@tomei/sso 0.66.1-test.1 → 0.66.1-test.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomei/sso",
-  "version": "0.66.1-test.1",
+  "version": "0.66.1-test.3",
   "description": "Tomei SSO Package",
   "main": "dist/index.js",
   "scripts": {

package/src/components/login-user/login-user.ts

@@ -20,6 +20,19 @@ export class LoginUser extends User implements ILoginUser {
     Id: null,
   };
 
+  private static isLoginApiEnabled(): boolean {
+    try {
+      const useLoginApiYN =
+        ComponentConfig.getComponentConfigValue(
+          '@tomei/sso',
+          'useLoginApiYN',
+        ) || 'Y';
+      return String(useLoginApiYN).toUpperCase() !== 'N';
+    } catch (error) {
+      return true;
+    }
+  }
+
   static async init(
     sessionService: ISessionService,
     userId?: number,
@@ -27,24 +40,43 @@ export class LoginUser extends User implements ILoginUser {
   ): Promise<LoginUser> {
     User._RedisService = await RedisService.init();
     if (userId) {
-      const loginApiEndpoint = ComponentConfig.getComponentConfigValue(
-        '@tomei/sso',
-        'loginApiEndpoint',
-      );
+      let user: any;
 
-      let payload = { UserId: userId };
+      if (LoginUser.isLoginApiEnabled()) {
+        const loginApiEndpoint = ComponentConfig.getComponentConfigValue(
+          '@tomei/sso',
+          'loginApiEndpoint',
+        );
 
-      const { data } = await axios.post(
-        `${loginApiEndpoint.baseUrl}${loginApiEndpoint.getProfile}`,
-        payload,
-        {
-          headers: {
-            'Content-Type': 'application/json',
-            'x-api-key': loginApiEndpoint.apiKey,
+        let payload = { UserId: userId };
+
+        const { data } = await axios.post(
+          `${loginApiEndpoint.baseUrl}${loginApiEndpoint.getProfile}`,
+          payload,
+          {
+            headers: {
+              'Content-Type': 'application/json',
+              'x-api-key': loginApiEndpoint.apiKey,
+            },
           },
-        },
-      );
-      const user = data.loginUser;
+        );
+        user = data.loginUser;
+      } else {
+        if (dbTransaction) {
+          User._Repository = new UserRepository();
+        }
+        user = await User._Repository.findOne({
+          where: {
+            UserId: userId,
+          },
+          include: [
+            {
+              model: Staff,
+            },
+          ],
+          transaction: dbTransaction,
+        });
+      }
 
       if (!user) {
         throw new Error('Invalid credentials.');
@@ -59,21 +91,21 @@ export class LoginUser extends User implements ILoginUser {
           IDType: user?.IdType || null,
           ContactNo: user?.ContactNo || null,
           Email: user.Email,
-          Password: null,
+          Password: user.Password,
           Status: user.Status,
-          DefaultPasswordChangedYN: null,
-          FirstLoginAt: null,
-          LastLoginAt: null,
+          DefaultPasswordChangedYN: user.DefaultPasswordChangedYN,
+          FirstLoginAt: user.FirstLoginAt,
+          LastLoginAt: user.LastLoginAt,
           MFAEnabled: user.MFAEnabled,
-          MFAConfig: null,
+          MFAConfig: user.MFAConfig,
           MFABypassYN: user.MFABypassYN,
-          RecoveryEmail: null,
-          FailedLoginAttemptCount: null,
-          LastFailedLoginAt: null,
-          LastPasswordChangedAt: null,
-          NeedToChangePasswordYN: null,
-          PasscodeHash: null,
-          PasscodeUpdatedAt: null,
+          RecoveryEmail: user.RecoveryEmail,
+          FailedLoginAttemptCount: user.FailedLoginAttemptCount,
+          LastFailedLoginAt: user.LastFailedLoginAt,
+          LastPasswordChangedAt: user.LastPasswordChangedAt,
+          NeedToChangePasswordYN: user.NeedToChangePasswordYN,
+          PasscodeHash: user.PasscodeHash,
+          PasscodeUpdatedAt: user.PasscodeUpdatedAt,
           CreatedById: user.CreatedById,
           CreatedAt: user.CreatedAt,
           UpdatedById: user.UpdatedById,
@@ -104,29 +136,45 @@ export class LoginUser extends User implements ILoginUser {
         throw new Error('Session name is not set');
       }
 
