@tomei/sso 0.65.0 → 0.65.1

package/.gitlab-ci.yml

@@ -1,7 +1,13 @@
 variables:
   SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"  # Defines the location of the analysis task cache
   GIT_DEPTH: "0"  # Tells git to fetch all the branches of the project, required by the analysis task
+
+stages:
+  - build
+  - publish
+
 sonarcloud-check:
+  stage: build
   image:
     name: sonarsource/sonar-scanner-cli:latest
     entrypoint: [""]
@@ -14,3 +20,37 @@ sonarcloud-check:
   only:
     - merge_requests
     - main
+
+package-build:
+  stage: build
+  image: node:20-alpine
+  tags:
+    - shared
+  script:
+    - npm ci
+    - npm run build
+  artifacts:
+    paths:
+      - dist/
+    expire_in: 1 hour
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^prod-v[0-9]+\.[0-9]+\.[0-9]+(-retry\.[0-9]+)?$/'
+
+package-publish:
+  stage: publish
+  image: node:20-alpine
+  tags:
+    - shared
+  needs:
+    - job: package-build
+      artifacts: true
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^prod-v[0-9]+\.[0-9]+\.[0-9]+(-retry\.[0-9]+)?$/'
+      when: manual
+      allow_failure: false
+  script:
+    - npm ci
+    - test -n "$NPM_TOKEN"
+    - printf '%s\n' "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
+    - npm whoami --registry https://registry.npmjs.org/
+    - npm publish --tag latest --access public

package/__tests__/unit/components/login-user/password-expiry.spec.ts

@@ -0,0 +1,87 @@
+import { User } from '../../../../src/components/login-user/user';
+import { UserPasswordHistory } from '../../../../src/components/user-password-history/user-password-history';
+import { YN } from '../../../../src/enum/yn.enum';
+
+// User and LoginUser import each other; this test exercises only User's expiry policy.
+jest.mock('../../../../src/components/login-user/login-user', () => ({
+  LoginUser: class {},
+}));
+
+describe('User.getPasswordExpiryStatus', () => {
+  const originalExpiryMonths = process.env.PASSWORD_EXPIRY_MONTHS;
+  const originalWarningDays = process.env.PASSWORD_EXPIRY_WARNING_DAYS;
+
+  const user = (password: string | null) =>
+    Object.assign(Object.create(User.prototype), {
+      ObjectId: '123',
+      _Password: password,
+      _NeedToChangePasswordYN: YN.No,
+    }) as User;
+
+  beforeEach(() => {
+    process.env.PASSWORD_EXPIRY_MONTHS = '1';
+    process.env.PASSWORD_EXPIRY_WARNING_DAYS = '14';
+    jest.useFakeTimers().setSystemTime(new Date('2026-02-20T12:00:00Z'));
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    jest.useRealTimers();
+    if (originalExpiryMonths === undefined)
+      delete process.env.PASSWORD_EXPIRY_MONTHS;
+    else process.env.PASSWORD_EXPIRY_MONTHS = originalExpiryMonths;
+    if (originalWarningDays === undefined)
+      delete process.env.PASSWORD_EXPIRY_WARNING_DAYS;
+    else process.env.PASSWORD_EXPIRY_WARNING_DAYS = originalWarningDays;
+  });
+
+  it('disables expiry when the period is zero', async () => {
+    process.env.PASSWORD_EXPIRY_MONTHS = '0';
+    const lookup = jest.spyOn(UserPasswordHistory, 'getLatestByUserId');
+
+    expect(await user('hash').getPasswordExpiryStatus()).toEqual({
+      expired: false,
+      expiringSoon: false,
+      expiresInDays: null,
+    });
+    expect(lookup).not.toHaveBeenCalled();
+  });
+
+  it('skips an account without a local password', async () => {
+    const lookup = jest.spyOn(UserPasswordHistory, 'getLatestByUserId');
+
+    expect(await user(null).getPasswordExpiryStatus()).toEqual({
+      expired: false,
+      expiringSoon: false,
+      expiresInDays: null,
+    });
+    expect(lookup).not.toHaveBeenCalled();
+  });
+
+  it('expires an account without password history', async () => {
+    jest
+      .spyOn(UserPasswordHistory, 'getLatestByUserId')
+      .mockResolvedValue(null);
+
+    expect(await user('hash').getPasswordExpiryStatus()).toEqual({
+      expired: true,
+      expiringSoon: false,
+      expiresInDays: null,
+    });
+  });
+
+  it('warns before expiry and clamps month-end dates', async () => {
+    jest.spyOn(UserPasswordHistory, 'getLatestByUserId').mockResolvedValue({
+      CreatedAt: new Date('2026-01-31T12:00:00Z'),
+    } as UserPasswordHistory);
+
+    expect(await user('hash').getPasswordExpiryStatus()).toEqual({
+      expired: false,
+      expiringSoon: true,
+      expiresInDays: 8,
+    });
+
+    jest.setSystemTime(new Date('2026-02-28T12:00:00Z'));
+    expect((await user('hash').getPasswordExpiryStatus()).expired).toBe(true);
+  });
+});

package/dist/__tests__/unit/components/login-user/password-expiry.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/unit/components/login-user/password-expiry.spec.js

