adapt-authoring-auth-local 1.3.1 → 1.3.2

package/lib/LocalAuthModule.js

@@ -105,7 +105,7 @@ class LocalAuthModule extends AbstractAuthModule {
    * @param {Object} user The current user
    */
   async handleLockStatus (user) {
-    const tempLockEndTime = new Date(user.lastFailedLoginAttempt).getTime() + this.getConfig('temporaryLockDuration') * 1000
+    const tempLockEndTime = new Date(user.lastFailedLoginAttempt).getTime() + this.getConfig('temporaryLockDuration')
     const tempLockRemainingSecs = Math.round((tempLockEndTime - Date.now()) / 1000)
 
     if (user.isPermLocked) {

package/lib/PasswordUtils.js

@@ -64,7 +64,7 @@ class PasswordUtils {
       INVALID_PASSWORD_UPPERCASE: [match('passwordMustHaveUppercase', /[A-Z]/)],
       INVALID_PASSWORD_LOWERCASE: [match('passwordMustHaveLowercase', /[a-z]/)],
       INVALID_PASSWORD_SPECIAL: [match('passwordMustHaveSpecial', /[#?!@$%^&*-]/)],
-      BLACKLISTED_PASSWORD_VALUE: [blacklisted.length === 0 || blacklisted.some(p => !(password.includes(p)))]
+      BLACKLISTED_PASSWORD_VALUE: [blacklisted.length === 0 || blacklisted.every(p => !(password.includes(p)))]
     }
     const errors = Object.entries(validationChecks).reduce((m, [code, [isValid, data]]) => {
       if (!isValid) m.push(App.instance.errors[code].setData(data))
@@ -164,7 +164,7 @@ class PasswordUtils {
     const [user] = await users.find({ email: tokenData.email })
     if (!user) {
       throw App.instance.errors.NOT_FOUND
-        .setData({ type: 'user', id: token.email })
+        .setData({ type: 'user', id: tokenData.email })
     }
     return tokenData
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adapt-authoring-auth-local",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "Module which implements username/password (local) authentication",
   "homepage": "https://github.com/adapt-security/adapt-authoring-auth-local",
   "license": "GPL-3.0",

package/tests/LocalAuthModule.spec.js

@@ -505,10 +505,7 @@ describe('LocalAuthModule', () => {
       const user = {
         isPermLocked: false,
         isTempLocked: true,
-        // NOTE: handleLockStatus multiplies temporaryLockDuration by 1000, which
-        // appears to be a bug if the config value is already in ms (isTimeMs: true).
-        // We set lastFailedLoginAttempt to now so the lock is still active with
-        // the doubled value.
+        // NOTE: lastFailedLoginAttempt is set to now so the lock is still active.
         lastFailedLoginAttempt: new Date().toISOString()
       }
       await assert.rejects(
@@ -649,9 +646,7 @@ describe('LocalAuthModule', () => {
       assert.ok(updateCalls.length > 0)
     })
 
-    // TODO: Bug - setUserEnabled references user.failedAttempts instead of
-    // user.failedLoginAttempts when disabling. See BUGS.md.
-    it('should preserve failedLoginAttempts when disabling a user', { todo: 'references user.failedAttempts instead of user.failedLoginAttempts' }, async () => {
+    it('should preserve failedLoginAttempts when disabling a user', async () => {
       const user = { _id: 'user-1', failedLoginAttempts: 7 }
       await mod.setUserEnabled(user, false)
       const lastUpdate = updateCalls[updateCalls.length - 1]

package/tests/PasswordUtils.spec.js

@@ -374,11 +374,7 @@ describe('PasswordUtils', () => {
       await assert.doesNotReject(() => PasswordUtils.validate('anything1'))
     })
 
-    // TODO: Bug - blacklist check uses .some() instead of .every()
-    // With multiple blacklisted values, a password containing one blacklisted
-    // value passes if another blacklisted value is absent.
-    // See BUGS.md and PasswordUtils.js line 67.
-    it('should throw when password contains any blacklisted value (multiple entries)', { todo: 'blacklist check uses .some() instead of .every()' }, async () => {
+    it('should throw when password contains any blacklisted value (multiple entries)', async () => {
       authlocalConfig.blacklistedPasswordValues = ['password', 'qwerty']
       await assert.rejects(
         () => PasswordUtils.validate('password123'),
@@ -593,10 +589,7 @@ describe('PasswordUtils', () => {
       )
     })
 
-    // TODO: Bug - validateReset uses token.email instead of tokenData.email
-    // in the NOT_FOUND error data. Since token is a string, token.email is
-    // undefined. See PasswordUtils.js line 167.
-    it('should include correct email in NOT_FOUND error when user is missing', { todo: 'uses token.email (string) instead of tokenData.email' }, async () => {
+    it('should include correct email in NOT_FOUND error when user is missing', async () => {
       mockPasswordResetsStore.push({
         token: 'orphan-token',
         email: 'orphan@example.com',