@tomei/sso 0.66.0 → 0.66.1-test.2

package/src/components/login-user/user.ts

@@ -2988,6 +2988,7 @@ export class User extends UserBase {
 
       this.Password = passwordHash;
       this.LastPasswordChangedAt = new Date();
+      this.NeedToChangePasswordYN = YN.No;
 
       const entityValueAfter: IUserAttr = {
         UserId: this.UserId,
@@ -3022,6 +3023,7 @@ export class User extends UserBase {
         {
           Password: this.Password,
           LastPasswordChangedAt: this.LastPasswordChangedAt,
+          NeedToChangePasswordYN: this.NeedToChangePasswordYN,
         },
         {
           where: {
@@ -3053,6 +3055,72 @@ export class User extends UserBase {
     }
   }
 
+  // PASSWORD_EXPIRY_MONTHS=0 disables the policy entirely (AC#1) - checked before NeedToChangePasswordYN/history.
+  async getPasswordExpiryStatus(dbTransaction?: any): Promise<{
+    expired: boolean;
+    expiringSoon: boolean;
+    expiresInDays: number | null;
+  }> {
+    try {
+      const expiryMonthsRaw = Number(process.env.PASSWORD_EXPIRY_MONTHS);
+      const expiryMonths = Number.isFinite(expiryMonthsRaw)
+        ? Math.max(0, Math.floor(expiryMonthsRaw))
+        : 0;
+
+      if (expiryMonths === 0) {
+        return { expired: false, expiringSoon: false, expiresInDays: null };
+      }
+
+      // Forces first-login change for temp-password/admin-created accounts (AC#4), regardless of password age.
+      if (this.NeedToChangePasswordYN === YN.Yes) {
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const warningDaysRaw = Number(process.env.PASSWORD_EXPIRY_WARNING_DAYS);
+      const warningDays = Number.isFinite(warningDaysRaw)
+        ? Math.max(0, Math.floor(warningDaysRaw))
+        : 14;
+
+      const latestHistory = await UserPasswordHistory.getLatestByUserId(
+        dbTransaction,
+        this.UserId,
+      );
+
+      if (!latestHistory) {
+        // Legacy/pre-existing accounts without a history row.
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const createdAt = latestHistory.CreatedAt;
+      const expiryDate = new Date(
+        Date.UTC(
+          createdAt.getUTCFullYear(),
+          createdAt.getUTCMonth() + expiryMonths,
+          createdAt.getUTCDate(),
+          createdAt.getUTCHours(),
+          createdAt.getUTCMinutes(),
+          createdAt.getUTCSeconds(),
+        ),
+      );
+
+      const now = new Date();
+      if (now.getTime() >= expiryDate.getTime()) {
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const msPerDay = 24 * 60 * 60 * 1000;
+      const expiringSoon =
+        now.getTime() >= expiryDate.getTime() - warningDays * msPerDay;
+      const expiresInDays = Math.ceil(
+        (expiryDate.getTime() - now.getTime()) / msPerDay,
+      );
+
+      return { expired: false, expiringSoon, expiresInDays };
+    } catch (error) {
+      throw error;
+    }
+  }
+
   async verifyPasscode(passcode: string) {
     try {
       // Return error if this._Userid is empty "User is not created yet."

package/src/components/user-password-history/user-password-history.ts

@@ -76,16 +76,30 @@ export class UserPasswordHistory
   ): Promise<void> {
     // This method used to check if password entered is valid by checking previous password history
     try {
-      // Part 1-2: Retrieve password history policy by using component config, call ComponentConfig. by passing:
+      // Part 1-2: Retrieve password history policy: env var takes precedence over component config, call ComponentConfig. by passing:
       // - ComponentName: "@tomei/sso"
       // - ConfigKey: "passwordHistory"
       // If no password history set, use default value 3
 
