@tomei/sso 0.65.0 → 0.65.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomei/sso",
-  "version": "0.65.0",
+  "version": "0.65.1",
   "description": "Tomei SSO Package",
   "main": "dist/index.js",
   "scripts": {

package/src/components/login-user/user.ts

@@ -2988,6 +2988,7 @@ export class User extends UserBase {
 
       this.Password = passwordHash;
       this.LastPasswordChangedAt = new Date();
+      this.NeedToChangePasswordYN = YN.No;
 
       const entityValueAfter: IUserAttr = {
         UserId: this.UserId,
@@ -3022,6 +3023,7 @@ export class User extends UserBase {
         {
           Password: this.Password,
           LastPasswordChangedAt: this.LastPasswordChangedAt,
+          NeedToChangePasswordYN: this.NeedToChangePasswordYN,
         },
         {
           where: {
@@ -3053,6 +3055,82 @@ export class User extends UserBase {
     }
   }
 
+  // PASSWORD_EXPIRY_MONTHS=0 disables the policy entirely (AC#1) - checked before NeedToChangePasswordYN/history.
+  async getPasswordExpiryStatus(dbTransaction?: any): Promise<{
+    expired: boolean;
+    expiringSoon: boolean;
+    expiresInDays: number | null;
+  }> {
+    try {
+      const expiryMonthsRaw = Number(process.env.PASSWORD_EXPIRY_MONTHS);
+      const expiryMonths = Number.isFinite(expiryMonthsRaw)
+        ? Math.max(0, Math.floor(expiryMonthsRaw))
+        : 0;
+
+      if (expiryMonths === 0) {
+        return { expired: false, expiringSoon: false, expiresInDays: null };
+      }
+
+      // Accounts authenticated without a local password cannot rotate one here.
+      if (!this.Password) {
+        return { expired: false, expiringSoon: false, expiresInDays: null };
+      }
+
+      // Forces first-login change for temp-password/admin-created accounts (AC#4), regardless of password age.
+      if (this.NeedToChangePasswordYN === YN.Yes) {
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const warningDaysRaw = Number(process.env.PASSWORD_EXPIRY_WARNING_DAYS);
+      const warningDays = Number.isFinite(warningDaysRaw)
+        ? Math.max(0, Math.floor(warningDaysRaw))
+        : 14;
+
+      const latestHistory = await UserPasswordHistory.getLatestByUserId(
+        dbTransaction,
+        this.UserId,
+      );
+
+      if (!latestHistory) {
+        // Legacy/pre-existing accounts without a history row.
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const createdAt = latestHistory.CreatedAt;
+      const expiryMonth = createdAt.getUTCMonth() + expiryMonths;
+      const lastDayOfExpiryMonth = new Date(
+        Date.UTC(createdAt.getUTCFullYear(), expiryMonth + 1, 0),
+      ).getUTCDate();
+      const expiryDate = new Date(
+        Date.UTC(
+          createdAt.getUTCFullYear(),
+          expiryMonth,
+          Math.min(createdAt.getUTCDate(), lastDayOfExpiryMonth),
+          createdAt.getUTCHours(),
+          createdAt.getUTCMinutes(),
+          createdAt.getUTCSeconds(),
+          createdAt.getUTCMilliseconds(),
+        ),
+      );
+
+      const now = new Date();
+      if (now.getTime() >= expiryDate.getTime()) {
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const msPerDay = 24 * 60 * 60 * 1000;
+      const expiringSoon =
+        now.getTime() >= expiryDate.getTime() - warningDays * msPerDay;
+      const expiresInDays = Math.ceil(
+        (expiryDate.getTime() - now.getTime()) / msPerDay,
+      );
+
+      return { expired: false, expiringSoon, expiresInDays };
+    } catch (error) {
+      throw error;
+    }
+  }
+
   async verifyPasscode(passcode: string) {
     try {
       // Return error if this._Userid is empty "User is not created yet."