-      const loginApiEndpoint = ComponentConfig.getComponentConfigValue(
-        '@tomei/sso',
-        'loginApiEndpoint',
-      );
-      let payload = {
-        SystemCode: systemCode,
-        SessionName: sessionName,
-        PrivilegeName: privilegeName,
-        UserId: this.ObjectId,
-      };
-      const { data } = await axios.post(
-        `${loginApiEndpoint.baseUrl}${loginApiEndpoint.checkPrivileges}`,
-        payload,
-        {
-          headers: {
-            'Content-Type': 'application/json',
-            'x-api-key': loginApiEndpoint.apiKey,
+      if (LoginUser.isLoginApiEnabled()) {
+        const loginApiEndpoint = ComponentConfig.getComponentConfigValue(
+          '@tomei/sso',
+          'loginApiEndpoint',
+        );
+        let payload = {
+          SystemCode: systemCode,
+          SessionName: sessionName,
+          PrivilegeName: privilegeName,
+          UserId: this.ObjectId,
+        };
+        const { data } = await axios.post(
+          `${loginApiEndpoint.baseUrl}${loginApiEndpoint.checkPrivileges}`,
+          payload,
+          {
+            headers: {
+              'Content-Type': 'application/json',
+              'x-api-key': loginApiEndpoint.apiKey,
+            },
           },
-        },
+        );
+        return data.hasPrivilege;
+      }
+
+      const userSession = await this._SessionService.retrieveUserSession(
+        this.ObjectId,
+        sessionName,
       );
-      const hasPrivilege = data.hasPrivilege;
 
-      return hasPrivilege;
+      const systemLogin = userSession.systemLogins.find(
+        (system) => system.code === systemCode,
+      );
+
+      if (!systemLogin) {
+        return false;
+      }
+
+      const privileges = systemLogin.privileges;
+      return privileges.includes(privilegeName);
     } catch (error) {
       throw error;
     }
@@ -143,27 +191,53 @@ export class LoginUser extends User implements ILoginUser {
       if (!sessionName) {
         throw new Error('Session name is not set');
       }
-      const loginApiEndpoint = ComponentConfig.getComponentConfigValue(
-        '@tomei/sso',
-        'loginApiEndpoint',
-      );
-      let payload = {
-        SystemCode: systemCode,
-        SessionName: sessionName,
-        SessionId: sessionId,
-        UserId: userId,
-      };
-      const { data } = await axios.post(
-        `${loginApiEndpoint.baseUrl}${loginApiEndpoint.checkSession}`,
-        payload,
-        {
-          headers: {
-            'Content-Type': 'application/json',
-            'x-api-key': loginApiEndpoint.apiKey,
+
+      if (LoginUser.isLoginApiEnabled()) {
+        const loginApiEndpoint = ComponentConfig.getComponentConfigValue(
+          '@tomei/sso',
+          'loginApiEndpoint',
+        );
+        let payload = {
+          SystemCode: systemCode,
+          SessionName: sessionName,
+          SessionId: sessionId,
+          UserId: userId,
+        };
+        const { data } = await axios.post(
+          `${loginApiEndpoint.baseUrl}${loginApiEndpoint.checkSession}`,
+          payload,
+          {
+            headers: {
+              'Content-Type': 'application/json',
+              'x-api-key': loginApiEndpoint.apiKey,
+            },
           },
-        },
+        );
+        return data.systemLogin;
+      }
+
+      const userSession = await this._SessionService.retrieveUserSession(
+        userId,
+        sessionName,
+      );
+
+      if (userSession.systemLogins.length === 0) {
+        throw new Error('Session expired.');
+      }
+
+      const systemLogin = userSession.systemLogins.find(
+        (sl) => sl.code === systemCode,
       );
-      const systemLogin = data.systemLogin;
+
+      if (!systemLogin) {
+        throw new Error('Session expired.');
+      }
+
+      if (systemLogin.sessionId !== sessionId) {
+        throw new Error('Session expired.');
+      }
+
+      await this._SessionService.refreshDuration(userId, sessionName);
 
       return systemLogin;
     } catch (error) {
@@ -339,26 +413,59 @@ export class LoginUser extends User implements ILoginUser {
       throw new Error('Session name is not set in the configuration');
     }
 