-      const passwordHistoryPolicy =
+      const envPasswordHistoryPolicy = Number(
+        process.env.PASSWORD_HISTORY_LIMIT,
+      );
+      const componentPasswordHistoryPolicy = Number(
         ComponentConfig.getComponentConfigValue(
           '@tomei/sso',
           'passwordHistory',
-        ) || 3;
+        ),
+      );
+      const passwordHistoryPolicy =
+        (Number.isFinite(envPasswordHistoryPolicy) &&
+        envPasswordHistoryPolicy > 0
+          ? Math.floor(envPasswordHistoryPolicy)
+          : 0) ||
+        (Number.isFinite(componentPasswordHistoryPolicy) &&
+        componentPasswordHistoryPolicy > 0
+          ? Math.floor(componentPasswordHistoryPolicy)
+          : 0) ||
+        3;
 
       // Part 3-4: Retrieve records from the table by using  class._repo findAll() by passing:
       // where: { UserId: params.UserId }
@@ -137,16 +151,30 @@ export class UserPasswordHistory
   ): Promise<void> {
     // This method used to check if password entered is valid by checking previous password history
     try {
-      // Part 1-2: Retrieve password history policy by using component config, call ComponentConfig. by passing:
+      // Part 1-2: Retrieve password history policy: env var takes precedence over component config, call ComponentConfig. by passing:
       // - ComponentName: "@tomei/sso"
       // - ConfigKey: "passwordHistory"
       // If no password history set, use default value 3
 
-      const passwordHistoryPolicy =
+      const envPasswordHistoryPolicy = Number(
+        process.env.PASSWORD_HISTORY_LIMIT,
+      );
+      const componentPasswordHistoryPolicy = Number(
         ComponentConfig.getComponentConfigValue(
           '@tomei/sso',
           'passwordHistory',
-        ) || 3;
+        ),
+      );
+      const passwordHistoryPolicy =
+        (Number.isFinite(envPasswordHistoryPolicy) &&
+        envPasswordHistoryPolicy > 0
+          ? Math.floor(envPasswordHistoryPolicy)
+          : 0) ||
+        (Number.isFinite(componentPasswordHistoryPolicy) &&
+        componentPasswordHistoryPolicy > 0
+          ? Math.floor(componentPasswordHistoryPolicy)
+          : 0) ||
+        3;
 
       // Part 3: Insert new password history by calling class _repo create() method.
       const userPasswordHistory = new UserPasswordHistory();
@@ -184,4 +212,27 @@ export class UserPasswordHistory
       throw error;
     }
   }
+
+  // Latest history row's CreatedAt is the source of truth for password age (used by User.getPasswordExpiryStatus()).
+  public static async getLatestByUserId(
+    dbTransaction: any,
+    UserId: number,
+  ): Promise<UserPasswordHistory | null> {
+    try {
+      const passwordHistory = await UserPasswordHistory._Repo.findAll({
+        where: { UserId: UserId },
+        order: [['CreatedAt', 'DESC']],
+        limit: 1,
+        transaction: dbTransaction,
+      });
+
+      if (!passwordHistory || passwordHistory.length < 1) {
+        return null;
+      }
+
+      return new UserPasswordHistory(passwordHistory[0].get({ plain: true }));
+    } catch (error) {
+      throw error;
+    }
+  }
 }

package/src/index.ts

@@ -6,4 +6,3 @@ export * from './session';
 export * from './enum';
 export * as ssoDb from './database';
 export * from './types';
-export * from './models/user.entity';

package/tsconfig.build.json

@@ -1,6 +1,6 @@
-{
-  "extends": "./tsconfig.json",
-  "include": ["**/*.ts"],
-  "exclude": ["node_modules", "__tests__", "dist", "**/*spec.ts"]
-}
+{
+  "extends": "./tsconfig.json",
+  "include": ["**/*.ts"],
+  "exclude": ["node_modules", "__tests__", "dist", "**/*spec.ts"]
+}
   