@@ -0,0 +1,86 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const user_1 = require("../../../../src/components/login-user/user");
+const user_password_history_1 = require("../../../../src/components/user-password-history/user-password-history");
+const yn_enum_1 = require("../../../../src/enum/yn.enum");
+jest.mock('../../../../src/components/login-user/login-user', () => ({
+    LoginUser: class {
+    },
+}));
+describe('User.getPasswordExpiryStatus', () => {
+    const originalExpiryMonths = process.env.PASSWORD_EXPIRY_MONTHS;
+    const originalWarningDays = process.env.PASSWORD_EXPIRY_WARNING_DAYS;
+    const user = (password) => Object.assign(Object.create(user_1.User.prototype), {
+        ObjectId: '123',
+        _Password: password,
+        _NeedToChangePasswordYN: yn_enum_1.YN.No,
+    });
+    beforeEach(() => {
+        process.env.PASSWORD_EXPIRY_MONTHS = '1';
+        process.env.PASSWORD_EXPIRY_WARNING_DAYS = '14';
+        jest.useFakeTimers().setSystemTime(new Date('2026-02-20T12:00:00Z'));
+    });
+    afterEach(() => {
+        jest.restoreAllMocks();
+        jest.useRealTimers();
+        if (originalExpiryMonths === undefined)
+            delete process.env.PASSWORD_EXPIRY_MONTHS;
+        else
+            process.env.PASSWORD_EXPIRY_MONTHS = originalExpiryMonths;
+        if (originalWarningDays === undefined)
+            delete process.env.PASSWORD_EXPIRY_WARNING_DAYS;
+        else
+            process.env.PASSWORD_EXPIRY_WARNING_DAYS = originalWarningDays;
+    });
+    it('disables expiry when the period is zero', () => __awaiter(void 0, void 0, void 0, function* () {
+        process.env.PASSWORD_EXPIRY_MONTHS = '0';
+        const lookup = jest.spyOn(user_password_history_1.UserPasswordHistory, 'getLatestByUserId');
+        expect(yield user('hash').getPasswordExpiryStatus()).toEqual({
+            expired: false,
+            expiringSoon: false,
+            expiresInDays: null,
+        });
+        expect(lookup).not.toHaveBeenCalled();
+    }));
+    it('skips an account without a local password', () => __awaiter(void 0, void 0, void 0, function* () {
+        const lookup = jest.spyOn(user_password_history_1.UserPasswordHistory, 'getLatestByUserId');
+        expect(yield user(null).getPasswordExpiryStatus()).toEqual({
+            expired: false,
+            expiringSoon: false,
+            expiresInDays: null,
+        });
+        expect(lookup).not.toHaveBeenCalled();
+    }));
+    it('expires an account without password history', () => __awaiter(void 0, void 0, void 0, function* () {
+        jest
+            .spyOn(user_password_history_1.UserPasswordHistory, 'getLatestByUserId')
+            .mockResolvedValue(null);
+        expect(yield user('hash').getPasswordExpiryStatus()).toEqual({
+            expired: true,
+            expiringSoon: false,
+            expiresInDays: null,
+        });
+    }));
+    it('warns before expiry and clamps month-end dates', () => __awaiter(void 0, void 0, void 0, function* () {
+        jest.spyOn(user_password_history_1.UserPasswordHistory, 'getLatestByUserId').mockResolvedValue({
+            CreatedAt: new Date('2026-01-31T12:00:00Z'),
+        });
+        expect(yield user('hash').getPasswordExpiryStatus()).toEqual({
+            expired: false,
+            expiringSoon: true,
+            expiresInDays: 8,
+        });
+        jest.setSystemTime(new Date('2026-02-28T12:00:00Z'));
+        expect((yield user('hash').getPasswordExpiryStatus()).expired).toBe(true);
+    }));
+});
+//# sourceMappingURL=password-expiry.spec.js.map