package/src/components/user-password-history/user-password-history.ts

@@ -76,16 +76,30 @@ export class UserPasswordHistory
   ): Promise<void> {
     // This method used to check if password entered is valid by checking previous password history
     try {
-      // Part 1-2: Retrieve password history policy by using component config, call ComponentConfig. by passing:
+      // Part 1-2: Retrieve password history policy: env var takes precedence over component config, call ComponentConfig. by passing:
       // - ComponentName: "@tomei/sso"
       // - ConfigKey: "passwordHistory"
       // If no password history set, use default value 3
 
-      const passwordHistoryPolicy =
+      const envPasswordHistoryPolicy = Number(
+        process.env.PASSWORD_HISTORY_LIMIT,
+      );
+      const componentPasswordHistoryPolicy = Number(
         ComponentConfig.getComponentConfigValue(
           '@tomei/sso',
           'passwordHistory',
-        ) || 3;
+        ),
+      );
+      const passwordHistoryPolicy =
+        (Number.isFinite(envPasswordHistoryPolicy) &&
+        envPasswordHistoryPolicy > 0
+          ? Math.floor(envPasswordHistoryPolicy)
+          : 0) ||
+        (Number.isFinite(componentPasswordHistoryPolicy) &&
+        componentPasswordHistoryPolicy > 0
+          ? Math.floor(componentPasswordHistoryPolicy)
+          : 0) ||
+        3;
 
       // Part 3-4: Retrieve records from the table by using  class._repo findAll() by passing:
       // where: { UserId: params.UserId }
@@ -137,16 +151,30 @@ export class UserPasswordHistory
   ): Promise<void> {
     // This method used to check if password entered is valid by checking previous password history
     try {
-      // Part 1-2: Retrieve password history policy by using component config, call ComponentConfig. by passing:
+      // Part 1-2: Retrieve password history policy: env var takes precedence over component config, call ComponentConfig. by passing:
       // - ComponentName: "@tomei/sso"
       // - ConfigKey: "passwordHistory"
       // If no password history set, use default value 3
 
-      const passwordHistoryPolicy =
+      const envPasswordHistoryPolicy = Number(
+        process.env.PASSWORD_HISTORY_LIMIT,
+      );
+      const componentPasswordHistoryPolicy = Number(
         ComponentConfig.getComponentConfigValue(
           '@tomei/sso',
           'passwordHistory',
-        ) || 3;
+        ),
+      );
+      const passwordHistoryPolicy =
+        (Number.isFinite(envPasswordHistoryPolicy) &&
+        envPasswordHistoryPolicy > 0
+          ? Math.floor(envPasswordHistoryPolicy)
+          : 0) ||
+        (Number.isFinite(componentPasswordHistoryPolicy) &&
+        componentPasswordHistoryPolicy > 0
+          ? Math.floor(componentPasswordHistoryPolicy)
+          : 0) ||
+        3;
 
       // Part 3: Insert new password history by calling class _repo create() method.
       const userPasswordHistory = new UserPasswordHistory();
@@ -184,4 +212,27 @@ export class UserPasswordHistory
       throw error;
     }
   }
+
+  // Latest history row's CreatedAt is the source of truth for password age (used by User.getPasswordExpiryStatus()).
+  public static async getLatestByUserId(
+    dbTransaction: any,
+    UserId: number,
+  ): Promise<UserPasswordHistory | null> {
+    try {
+      const passwordHistory = await UserPasswordHistory._Repo.findAll({
+        where: { UserId: UserId },
+        order: [['CreatedAt', 'DESC']],
+        limit: 1,
+        transaction: dbTransaction,
+      });
+
+      if (!passwordHistory || passwordHistory.length < 1) {
+        return null;
+      }
+
+      return new UserPasswordHistory(passwordHistory[0].get({ plain: true }));
+    } catch (error) {
+      throw error;
+    }
+  }
 }