@tomei/sso 0.65.1-test.1 → 0.65.1

package/jest.config.js

@@ -4,8 +4,6 @@ module.exports = {
   preset: 'ts-jest',
   testTimeout: 20000,
   coverageDirectory: "coverage",
-  collectCoverage: true,
-  coverageReporters: ['text', 'cobertura'],
   testEnvironment: 'node',
   "modulePathIgnorePatterns": [
     "<rootDir>/dist"

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@tomei/sso",
-  "version": "0.65.1-test.1",
+  "version": "0.65.1",
   "description": "Tomei SSO Package",
   "main": "dist/index.js",
   "scripts": {
     "start:dev": "tsc -w",
     "build": "tsc",
-    "prepare": "husky install || true",
+    "prepare": "husky",
     "format": "prettier --write \"src/**/*.ts\"",
     "lint": "npx eslint . --fix",
     "test": "jest --forceExit --detectOpenHandles --coverage"

package/src/components/login-user/user.ts

@@ -2988,6 +2988,7 @@ export class User extends UserBase {
 
       this.Password = passwordHash;
       this.LastPasswordChangedAt = new Date();
+      this.NeedToChangePasswordYN = YN.No;
 
       const entityValueAfter: IUserAttr = {
         UserId: this.UserId,
@@ -3022,6 +3023,7 @@ export class User extends UserBase {
         {
           Password: this.Password,
           LastPasswordChangedAt: this.LastPasswordChangedAt,
+          NeedToChangePasswordYN: this.NeedToChangePasswordYN,
         },
         {
           where: {
@@ -3053,6 +3055,82 @@ export class User extends UserBase {
     }
   }
 
+  // PASSWORD_EXPIRY_MONTHS=0 disables the policy entirely (AC#1) - checked before NeedToChangePasswordYN/history.
+  async getPasswordExpiryStatus(dbTransaction?: any): Promise<{
+    expired: boolean;
+    expiringSoon: boolean;
+    expiresInDays: number | null;
+  }> {
+    try {
+      const expiryMonthsRaw = Number(process.env.PASSWORD_EXPIRY_MONTHS);
+      const expiryMonths = Number.isFinite(expiryMonthsRaw)
+        ? Math.max(0, Math.floor(expiryMonthsRaw))
+        : 0;
+
+      if (expiryMonths === 0) {
+        return { expired: false, expiringSoon: false, expiresInDays: null };
+      }
+
+      // Accounts authenticated without a local password cannot rotate one here.
+      if (!this.Password) {
+        return { expired: false, expiringSoon: false, expiresInDays: null };
+      }
+
+      // Forces first-login change for temp-password/admin-created accounts (AC#4), regardless of password age.
+      if (this.NeedToChangePasswordYN === YN.Yes) {
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const warningDaysRaw = Number(process.env.PASSWORD_EXPIRY_WARNING_DAYS);
+      const warningDays = Number.isFinite(warningDaysRaw)
+        ? Math.max(0, Math.floor(warningDaysRaw))
+        : 14;
+
+      const latestHistory = await UserPasswordHistory.getLatestByUserId(
+        dbTransaction,
+        this.UserId,
+      );
+
+      if (!latestHistory) {
+        // Legacy/pre-existing accounts without a history row.
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const createdAt = latestHistory.CreatedAt;
+      const expiryMonth = createdAt.getUTCMonth() + expiryMonths;
+      const lastDayOfExpiryMonth = new Date(
+        Date.UTC(createdAt.getUTCFullYear(), expiryMonth + 1, 0),
+      ).getUTCDate();
+      const expiryDate = new Date(
+        Date.UTC(
+          createdAt.getUTCFullYear(),
+          expiryMonth,
+          Math.min(createdAt.getUTCDate(), lastDayOfExpiryMonth),
+          createdAt.getUTCHours(),
+          createdAt.getUTCMinutes(),
+          createdAt.getUTCSeconds(),
+          createdAt.getUTCMilliseconds(),
+        ),
+      );
+
+      const now = new Date();
+      if (now.getTime() >= expiryDate.getTime()) {
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const msPerDay = 24 * 60 * 60 * 1000;
+      const expiringSoon =
+        now.getTime() >= expiryDate.getTime() - warningDays * msPerDay;
+      const expiresInDays = Math.ceil(
+        (expiryDate.getTime() - now.getTime()) / msPerDay,
+      );
+
+      return { expired: false, expiringSoon, expiresInDays };
+    } catch (error) {
+      throw error;
+    }
+  }
+
   async verifyPasscode(passcode: string) {
     try {
       // Return error if this._Userid is empty "User is not created yet."