package/dist/__tests__/unit/components/login-user/password-expiry.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-expiry.spec.js","sourceRoot":"","sources":["../../../../../__tests__/unit/components/login-user/password-expiry.spec.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,qEAAkE;AAClE,kHAA6G;AAC7G,0DAAkD;AAGlD,IAAI,CAAC,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,SAAS,EAAE;KAAQ;CACpB,CAAC,CAAC,CAAC;AAEJ,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAChE,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAErE,MAAM,IAAI,GAAG,CAAC,QAAuB,EAAE,EAAE,CACvC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAI,CAAC,SAAS,CAAC,EAAE;QAC3C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,QAAQ;QACnB,uBAAuB,EAAE,YAAE,CAAC,EAAE;KAC/B,CAAS,CAAC;IAEb,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,GAAG,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,IAAI,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,oBAAoB,KAAK,SAAS;YACpC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;;YACvC,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,oBAAoB,CAAC;QAC/D,IAAI,mBAAmB,KAAK,SAAS;YACnC,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;;YAC7C,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,mBAAmB,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAS,EAAE;QACvD,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,GAAG,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,2CAAmB,EAAE,mBAAmB,CAAC,CAAC;QAEpE,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC;YAC3D,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAS,EAAE;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,2CAAmB,EAAE,mBAAmB,CAAC,CAAC;QAEpE,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC;YACzD,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAS,EAAE;QAC3D,IAAI;aACD,KAAK,CAAC,2CAAmB,EAAE,mBAAmB,CAAC;aAC/C,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE3B,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC;YAC3D,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAS,EAAE;QAC9D,IAAI,CAAC,KAAK,CAAC,2CAAmB,EAAE,mBAAmB,CAAC,CAAC,iBAAiB,CAAC;YACrE,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;SACrB,CAAC,CAAC;QAE1B,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC;YAC3D,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAA,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/components/login-user/user.d.ts

@@ -176,6 +176,11 @@ export declare class User extends UserBase {
     static findByEmail(AuthContext: AuthContext, dbTransaction: any, Email: string): Promise<User>;
     updatePasscode(loginUser: User, passcode: string, dbTransaction: any): Promise<void>;
     updatePassword(loginUser: User, oldPassword: string, newPassword: string, dbTransaction: any): Promise<void>;
+    getPasswordExpiryStatus(dbTransaction?: any): Promise<{
+        expired: boolean;
+        expiringSoon: boolean;
+        expiresInDays: number | null;
+    }>;
     verifyPasscode(passcode: string): Promise<void>;
     getReportingUser(dbTransaction: any): Promise<{
         Email: string;

package/dist/src/components/login-user/user.js

@@ -2042,6 +2042,7 @@ class User extends general_1.UserBase {
                 };
                 this.Password = passwordHash;
                 this.LastPasswordChangedAt = new Date();
+                this.NeedToChangePasswordYN = yn_enum_1.YN.No;
                 const entityValueAfter = {
                     UserId: this.UserId,
                     UserName: this.UserName,
@@ -2073,6 +2074,7 @@ class User extends general_1.UserBase {
                 yield User._Repository.update({
                     Password: this.Password,
                     LastPasswordChangedAt: this.LastPasswordChangedAt,
+                    NeedToChangePasswordYN: this.NeedToChangePasswordYN,
                 }, {
                     where: {
                         UserId: this.UserId,
@@ -2095,6 +2097,48 @@ class User extends general_1.UserBase {
             }
         });
     }
+    getPasswordExpiryStatus(dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const expiryMonthsRaw = Number(process.env.PASSWORD_EXPIRY_MONTHS);
+                const expiryMonths = Number.isFinite(expiryMonthsRaw)
+                    ? Math.max(0, Math.floor(expiryMonthsRaw))
+                    : 0;
+                if (expiryMonths === 0) {
+                    return { expired: false, expiringSoon: false, expiresInDays: null };
+                }
+                if (!this.Password) {
+                    return { expired: false, expiringSoon: false, expiresInDays: null };
+                }
+                if (this.NeedToChangePasswordYN === yn_enum_1.YN.Yes) {
+                    return { expired: true, expiringSoon: false, expiresInDays: null };
+                }
+                const warningDaysRaw = Number(process.env.PASSWORD_EXPIRY_WARNING_DAYS);
+                const warningDays = Number.isFinite(warningDaysRaw)
+                    ? Math.max(0, Math.floor(warningDaysRaw))
+                    : 14;
+                const latestHistory = yield user_password_history_1.UserPasswordHistory.getLatestByUserId(dbTransaction, this.UserId);
+                if (!latestHistory) {
+                    return { expired: true, expiringSoon: false, expiresInDays: null };
+                }
+                const createdAt = latestHistory.CreatedAt;
+                const expiryMonth = createdAt.getUTCMonth() + expiryMonths;
+                const lastDayOfExpiryMonth = new Date(Date.UTC(createdAt.getUTCFullYear(), expiryMonth + 1, 0)).getUTCDate();
+                const expiryDate = new Date(Date.UTC(createdAt.getUTCFullYear(), expiryMonth, Math.min(createdAt.getUTCDate(), lastDayOfExpiryMonth), createdAt.getUTCHours(), createdAt.getUTCMinutes(), createdAt.getUTCSeconds(), createdAt.getUTCMilliseconds()));
+                const now = new Date();
+                if (now.getTime() >= expiryDate.getTime()) {
+                    return { expired: true, expiringSoon: false, expiresInDays: null };
+                }
+                const msPerDay = 24 * 60 * 60 * 1000;
+                const expiringSoon = now.getTime() >= expiryDate.getTime() - warningDays * msPerDay;
+                const expiresInDays = Math.ceil((expiryDate.getTime() - now.getTime()) / msPerDay);
+                return { expired: false, expiringSoon, expiresInDays };
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
     verifyPasscode(passcode) {
         return __awaiter(this, void 0, void 0, function* () {
             try {