAttemptCount,
+                    LastFailedLoginAt: this.LastFailedLoginAt,
+                    LastPasswordChangedAt: this.LastPasswordChangedAt,
+                    NeedToChangePasswordYN: this.NeedToChangePasswordYN,
+                    CreatedById: this.CreatedById,
+                    CreatedAt: this.CreatedAt,
+                    UpdatedById: this.UpdatedById,
+                    UpdatedAt: this.UpdatedAt,
+                    PasscodeHash: this.PasscodeHash,
+                    PasscodeUpdatedAt: this.PasscodeUpdatedAt,
+                };
+                this.MFABypassYN = yn_enum_1.YN.No;
+                this.UpdatedAt = new Date();
+                this.UpdatedById = loginUser.UserId;
+                yield User._Repository.update({
+                    MFABypassYN: this.MFABypassYN,
+                    UpdatedAt: this.UpdatedAt,
+                    UpdatedById: this.UpdatedById,
+                }, {
+                    where: {
+                        UserId: this.UserId,
+                    },
+                    transaction: dbTransaction,
+                });
+                const entityValueAfter = {
+                    UserId: this.UserId,
+                    UserName: this.UserName,
+                    FullName: this.FullName,
+                    IDNo: this.IDNo,
+                    IDType: this.IDType,
+                    ContactNo: this.ContactNo,
+                    Email: this.Email,
+                    Password: this.Password,
+                    Status: this.Status,
+                    DefaultPasswordChangedYN: this.DefaultPasswordChangedYN,
+                    FirstLoginAt: this.FirstLoginAt,
+                    LastLoginAt: this.LastLoginAt,
+                    MFAEnabled: this.MFAEnabled,
+                    MFAConfig: this.MFAConfig,
+                    MFABypassYN: this.MFABypassYN,
+                    RecoveryEmail: this.RecoveryEmail,
+                    FailedLoginAttemptCount: this.FailedLoginAttemptCount,
+                    LastFailedLoginAt: this.LastFailedLoginAt,
+                    LastPasswordChangedAt: this.LastPasswordChangedAt,
+                    NeedToChangePasswordYN: this.NeedToChangePasswordYN,
+                    CreatedById: this.CreatedById,
+                    CreatedAt: this.CreatedAt,
+                    UpdatedById: this.UpdatedById,
+                    UpdatedAt: this.UpdatedAt,
+                    PasscodeHash: this.PasscodeHash,
+                    PasscodeUpdatedAt: this.PasscodeUpdatedAt,
+                };
+                const activity = new activity_history_1.Activity();
+                activity.ActivityId = activity.createId();
+                activity.Action = activity_history_1.ActionEnum.UPDATE;
+                activity.Description = `Disable 2FA Bypass For User ${this.Email}`;
+                activity.EntityType = this.ObjectType;
+                activity.EntityId = this.UserId.toString();
+                activity.EntityValueBefore = JSON.stringify(entityValueBefore);
+                activity.EntityValueAfter = JSON.stringify(entityValueAfter);
+                yield activity.create(loginUser.ObjectId, dbTransaction);
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    reset2FA(loginUser, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                if (this.MFAEnabled === 0) {
+                    throw new general_1.ClassError('User', 'UserErrMsg0X', 'User not yet setup 2FA.', 'reset2FA');
+                }
+                const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+                const isPrivileged = yield loginUser.checkPrivileges(systemCode, 'MANAGE_MFA');
+                if (!isPrivileged) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'You do not have permission to reset 2FA.');
+                }
+                const entityValueBefore = {
+                    UserId: this.UserId,
+                    UserName: this.UserName,
+                    FullName: this.FullName,
+                    IDNo: this.IDNo,
+                    IDType: this.IDType,
+                    ContactNo: this.ContactNo,
+                    Email: this.Email,
+                    Password: this.Password,
+                    Status: this.Status,
+                    DefaultPasswordChangedYN: this.DefaultPasswordChangedYN,
+                    FirstLoginAt: this.FirstLoginAt,
+                    LastLoginAt: this.LastLoginAt,
+                    MFAEnabled: this.MFAEnabled,
+                    MFAConfig: this.MFAConfig,
+                    MFABypassYN: this.MFABypassYN,
+                    RecoveryEmail: this.RecoveryEmail,
+                    FailedLoginAttemptCount: this.FailedLoginAttemptCount,
+                    LastFailedLoginAt: this.LastFailedLoginAt,
+                    LastPasswordChangedAt: this.LastPasswordChangedAt,
+                    NeedToChangePasswordYN: this.NeedToChangePasswordYN,
+                    CreatedById: this.CreatedById,
+                    CreatedAt: this.CreatedAt,
+                    UpdatedById: this.UpdatedById,
+                    UpdatedAt: this.UpdatedAt,
+                    PasscodeHash: this.PasscodeHash,
+                    PasscodeUpdatedAt: this.PasscodeUpdatedAt,
+                };
+                this.MFAEnabled = 0;
+                this.MFABypassYN = yn_enum_1.YN.No;
+                this.UpdatedAt = new Date();
+                this.UpdatedById = loginUser.UserId;
+                yield User._Repository.update({
+                    MFAEnabled: this.MFAEnabled,
+                    MFABypassYN: this.MFABypassYN,
+                    UpdatedAt: this.UpdatedAt,
+                    UpdatedById: this.UpdatedById,
+                }, {
+                    where: {
+                        UserId: this.UserId,
+                    },
+                    transaction: dbTransaction,
+                });
+                const entityValueAfter = {
+                    UserId: this.UserId,
+                    UserName: this.UserName,
+                    FullName: this.FullName,
+                    IDNo: this.IDNo,
+                    IDType: this.IDType,
+                    ContactNo: this.ContactNo,
+                    Email: this.Email,
+                    Password: this.Password,
+                    Status: this.Status,
+                    DefaultPasswordChangedYN: this.DefaultPasswordChangedYN,
+                    FirstLoginAt: this.FirstLoginAt,
+                    LastLoginAt: this.LastLoginAt,
+                    MFAEnabled: this.MFAEnabled,
+                    MFAConfig: this.MFAConfig,
+                    MFABypassYN: this.MFABypassYN,
+                    RecoveryEmail: this.RecoveryEmail,
+                    FailedLoginAttemptCount: this.FailedLoginAttemptCount,
+                    LastFailedLoginAt: this.LastFailedLoginAt,
+                    LastPasswordChangedAt: this.LastPasswordChangedAt,
+                    NeedToChangePasswordYN: this.NeedToChangePasswordYN,
+                    CreatedById: this.CreatedById,
+                    CreatedAt: this.CreatedAt,
+                    UpdatedById: this.UpdatedById,
+                    UpdatedAt: this.UpdatedAt,
+                    PasscodeHash: this.PasscodeHash,
+                    PasscodeUpdatedAt: this.PasscodeUpdatedAt,
+                };
+                const activity = new activity_history_1.Activity();
+                activity.ActivityId = activity.createId();
+                activity.Action = activity_history_1.ActionEnum.UPDATE;
+                activity.Description = `Reset 2FA for User ${this.Email}`;
+                activity.EntityType = this.ObjectType;
+                activity.EntityId = this.UserId.toString();
+                activity.EntityValueBefore = JSON.stringify(entityValueBefore);
+                activity.EntityValueAfter = JSON.stringify(entityValueAfter);
+                yield activity.create(loginUser.ObjectId, dbTransaction);
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
 }
 exports.User = User;
 User._Repository = new user_repository_1.UserRepository();