package/src/components/user-password-history/user-password-history.ts

@@ -76,16 +76,30 @@ export class UserPasswordHistory
   ): Promise<void> {
     // This method used to check if password entered is valid by checking previous password history
     try {
-      // Part 1-2: Retrieve password history policy by using component config, call ComponentConfig. by passing:
+      // Part 1-2: Retrieve password history policy: env var takes precedence over component config, call ComponentConfig. by passing:
       // - ComponentName: "@tomei/sso"
       // - ConfigKey: "passwordHistory"
       // If no password history set, use default value 3
 
-      const passwordHistoryPolicy =
+      const envPasswordHistoryPolicy = Number(
+        process.env.PASSWORD_HISTORY_LIMIT,
+      );
+      const componentPasswordHistoryPolicy = Number(
         ComponentConfig.getComponentConfigValue(
           '@tomei/sso',
           'passwordHistory',
-        ) || 3;
+        ),
+      );
+      const passwordHistoryPolicy =
+        (Number.isFinite(envPasswordHistoryPolicy) &&
+        envPasswordHistoryPolicy > 0
+          ? Math.floor(envPasswordHistoryPolicy)
+          : 0) ||
+        (Number.isFinite(componentPasswordHistoryPolicy) &&
+        componentPasswordHistoryPolicy > 0
+          ? Math.floor(componentPasswordHistoryPolicy)
+          : 0) ||
+        3;
 
       // Part 3-4: Retrieve records from the table by using  class._repo findAll() by passing:
       // where: { UserId: params.UserId }
@@ -137,16 +151,30 @@ export class UserPasswordHistory
   ): Promise<void> {
     // This method used to check if password entered is valid by checking previous password history
     try {
-      // Part 1-2: Retrieve password history policy by using component config, call ComponentConfig. by passing:
+      // Part 1-2: Retrieve password history policy: env var takes precedence over component config, call ComponentConfig. by passing:
       // - ComponentName: "@tomei/sso"
       // - ConfigKey: "passwordHistory"
       // If no password history set, use default value 3
 
-      const passwordHistoryPolicy =
+      const envPasswordHistoryPolicy = Number(
+        process.env.PASSWORD_HISTORY_LIMIT,
+      );
+      const componentPasswordHistoryPolicy = Number(
         ComponentConfig.getComponentConfigValue(
           '@tomei/sso',
           'passwordHistory',
-        ) || 3;
+        ),
+      );
+      const passwordHistoryPolicy =
+        (Number.isFinite(envPasswordHistoryPolicy) &&
+        envPasswordHistoryPolicy > 0
+          ? Math.floor(envPasswordHistoryPolicy)
+          : 0) ||
+        (Number.isFinite(componentPasswordHistoryPolicy) &&
+        componentPasswordHistoryPolicy > 0
+          ? Math.floor(componentPasswordHistoryPolicy)
+          : 0) ||
+        3;
 
       // Part 3: Insert new password history by calling class _repo create() method.
       const userPasswordHistory = new UserPasswordHistory();
@@ -184,4 +212,27 @@ export class UserPasswordHistory
       throw error;
     }
   }
+
+  // Latest history row's CreatedAt is the source of truth for password age (used by User.getPasswordExpiryStatus()).
+  public static async getLatestByUserId(
+    dbTransaction: any,
+    UserId: number,
+  ): Promise<UserPasswordHistory | null> {
+    try {
+      const passwordHistory = await UserPasswordHistory._Repo.findAll({
+        where: { UserId: UserId },
+        order: [['CreatedAt', 'DESC']],
+        limit: 1,
+        transaction: dbTransaction,
+      });
+
+      if (!passwordHistory || passwordHistory.length < 1) {
+        return null;
+      }
+
+      return new UserPasswordHistory(passwordHistory[0].get({ plain: true }));
+    } catch (error) {
+      throw error;
+    }
+  }
 }