package/tsconfig.json

@@ -1,24 +1,24 @@
-{
-  "compilerOptions": {
-    "module": "commonjs",
-    "declaration": true,
-    "removeComments": true,
-    "emitDecoratorMetadata": true,
-    "experimentalDecorators": true,
-    "allowSyntheticDefaultImports": true,
-    "moduleResolution": "node",
-    "target": "es6",
-    "sourceMap": true,
-    "outDir": "./dist",
-    "baseUrl": "./src",
-    "rootDir": "./",
-    "incremental": true,
-    "skipLibCheck": true,
-    "noImplicitAny": false,
-    "strictBindCallApply": false,
-    "forceConsistentCasingInFileNames": false,
-    "noFallthroughCasesInSwitch": false,
-    "strictNullChecks": false,
-  },
-  "exclude": ["node_modules", "dist"]
+{
+  "compilerOptions": {
+    "module": "commonjs",
+    "declaration": true,
+    "removeComments": true,
+    "emitDecoratorMetadata": true,
+    "experimentalDecorators": true,
+    "allowSyntheticDefaultImports": true,
+    "moduleResolution": "node",
+    "target": "es6",
+    "sourceMap": true,
+    "outDir": "./dist",
+    "baseUrl": "./src",
+    "rootDir": "./",
+    "incremental": true,
+    "skipLibCheck": true,
+    "noImplicitAny": false,
+    "strictBindCallApply": false,
+    "forceConsistentCasingInFileNames": false,
+    "noFallthroughCasesInSwitch": false,
+    "strictNullChecks": false,
+  },
+  "exclude": ["node_modules", "dist"]
 }

package/dist/__tests__/unit/components/group-privilege/group-privilege.test.js

@@ -1,71 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const group_privilege_1 = require("../../../../src/components/group-privilege/group-privilege");
-const group_privilege_repository_1 = require("../../../../src/components/group-privilege/group-privilege.repository");
-const general_1 = require("@tomei/general");
-describe('GroupPrivilege', () => {
-    afterEach(() => {
-        jest.restoreAllMocks();
-    });
-    it('should initialize with GroupPrivilegeAttr', () => __awaiter(void 0, void 0, void 0, function* () {
-        const mockGroupPrivilegeAttr = {
-            GroupPrivilegeId: 1,
-            GroupCode: 'group1',
-            PrivilegeCode: 'privilege1',
-            Status: 'active',
-            CreatedAt: new Date(),
-            UpdatedAt: new Date(),
-            CreatedById: 1,
-            UpdatedById: 1,
-        };
-        const findOneMock = jest
-            .spyOn(group_privilege_repository_1.GroupPrivilegeRepository.prototype, 'findOne')
-            .mockResolvedValueOnce({ get: jest.fn().mockReturnValue(mockGroupPrivilegeAttr) });
-        const groupPrivilege = yield group_privilege_1.GroupPrivilege.init(null, 1);
-        expect(findOneMock).toBeCalledWith({
-            where: { GroupPrivilegeId: 1 },
-            transaction: null,
-        });
-        expect(groupPrivilege).toBeInstanceOf(group_privilege_1.GroupPrivilege);
-        expect(groupPrivilege.GroupPrivilegeId).toEqual(mockGroupPrivilegeAttr.GroupPrivilegeId);
-        expect(groupPrivilege.GroupCode).toEqual(mockGroupPrivilegeAttr.GroupCode);
-        expect(groupPrivilege.PrivilegeCode).toEqual(mockGroupPrivilegeAttr.PrivilegeCode);
-        expect(groupPrivilege.Status).toEqual(mockGroupPrivilegeAttr.Status);
-        expect(groupPrivilege.CreatedAt).toEqual(mockGroupPrivilegeAttr.CreatedAt);
-        expect(groupPrivilege.UpdatedAt).toEqual(mockGroupPrivilegeAttr.UpdatedAt);
-        expect(groupPrivilege.CreatedById).toEqual(mockGroupPrivilegeAttr.CreatedById);
-        expect(groupPrivilege.UpdatedById).toEqual(mockGroupPrivilegeAttr.UpdatedById);
-    }));
-    it('should throw ClassError when GroupPrivilegeAttr is not found', () => __awaiter(void 0, void 0, void 0, function* () {
-        const findOneMock = jest
-            .spyOn(group_privilege_repository_1.GroupPrivilegeRepository.prototype, 'findOne')
-            .mockResolvedValueOnce(null);
-        yield expect(group_privilege_1.GroupPrivilege.init(null, 1)).rejects.toThrow(general_1.ClassError);
-        expect(findOneMock).toBeCalledWith({
-            where: { GroupPrivilegeId: 1 },
-            transaction: null,
-        });
-    }));
-    it('should initialize with default values', () => __awaiter(void 0, void 0, void 0, function* () {
-        const groupPrivilege = yield group_privilege_1.GroupPrivilege.init();
-        expect(groupPrivilege).toBeInstanceOf(group_privilege_1.GroupPrivilege);
-        expect(groupPrivilege.GroupPrivilegeId).toBeUndefined();
-        expect(groupPrivilege.GroupCode).toBeUndefined();
-        expect(groupPrivilege.PrivilegeCode).toBeUndefined();
-        expect(groupPrivilege.Status).toBeUndefined();
-        expect(groupPrivilege.CreatedAt).toBeUndefined();
-        expect(groupPrivilege.UpdatedAt).toBeUndefined();
-        expect(groupPrivilege.CreatedById).toBeUndefined();
-        expect(groupPrivilege.UpdatedById).toBeUndefined();
-    }));
-});
-//# sourceMappingURL=group-privilege.test.js.map

