ecrs-auth-core 1.0.103 → 1.0.104

package/dist/auth.service.js

@@ -72,30 +72,40 @@ let AuthService = class AuthService {
         this.employeeWorkProfileRepo = repositories.employeeWorkProfileRepo || null;
     }
     async validateUser(email, password, clientIp, moduleId) {
-        const whereClause = { email, deletedBy: null, deletedAt: null };
+        // Guard: reject missing or oversized inputs before any DB/bcrypt work.
+        // Oversized passwords cause bcrypt to hang (DoS); oversized emails are never valid.
+        if (!email || !password || password.length > 72 || email.length > 254) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
+        }
+        // Normalize email for consistent comparison, then use ILike so the DB
+        // matches regardless of how the email was originally stored (mixed/upper/lower).
+        const normalizedEmail = email.trim().toLowerCase();
+        const whereClause = { email: (0, typeorm_1.ILike)(normalizedEmail), deletedBy: null, deletedAt: null, status: 1 };
         //role-id
         //1-"Superadmin" 2-"Admin" 3-"Employee" 5-"CUSTOMER_BOOKER" 6-"SECURITY" 7-"SUPPLIER"
         //module-id
         // 1	"HR" , 2	"ETS" ,3	"Spot",4	"Account",5	"Superadmin",6	"Vendor",7	"Customer"
         const modulearray = [1, 2, 3, 4, 5];
         if (moduleId === 7) {
-            // Customer module: allow CUSTOMER_BOOKER(5), SECURITY(6), SUPPLIER(7)
             whereClause.roleId = (0, typeorm_1.In)([5, 1, 2]);
         }
         else if (moduleId === 6) {
-            // vendor module: allow CUSTOMER_BOOKER(5), SECURITY(6), SUPPLIER(7)
             whereClause.roleId = (0, typeorm_1.In)([7, 1, 2]);
         }
         else if (moduleId !== undefined && modulearray.includes(moduleId)) {
             whereClause.roleId = (0, typeorm_1.In)([1, 2, 3]);
         }
         const user = await this.userRepo.findOne({ where: whereClause });
-        if (!user) {
-            throw new common_1.UnauthorizedException('Invalid email');
-        }
-        const isValid = await bcrypt.compare(password, user.password);
-        if (!isValid) {
-            throw new common_1.UnauthorizedException('Invalid password');
+        // Always run bcrypt.compare regardless of whether the user was found.
+        // This prevents timing-based user enumeration: both paths take the same time.
+        // A known bcrypt hash is used as a dummy so the operation cost is identical.
+        // const DUMMY_HASH = '$2b$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ012345';
+        // const hashToCompare = user?.password ?? DUMMY_HASH;
+        // const isValid = await bcrypt.compare(password, hashToCompare);
+        const isValid = user ? await bcrypt.compare(password, user.password) : false;
+        // Single generic message — never reveal whether the email exists
+        if (!user || !isValid) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
         }
         if (clientIp && this.ipRestrictionsRepo) {
             const ipAllowed = await this.validateIpRestriction(user.id, clientIp);

package/dist/dtos/login.dto.js

@@ -13,6 +13,7 @@ exports.LoginDto = void 0;
 // src/dtos/login.dto.ts
 const swagger_1 = require("@nestjs/swagger");
 const class_validator_1 = require("class-validator");
+const class_transformer_1 = require("class-transformer");
 class LoginDto {
 }
 exports.LoginDto = LoginDto;
@@ -20,12 +21,17 @@ __decorate([
     (0, swagger_1.ApiProperty)({ example: 'user@example.com', description: 'User email address used for login' }),
     (0, class_validator_1.IsEmail)(),
     (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(254) // RFC 5321 max; rejects oversized email before DB lookup
+    ,
+    (0, class_transformer_1.Transform)(({ value }) => typeof value === 'string' ? value.trim() : value),
     __metadata("design:type", String)
 ], LoginDto.prototype, "email", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ example: 'StrongP@ssw0rd', description: 'Plain text password to authenticate' }),
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(72) // bcrypt only processes first 72 bytes; anything longer is a DoS attempt
+    ,
     __metadata("design:type", String)
 ], LoginDto.prototype, "password", void 0);
 __decorate([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ecrs-auth-core",
-  "version": "1.0.103",
+  "version": "1.0.104",
   "description": "Centralized authentication and authorization module for ECRS apps",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",