@tomei/sso 0.64.0-dev.1 → 0.64.0-staging.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomei/sso",
-  "version": "0.64.0-dev.1",
+  "version": "0.64.0-staging.1",
   "description": "Tomei SSO Package",
   "main": "dist/index.js",
   "scripts": {

package/src/components/login-user/user.ts

@@ -585,7 +585,7 @@ export class User extends UserBase {
           },
         });
         if (!system) {
-          throw new Error('Access denied: invalid or unauthorized system.');
+          throw new Error('Invalid credentials.');
         }
 
         // 1.5: Instantiate new PasswordHashService object and call PasswordHashService.verify method to check whether the param.Password is correct.
@@ -614,14 +614,12 @@ export class User extends UserBase {
             await User.releaseLock(this.UserId, dbTransaction);
             this.Status = UserStatus.ACTIVE;
           } else {
-            throw new Error(
-              'Your account has been locked. Please contact the administrator for assistance.',
-            );
+            throw new Error('Invalid credentials.');
           }
         }
       } catch (error) {
         await this.incrementFailedLoginAttemptCount(dbTransaction);
-        throw error;
+        throw new Error('Invalid credentials.');
       }
 
       // 2.1:  Call alertNewLogin to check whether the ip used is new ip and alert the user if it's new.
@@ -1734,7 +1732,7 @@ export class User extends UserBase {
       throw new ClassError(
         'LoginUser',
         'LoginUserErrMsg0X',
-        'Your account has been locked due to too many failed login attempts, please contact IT Support for instructions on how to unlock your account.',
+        'Invalid credentials.',
       );
     }
   }
@@ -1820,7 +1818,7 @@ export class User extends UserBase {
 
     // Part 2: Retrieve Parent Group System Access If Applicable
     // 2.1 Check if Params.group.InheritParentSystemAccessYN is "Y" and Params.group.ParentGroupCode is not empty
-    if (group.InheritParentSystemAccessYN === 'Y' && group.ParentGroupCode) {
+    if (group.InheritParentPrivilegeYN === 'Y' && group.ParentGroupCode) {
       const GroupCode = group.ParentGroupCode;
       const parentGroup = await User._GroupRepo.findByPk(
         GroupCode,
@@ -2005,31 +2003,15 @@ export class User extends UserBase {
     }
 
     // 3. Verify the mfaToken by calling speakeasy.totp.verify
-    const isCurrentValid = await speakeasy.totp.verify({
+    const isVerified = await speakeasy.totp.verify({
       secret: userMFAConfig.totp.secret,
       encoding: 'base32',
       token: mfaToken,
-      window: 0, // strict current time window
     });
-    if (!isCurrentValid) {
-      const isExpired = await speakeasy.totp.verify({
-        secret: userMFAConfig.totp.secret,
-        encoding: 'base32',
-        token: mfaToken,
-        window: 2, // allow slight leeway: previous or next 2 time steps
-      });
 
-      if (isExpired) {
-        return {
-          success: false,
-          reason: 'MFA token has expired. Please try again.',
-        };
-      } else {
-        return {
-          success: false,
-          reason: 'Invalid MFA token. Check your authenticator app.',
-        };
-      }
+    // 4. if not verified, then return false. if verified, Call LoginUser._Repo.update and update user data in database
+    if (!isVerified) {
+      return false;
     }
 
     user.MFAEnabled = 1;
@@ -2058,7 +2040,7 @@ export class User extends UserBase {
     const systemLogin = userSession.systemLogins.find(
       (e) => e.code === systemCode,
     );
-    return { success: true, sessionId: `${userId}:${systemLogin.sessionId}` };
+    return `${userId}:${systemLogin.sessionId}`;
   }
 
   // This method will verify  2FA codes
@@ -2096,31 +2078,15 @@ export class User extends UserBase {
     }
 
     // 3. Verify the mfaToken by calling speakeasy.totp.verify
-    const isCurrentValid = await speakeasy.totp.verify({
+    const isVerified = await speakeasy.totp.verify({
       secret: userMFAConfig.totp.secret,
       encoding: 'base32',
       token: mfaToken,
-      window: 0, // strict current time window
     });
-    if (!isCurrentValid) {
-      const isExpired = await speakeasy.totp.verify({
-        secret: userMFAConfig.totp.secret,
-        encoding: 'base32',
-        token: mfaToken,
-        window: 2, // allow slight leeway: previous or next 2 time steps
-      });
 
-      if (isExpired) {
-        return {
-          success: false,
-          reason: 'MFA token has expired. Please try again.',
-        };
-      } else {
-        return {
-          success: false,
-          reason: 'Invalid MFA token. Check your authenticator app.',
-        };
-      }
+    // 4. if not verified, then return false. if verified, Call LoginUser._Repo.update and update user data in database
+    if (!isVerified) {
+      return false;
     }
 
     // 5. Retrieve Session
@@ -2143,7 +2109,7 @@ export class User extends UserBase {
     const systemLogin = userSession.systemLogins.find(
       (e) => e.code === systemCode,
     );
-    return { success: true, sessionId: `${userId}:${systemLogin.sessionId}` };
+    return `${userId}:${systemLogin.sessionId}`;
   }
 
   public async bypass2FA(systemCode: string, dbTransaction: any) {
@@ -2186,10 +2152,7 @@ export class User extends UserBase {
       const systemLogin = userSession.systemLogins.find(
         (e) => e.code === systemCode,
       );
-      return {
-        success: true,
-        sessionId: `${this.UserId}:${systemLogin.sessionId}`,
-      };
+      return `${this.UserId}:${systemLogin.sessionId}`;
     } catch (error) {
       throw error;
     }

package/migrations/20250805085707-add-bulk-approval-code-to-sso-user.js

@@ -1,29 +0,0 @@
-'use strict';
-
-module.exports = {
-  up: async (queryInterface, Sequelize) => {
-    const transaction = await queryInterface.sequelize.transaction();
-    try {
-      await queryInterface.addColumn('sso_User', 'BulkApprovalCode', {
-        type: Sequelize.STRING(100),
-        allowNull: true,
-      });
-
-      await transaction.commit();
-    } catch (error) {
-      await transaction.rollback();
-      throw error;
-    }
-  },
-
-  down: async (queryInterface, Sequelize) => {
-    const transaction = await queryInterface.sequelize.transaction();
-    try {
-      await queryInterface.removeColumn('sso_User', 'BulkApprovalCode');
-      await transaction.commit();
-    } catch (error) {
-      await transaction.rollback();
-      throw error;
-    }
-  },
-};