package/__tests__/unit/components/api-key/api-key.spec.ts

@@ -1,201 +0,0 @@
-import { APIKey } from '../../../../src/components/api-key/api-key';
-import { APIKeyRepository } from '../../../../src/components/api-key/api-key.repository';
-import { LoginUser } from '../../../../src/components/login-user/login-user';
-import { ApplicationConfig } from '@tomei/config';
-import { Activity } from '@tomei/activity-history';
-import { ClassError } from '@tomei/general';
-import { System } from '../../../../src/components/system/system';
-import { APIKeyStatusEnum } from '../../../../src/enum/api-key.enum';
-
-describe('APIKey', () => {
-  const loginUser = new (LoginUser.prototype as any).constructor();
-  loginUser.ObjectId = '1';
-  loginUser.UserId = 1;
-
-  const apiKeyData = {
-    APIKeyId: 1,
-    ApiKey: 'abc123def456',
-    Name: 'Test Key',
-    SystemCode: 'TST',
-    Description: 'Test description',
-    Status: APIKeyStatusEnum.ACTIVE,
-    ExpirationDate: new Date('2027-01-01'),
-    RevokedById: null,
-    RevokedAt: null,
-    CreatedAt: new Date('2024-01-01'),
-    CreatedById: 1,
-    get: function (opts?: any) {
-      if (opts?.plain) return this;
-      return this;
-    },
-  };
-
-  afterEach(() => {
-    jest.clearAllMocks();
-  });
-
-  beforeEach(() => {
-    jest
-      .spyOn(ApplicationConfig, 'getComponentConfigValue')
-      .mockReturnValue('TST' as any);
-    jest
-      .spyOn(Activity.prototype, 'create')
-      .mockResolvedValue(undefined as any);
-    jest
-      .spyOn(LoginUser.prototype, 'checkPrivileges')
-      .mockResolvedValue(true as any);
-  });
-
-  describe('init', () => {
-    it('should return a new APIKey instance when no ApiKeyId is provided', async () => {
-      const result = await APIKey.init();
-      expect(result).toBeInstanceOf(APIKey);
-      expect(result.APIKeyId).toBeNaN();
-    });
-
-    it('should initialize APIKey with valid ApiKeyId', async () => {
-      jest
-        .spyOn(APIKeyRepository.prototype, 'findByPk')
-        .mockResolvedValueOnce(apiKeyData as any);
-
-      const result = await APIKey.init(1);
-
-      expect(result).toBeInstanceOf(APIKey);
-      expect(result.Name).toBe('Test Key');
-    });
-
-    it('should throw ClassError when ApiKeyId is not found', async () => {
-      jest
-        .spyOn(APIKeyRepository.prototype, 'findByPk')
-        .mockResolvedValueOnce(null);
-
-      await expect(APIKey.init(999)).rejects.toThrow('APIKey not found');
-    });
-  });
-
-  describe('generate', () => {
-    it('should throw when user lacks API_KEY_CREATE privilege', async () => {
-      jest
-        .spyOn(LoginUser.prototype, 'checkPrivileges')
-        .mockResolvedValueOnce(false as any);
-
-      const apiKey = await APIKey.init();
-      apiKey.SystemCode = 'TST';
-
-      await expect(apiKey.generate(loginUser)).rejects.toThrow(
-        'User does not have privilege to generate API key.',
-      );
-    });
-
-    it('should generate an API key successfully', async () => {
-      jest
-        .spyOn(System, 'init')
-        .mockResolvedValueOnce(new (System.prototype as any).constructor() as any);
-      jest
-        .spyOn(APIKeyRepository.prototype, 'create')
-        .mockResolvedValueOnce({ ...apiKeyData, APIKeyId: 1 } as any);