-    const loginApiEndpoint = ComponentConfig.getComponentConfigValue(
-      '@tomei/sso',
-      'loginApiEndpoint',
-    );
-    let payload = {
-      SystemCode: systemCode,
-      SessionName: sessionName,
-      SessionId: sessionId,
-      UserId: this.ObjectId,
-    };
-
-    await axios.post(
-      `${loginApiEndpoint.baseUrl}${loginApiEndpoint.setSession}`,
-      payload,
-      {
-        headers: {
-          'Content-Type': 'application/json',
-          'x-api-key': loginApiEndpoint.apiKey,
+    if (LoginUser.isLoginApiEnabled()) {
+      const loginApiEndpoint = ComponentConfig.getComponentConfigValue(
+        '@tomei/sso',
+        'loginApiEndpoint',
+      );
+      let payload = {
+        SystemCode: systemCode,
+        SessionName: sessionName,
+        SessionId: sessionId,
+        UserId: this.ObjectId,
+      };
+
+      await axios.post(
+        `${loginApiEndpoint.baseUrl}${loginApiEndpoint.setSession}`,
+        payload,
+        {
+          headers: {
+            'Content-Type': 'application/json',
+            'x-api-key': loginApiEndpoint.apiKey,
+          },
         },
-      },
+      );
+      return;
+    }
+
+    const userSession = await this._SessionService.retrieveUserSession(
+      this.ObjectId,
+      sessionName,
+    );
+    const systemLogin = userSession.systemLogins.find(
+      (system) => system.code === systemCode,
+    );
+
+    if (systemLogin) {
+      const privileges = await this.getPrivileges(systemCode, dbTransaction);
+      systemLogin.sessionId = sessionId;
+      systemLogin.privileges = privileges;
+      userSession.systemLogins.map((system) =>
+        system.code === systemCode ? systemLogin : system,
+      );
+    } else {
+      const newLogin = {
+        id: systemCode,
+        code: systemCode,
+        sessionId: sessionId,
+        privileges: await this.getPrivileges(systemCode, dbTransaction),
+      };
+      userSession.systemLogins.push(newLogin);
+    }
+    this._SessionService.setUserSession(
+      this.ObjectId,
+      userSession,
+      sessionName,
     );
   }
 }

package/src/components/login-user/user.ts

@@ -2988,6 +2988,7 @@ export class User extends UserBase {
 
       this.Password = passwordHash;
       this.LastPasswordChangedAt = new Date();
+      this.NeedToChangePasswordYN = YN.No;
 
       const entityValueAfter: IUserAttr = {
         UserId: this.UserId,
@@ -3022,6 +3023,7 @@ export class User extends UserBase {
         {
           Password: this.Password,
           LastPasswordChangedAt: this.LastPasswordChangedAt,
+          NeedToChangePasswordYN: this.NeedToChangePasswordYN,
         },
         {
           where: {
@@ -3053,6 +3055,72 @@ export class User extends UserBase {
     }
   }
 
+  // PASSWORD_EXPIRY_MONTHS=0 disables the policy entirely (AC#1) - checked before NeedToChangePasswordYN/history.
+  async getPasswordExpiryStatus(dbTransaction?: any): Promise<{
+    expired: boolean;
+    expiringSoon: boolean;
+    expiresInDays: number | null;
+  }> {
+    try {
+      const expiryMonthsRaw = Number(process.env.PASSWORD_EXPIRY_MONTHS);
+      const expiryMonths = Number.isFinite(expiryMonthsRaw)
+        ? Math.max(0, Math.floor(expiryMonthsRaw))
+        : 0;
+
+      if (expiryMonths === 0) {
+        return { expired: false, expiringSoon: false, expiresInDays: null };
+      }
+
+      // Forces first-login change for temp-password/admin-created accounts (AC#4), regardless of password age.
+      if (this.NeedToChangePasswordYN === YN.Yes) {
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const warningDaysRaw = Number(process.env.PASSWORD_EXPIRY_WARNING_DAYS);
+      const warningDays = Number.isFinite(warningDaysRaw)
+        ? Math.max(0, Math.floor(warningDaysRaw))
+        : 14;
+
+      const latestHistory = await UserPasswordHistory.getLatestByUserId(
+        dbTransaction,
+        this.UserId,
+      );
+
+      if (!latestHistory) {
+        // Legacy/pre-existing accounts without a history row.
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const createdAt = latestHistory.CreatedAt;
+      const expiryDate = new Date(
+        Date.UTC(
+          createdAt.getUTCFullYear(),
+          createdAt.getUTCMonth() + expiryMonths,
+          createdAt.getUTCDate(),
+          createdAt.getUTCHours(),
+          createdAt.getUTCMinutes(),
+          createdAt.getUTCSeconds(),
+        ),
+      );
+
+      const now = new Date();
+      if (now.getTime() >= expiryDate.getTime()) {
+        return { expired: true, expiringSoon: false, expiresInDays: null };
+      }
+
+      const msPerDay = 24 * 60 * 60 * 1000;
+      const expiringSoon =
+        now.getTime() >= expiryDate.getTime() - warningDays * msPerDay;
+      const expiresInDays = Math.ceil(
+        (expiryDate.getTime() - now.getTime()) / msPerDay,
+      );
+
+      return { expired: false, expiringSoon, expiresInDays };
+    } catch (error) {
+      throw error;
+    }
+  }
+
   async verifyPasscode(passcode: string) {
     try {
       // Return error if this._Userid is empty "User is not created yet."

