ecrs-auth-core 1.0.102 → 1.0.104

package/dist/auth.controller.js

@@ -32,7 +32,7 @@ let AuthController = class AuthController {
         const additionalData = this.extractClientData(request, userAgent);
         console.log(`📍 Login attempt from IP: ${clientIp}, User-Agent: ${userAgent}`);
         // Validate user with IP restriction check
-        const user = await this.authService.validateUser(body.email, body.password, clientIp);
+        const user = await this.authService.validateUser(body.email, body.password, clientIp, Number(body.moduleId));
         if (!user) {
             // Save failed login attempt to both tables
             await this.authService.saveLastLogin({ email: body.email }, clientIp, 'failed', 'Invalid credentials or IP not allowed', additionalData).catch((err) => {

package/dist/auth.service.d.ts

@@ -25,7 +25,7 @@ export declare class AuthService {
     private readonly employeeWorkProfileRepo;
     private uploadPhotoDir;
     constructor(jwtService: JwtService, options: AuthCoreOptions);
-    validateUser(email: string, password: string, clientIp?: string): Promise<User>;
+    validateUser(email: string, password: string, clientIp?: string, moduleId?: number): Promise<User>;
     /**
      * Validate IP restriction for a user
      *

package/dist/auth.service.js

@@ -49,6 +49,7 @@ exports.AuthService = void 0;
 const common_1 = require("@nestjs/common");
 const jwt_1 = require("@nestjs/jwt");
 const bcrypt = __importStar(require("bcrypt"));
+const typeorm_1 = require("typeorm");
 const constants_1 = require("./constants/constants");
 let AuthService = class AuthService {
     constructor(jwtService, options) {
@@ -70,14 +71,41 @@ let AuthService = class AuthService {
         this.loginDetailsRepo = repositories.loginDetailsRepo || null;
         this.employeeWorkProfileRepo = repositories.employeeWorkProfileRepo || null;
     }
-    async validateUser(email, password, clientIp) {
-        const user = await this.userRepo.findOne({ where: { email } });
-        if (!user) {
-            throw new common_1.UnauthorizedException('Invalid email');
-        }
-        const isValid = await bcrypt.compare(password, user.password);
-        if (!isValid) {
-            throw new common_1.UnauthorizedException('Invalid password');
+    async validateUser(email, password, clientIp, moduleId) {
+        // Guard: reject missing or oversized inputs before any DB/bcrypt work.
+        // Oversized passwords cause bcrypt to hang (DoS); oversized emails are never valid.
+        if (!email || !password || password.length > 72 || email.length > 254) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
+        }
+        // Normalize email for consistent comparison, then use ILike so the DB
+        // matches regardless of how the email was originally stored (mixed/upper/lower).
+        const normalizedEmail = email.trim().toLowerCase();
+        const whereClause = { email: (0, typeorm_1.ILike)(normalizedEmail), deletedBy: null, deletedAt: null, status: 1 };
+        //role-id
+        //1-"Superadmin" 2-"Admin" 3-"Employee" 5-"CUSTOMER_BOOKER" 6-"SECURITY" 7-"SUPPLIER"
+        //module-id
+        // 1	"HR" , 2	"ETS" ,3	"Spot",4	"Account",5	"Superadmin",6	"Vendor",7	"Customer"
+        const modulearray = [1, 2, 3, 4, 5];
+        if (moduleId === 7) {
+            whereClause.roleId = (0, typeorm_1.In)([5, 1, 2]);
+        }
+        else if (moduleId === 6) {
+            whereClause.roleId = (0, typeorm_1.In)([7, 1, 2]);
+        }
+        else if (moduleId !== undefined && modulearray.includes(moduleId)) {
+            whereClause.roleId = (0, typeorm_1.In)([1, 2, 3]);
+        }
+        const user = await this.userRepo.findOne({ where: whereClause });
+        // Always run bcrypt.compare regardless of whether the user was found.
+        // This prevents timing-based user enumeration: both paths take the same time.
+        // A known bcrypt hash is used as a dummy so the operation cost is identical.
+        // const DUMMY_HASH = '$2b$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ012345';
+        // const hashToCompare = user?.password ?? DUMMY_HASH;
+        // const isValid = await bcrypt.compare(password, hashToCompare);
+        const isValid = user ? await bcrypt.compare(password, user.password) : false;
+        // Single generic message — never reveal whether the email exists
+        if (!user || !isValid) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
         }
         if (clientIp && this.ipRestrictionsRepo) {
             const ipAllowed = await this.validateIpRestriction(user.id, clientIp);

package/dist/dtos/login.dto.js

@@ -13,6 +13,7 @@ exports.LoginDto = void 0;
 // src/dtos/login.dto.ts
 const swagger_1 = require("@nestjs/swagger");
 const class_validator_1 = require("class-validator");
+const class_transformer_1 = require("class-transformer");
 class LoginDto {
 }
 exports.LoginDto = LoginDto;
@@ -20,12 +21,17 @@ __decorate([
     (0, swagger_1.ApiProperty)({ example: 'user@example.com', description: 'User email address used for login' }),
     (0, class_validator_1.IsEmail)(),
     (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(254) // RFC 5321 max; rejects oversized email before DB lookup
+    ,
+    (0, class_transformer_1.Transform)(({ value }) => typeof value === 'string' ? value.trim() : value),
     __metadata("design:type", String)
 ], LoginDto.prototype, "email", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ example: 'StrongP@ssw0rd', description: 'Plain text password to authenticate' }),
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(72) // bcrypt only processes first 72 bytes; anything longer is a DoS attempt
+    ,
     __metadata("design:type", String)
 ], LoginDto.prototype, "password", void 0);
 __decorate([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ecrs-auth-core",
-  "version": "1.0.102",
+  "version": "1.0.104",
   "description": "Centralized authentication and authorization module for ECRS apps",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",