package/dist/__tests__/unit/components/group-privilege/group-privilege.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"group-privilege.test.js","sourceRoot":"","sources":["../../../../../__tests__/unit/components/group-privilege/group-privilege.test.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,gGAA4F;AAC5F,sHAAiH;AACjH,4CAA4C;AAE5C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAS,EAAE;QACzD,MAAM,sBAAsB,GAAG;YAC7B,gBAAgB,EAAE,CAAC;YACnB,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;SACf,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI;aACrB,KAAK,CAAC,qDAAwB,CAAC,SAAS,EAAE,SAAS,CAAC;aACpD,qBAAqB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAS,CAAC,CAAC;QAE5F,MAAM,cAAc,GAAG,MAAM,gCAAc,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAE1D,MAAM,CAAC,WAAW,CAAC,CAAC,cAAc,CAAC;YACjC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;YAC9B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,gCAAc,CAAC,CAAC;QACtD,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;QACzF,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC3E,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC;QACnF,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC3E,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC3E,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAC/E,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACjF,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAS,EAAE;QAC5E,MAAM,WAAW,GAAG,IAAI;aACrB,KAAK,CAAC,qDAAwB,CAAC,SAAS,EAAE,SAAS,CAAC;aACpD,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,MAAM,CAAC,gCAAc,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAU,CAAC,CAAC;QAEvE,MAAM,CAAC,WAAW,CAAC,CAAC,cAAc,CAAC;YACjC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;YAC9B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC,CAAA,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAS,EAAE;QACrD,MAAM,cAAc,GAAG,MAAM,gCAAc,CAAC,IAAI,EAAE,CAAC;QAEnD,MAAM,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,gCAAc,CAAC,CAAC;QACtD,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,aAAa,EAAE,CAAC;QACxD,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACjD,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,aAAa,EAAE,CAAC;QACrD,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACjD,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACjD,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;IACrD,CAAC,CAAA,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/unit/components/login-user/login-user.spec.js

@@ -1,6 +0,0 @@
-describe('LoginUser', () => {
-    it('should be true', () => {
-        expect(true).toBe(true);
-    });
-});
-//# sourceMappingURL=login-user.spec.js.map

package/dist/__tests__/unit/components/login-user/login-user.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"login-user.spec.js","sourceRoot":"","sources":["../../../../../__tests__/unit/components/login-user/login-user.spec.ts"],"names":[],"mappings":"AAuuBA,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACvB,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}