package/src/components/user-password-history/user-password-history.ts

@@ -76,16 +76,30 @@ export class UserPasswordHistory
   ): Promise<void> {
     // This method used to check if password entered is valid by checking previous password history
     try {
-      // Part 1-2: Retrieve password history policy by using component config, call ComponentConfig. by passing:
+      // Part 1-2: Retrieve password history policy: env var takes precedence over component config, call ComponentConfig. by passing:
       // - ComponentName: "@tomei/sso"
       // - ConfigKey: "passwordHistory"
       // If no password history set, use default value 3
 
-      const passwordHistoryPolicy =
+      const envPasswordHistoryPolicy = Number(
+        process.env.PASSWORD_HISTORY_LIMIT,
+      );
+      const componentPasswordHistoryPolicy = Number(
         ComponentConfig.getComponentConfigValue(
           '@tomei/sso',
           'passwordHistory',
-        ) || 3;
+        ),
+      );
+      const passwordHistoryPolicy =
+        (Number.isFinite(envPasswordHistoryPolicy) &&
+        envPasswordHistoryPolicy > 0
+          ? Math.floor(envPasswordHistoryPolicy)
+          : 0) ||
+        (Number.isFinite(componentPasswordHistoryPolicy) &&
+        componentPasswordHistoryPolicy > 0
+          ? Math.floor(componentPasswordHistoryPolicy)
+          : 0) ||
+        3;
 
       // Part 3-4: Retrieve records from the table by using  class._repo findAll() by passing:
       // where: { UserId: params.UserId }
@@ -137,16 +151,30 @@ export class UserPasswordHistory
   ): Promise<void> {
     // This method used to check if password entered is valid by checking previous password history
     try {
-      // Part 1-2: Retrieve password history policy by using component config, call ComponentConfig. by passing:
+      // Part 1-2: Retrieve password history policy: env var takes precedence over component config, call ComponentConfig. by passing:
       // - ComponentName: "@tomei/sso"
       // - ConfigKey: "passwordHistory"
       // If no password history set, use default value 3
 
-      const passwordHistoryPolicy =
+      const envPasswordHistoryPolicy = Number(
+        process.env.PASSWORD_HISTORY_LIMIT,
+      );
+      const componentPasswordHistoryPolicy = Number(
         ComponentConfig.getComponentConfigValue(
           '@tomei/sso',
           'passwordHistory',
-        ) || 3;
+        ),
+      );
+      const passwordHistoryPolicy =
+        (Number.isFinite(envPasswordHistoryPolicy) &&
+        envPasswordHistoryPolicy > 0
+          ? Math.floor(envPasswordHistoryPolicy)
+          : 0) ||
+        (Number.isFinite(componentPasswordHistoryPolicy) &&
+        componentPasswordHistoryPolicy > 0
+          ? Math.floor(componentPasswordHistoryPolicy)
+          : 0) ||
+        3;
 
       // Part 3: Insert new password history by calling class _repo create() method.
       const userPasswordHistory = new UserPasswordHistory();
@@ -184,4 +212,27 @@ export class UserPasswordHistory
       throw error;
     }
   }
+
+  // Latest history row's CreatedAt is the source of truth for password age (used by User.getPasswordExpiryStatus()).
+  public static async getLatestByUserId(
+    dbTransaction: any,
+    UserId: number,
+  ): Promise<UserPasswordHistory | null> {
+    try {
+      const passwordHistory = await UserPasswordHistory._Repo.findAll({
+        where: { UserId: UserId },
+        order: [['CreatedAt', 'DESC']],
+        limit: 1,
+        transaction: dbTransaction,
+      });
+
+      if (!passwordHistory || passwordHistory.length < 1) {
+        return null;
+      }
+
+      return new UserPasswordHistory(passwordHistory[0].get({ plain: true }));
+    } catch (error) {
+      throw error;
+    }
+  }
 }