-
-      const apiKey = await APIKey.init();
-      apiKey.SystemCode = 'TST';
-      apiKey.Name = 'Test Key';
-      apiKey.Status = APIKeyStatusEnum.ACTIVE;
-
-      const result = await apiKey.generate(loginUser);
-
-      expect(result).toHaveProperty('ApiKey');
-      expect(result.Name).toBe('Test Key');
-    });
-  });
-
-  describe('findAll', () => {
-    it('should throw when user lacks API_KEY_VIEW privilege', async () => {
-      jest
-        .spyOn(LoginUser.prototype, 'checkPrivileges')
-        .mockResolvedValueOnce(false as any);
-
-      await expect(
-        APIKey.findAll({ page: 1, limit: 10 }, loginUser, null, {}),
-      ).rejects.toThrow('User does not have privilege to generate API key.');
-    });
-
-    it('should return paginated API keys', async () => {
-      jest
-        .spyOn(APIKeyRepository.prototype, 'findAllWithPagination')
-        .mockResolvedValueOnce({
-          count: 1,
-          rows: [new (APIKey.prototype as any).constructor(apiKeyData)],
-        } as any);
-
-      const result = await APIKey.findAll(
-        { page: 1, limit: 10 },
-        loginUser,
-        null,
-        { SystemCode: 'TST' },
-      );
-
-      expect(result.total).toBe(1);
-      expect(result.ApiKeys).toHaveLength(1);
-      expect(result.page).toBe(1);
-      expect(result.limit).toBe(10);
-    });
-
-    it('should apply filters correctly', async () => {
-      const spy = jest
-        .spyOn(APIKeyRepository.prototype, 'findAllWithPagination')
-        .mockResolvedValueOnce({ count: 0, rows: [] } as any);
-
-      const fromDate = new Date('2024-01-01');
-      const toDate = new Date('2024-12-31');
-
-      await APIKey.findAll(
-        { page: 1, limit: 10 },
-        loginUser,
-        null,
-        {
-          Status: APIKeyStatusEnum.ACTIVE,
-          ExpirationDate: { FromDate: fromDate, ToDate: toDate },
-          CreatedById: 1,
-        },
-        { SortBy: 'CreatedAt', SortOrder: 'ASC' },
-      );
-
-      expect(spy).toHaveBeenCalledTimes(1);
-    });
-  });
-
-  describe('revoke', () => {
-    it('should throw when API key is not found', async () => {
-      jest
-        .spyOn(APIKeyRepository.prototype, 'findOne')
-        .mockResolvedValueOnce(null);
-
-      const apiKey = await APIKey.init();
-      await expect(
-        apiKey.revoke('nonexistent-key', loginUser, null),
-      ).rejects.toThrow('API key not found.');
-    });
-
-    it('should revoke an API key successfully', async () => {
-      const apiKeyRecord = {
-        ...apiKeyData,
-        Status: APIKeyStatusEnum.ACTIVE,
-        RevokedAt: null,
-        RevokedById: null,
-        RevokedReason: null,
-        get: (opts?: any) => ({ ...apiKeyData }),
-      };
-      jest
-        .spyOn(APIKeyRepository.prototype, 'findOne')
-        .mockResolvedValueOnce(apiKeyRecord as any);
-      jest
-        .spyOn(APIKeyRepository.prototype, 'update')
-        .mockResolvedValueOnce(undefined as any);
-
-      const apiKey = await APIKey.init();
-      const result = await apiKey.revoke('abc123def456', loginUser, null, 'No longer needed');
-
-      expect(result.Status).toBe(APIKeyStatusEnum.REVOKED);
-      expect(result.RevokedReason).toBe('No longer needed');
-    });
-  });
-});

package/__tests__/unit/components/user-password-history/user-password-history.spec.ts

@@ -1,165 +0,0 @@
-import { UserPasswordHistory } from '../../../../src/components/user-password-history/user-password-history';
-import { UserPasswordHistoryRepository } from '../../../../src/components/user-password-history/user-password-history.repository';
-import { PasswordHashService } from '../../../../src/components/password-hash';
-import { ComponentConfig } from '@tomei/config';
-import { ClassError } from '@tomei/general';
-
-describe('UserPasswordHistory', () => {
-  const historyData = {
-    HistoryId: '1',
-    UserId: 1,
-    PasswordHash: '$argon2id$v=19$m=65536,t=3,p=4$hash1',
-    CreatedAt: new Date('2024-01-01'),
-    get: (opts?: any) => ({
-      HistoryId: '1',
-      UserId: 1,
-      PasswordHash: '$argon2id$v=19$m=65536,t=3,p=4$hash1',
-      CreatedAt: new Date('2024-01-01'),
-    }),
-  };
-
-  afterEach(() => {
-    jest.clearAllMocks();
-  });
-
-  describe('init', () => {
-    it('should return new instance when no historyId is provided', async () => {
-      const result = await UserPasswordHistory.init();
-      expect(result).toBeInstanceOf(UserPasswordHistory);
-      expect(result.HistoryId).toBeUndefined();
-    });
-
-    it('should initialize UserPasswordHistory with valid historyId', async () => {
-      jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'findByPk')
-        .mockResolvedValueOnce(historyData as any);
-
-      const result = await UserPasswordHistory.init(1);
-
-      expect(result).toBeInstanceOf(UserPasswordHistory);
-      expect(result.UserId).toBe(1);
-    });
-
-    it('should throw ClassError when historyId is not found', async () => {
-      jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'findByPk')
-        .mockResolvedValueOnce(null);
-
-      await expect(UserPasswordHistory.init(999)).rejects.toThrow(
-        'UserPasswordHistory not found',
-      );
-    });
-  });
-
-  describe('validate', () => {
-    const passwordHashService = new PasswordHashService();
-
-    beforeEach(() => {
-      jest
-        .spyOn(ComponentConfig, 'getComponentConfigValue')
-        .mockReturnValue(3 as any);
-    });
-
-    it('should return null when no password history exists', async () => {
-      jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'findAll')
-        .mockResolvedValueOnce([] as any);
-
-      const result = await UserPasswordHistory.validate(
-        null,
-        1,
-        'NewPassword1!',
-        passwordHashService,
-      );
-
-      expect(result).toBeNull();
-    });
-
-    it('should throw ClassError when password matches history', async () => {
-      jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'findAll')
-        .mockResolvedValueOnce([historyData] as any);
-      jest
-        .spyOn(passwordHashService, 'verify')
-        .mockResolvedValueOnce(true as any);
-
-      await expect(
-        UserPasswordHistory.validate(null, 1, 'OldPassword1!', passwordHashService),
-      ).rejects.toThrow(ClassError);
-    });
-
-    it('should not throw when password does not match any history', async () => {
-      jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'findAll')
-        .mockResolvedValueOnce([historyData] as any);
-      jest
-        .spyOn(passwordHashService, 'verify')
-        .mockResolvedValueOnce(false as any);
-
-      await expect(
-        UserPasswordHistory.validate(null, 1, 'NewPassword1!', passwordHashService),
-      ).resolves.not.toThrow();
-    });
-  });
-
-  describe('create', () => {
-    beforeEach(() => {
-      jest
-        .spyOn(ComponentConfig, 'getComponentConfigValue')
-        .mockReturnValue(3 as any);
-    });
-
-    it('should create a new password history record', async () => {
-      const createSpy = jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'create')
-        .mockResolvedValueOnce(historyData as any);
-      jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'findAll')
-        .mockResolvedValueOnce([historyData] as any);
-
-      await UserPasswordHistory.create(null, 1, 'hashedPassword');
-
-      expect(createSpy).toHaveBeenCalledTimes(1);
-    });
-
-    it('should purge oldest records when history exceeds policy limit', async () => {
-      const oldRecords = [
-        { HistoryId: '1', CreatedAt: new Date('2024-01-01') },
-        { HistoryId: '2', CreatedAt: new Date('2024-02-01') },
-        { HistoryId: '3', CreatedAt: new Date('2024-03-01') },
-        { HistoryId: '4', CreatedAt: new Date('2024-04-01') },
-      ];
-
-      jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'create')
-        .mockResolvedValueOnce(historyData as any);
-      jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'findAll')
-        .mockResolvedValueOnce(oldRecords as any);
-      const destroySpy = jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'destroyMultiple')
-        .mockResolvedValueOnce(undefined as any);
-
-      await UserPasswordHistory.create(null, 1, 'hashedPassword');
-
-      expect(destroySpy).toHaveBeenCalledTimes(1);
-      expect(destroySpy).toHaveBeenCalledWith(['4'], null);
-    });
-
-    it('should not purge when history is within policy limit', async () => {
-      jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'create')
-        .mockResolvedValueOnce(historyData as any);
-      jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'findAll')
-        .mockResolvedValueOnce([historyData] as any);
-      const destroySpy = jest
-        .spyOn(UserPasswordHistoryRepository.prototype, 'destroyMultiple')
-        .mockResolvedValueOnce(undefined as any);
-
-      await UserPasswordHistory.create(null, 1, 'hashedPassword');
-
-      expect(destroySpy).not.toHaveBeenCalled();
-    });
-  });
-});