nucleus-core-ts 0.10.21 → 0.10.23

package/dist/src/Nucleus/routes/auth/cohort/types.d.ts

@@ -1,3 +1,4 @@
+import type { AppliedPasswordPolicy } from '../passwordPolicy';
 import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import type { Logger } from 'src/Services';
 type PgTable = ReturnType<typeof import('drizzle-orm/pg-core').pgTable>;
@@ -21,14 +22,12 @@ export type CohortRouteConfig = {
     /** List form of `defaultRole`; merged with it. See NucleusConfigOptions.authentication. */
     defaultRoles?: string[];
     emailExemptDomains?: string[];
-    passwordPolicy?: {
-        minLength?: number;
-        maxLength?: number;
-        requireUppercase?: boolean;
-        requireLowercase?: boolean;
-        requireNumber?: boolean;
-        requireSpecialChar?: boolean;
-    };
+    /**
+     * Mirrors `authentication.passwordPolicy`. It listed only the structural
+     * rules, so the two flags the public config declares could not even be named
+     * here -- which is one reason they never did anything.
+     */
+    passwordPolicy?: AppliedPasswordPolicy;
 };
 /**
  * What a cohort handler actually reads off the request.

package/dist/src/Nucleus/routes/auth/cohort/utils.d.ts

@@ -36,8 +36,11 @@ type PasswordValidation = {
 };
 /**
  * Policy-aware password validation.
- * Uses config-driven rules when a passwordPolicy is provided,
- * otherwise falls back to sensible defaults (min 8, uppercase, lowercase, digit).
+ *
+ * Delegates to the shared policy so `preventCommonPasswords` and
+ * `preventUserInfoInPassword` -- declared in the public config for as long as it
+ * has existed, and implemented nowhere -- apply here too. `identity` is the
+ * account the password is being set for, which is what the second flag needs.
  */
-export declare function validatePassword(pwd: string, policy?: PasswordPolicy): PasswordValidation;
+export declare function validatePassword(pwd: string, policy?: PasswordPolicy, identity?: string): PasswordValidation;
 export {};

package/dist/src/Nucleus/routes/auth/passwordPolicy.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The password policy, actually applied.
+ *
+ * `preventCommonPasswords` and `preventUserInfoInPassword` have been declared in
+ * the public config, carried in the JSON schema, documented as "checks against a
+ * list of known common passwords" and "rejects passwords containing the user's
+ * email", and defaulted to true in the shipped frontend -- while no list and no
+ * comparison existed anywhere in the product. An operator who set them was told
+ * their users were protected and they were not. This is where both become real.
+ *
+ * The two structural validators that existed (`validatePassword` for cohort
+ * imports, `validatePasswordStrength` for every other write path) duplicated the
+ * same four rules and neither could see the flags. Both now delegate here, so a
+ * policy means the same thing wherever a password is set.
+ */
+export interface AppliedPasswordPolicy {
+    minLength?: number;
+    maxLength?: number;
+    requireUppercase?: boolean;
+    requireLowercase?: boolean;
+    requireNumber?: boolean;
+    requireSpecialChar?: boolean;
+    /** Reject passwords that appear on the common-password list. */
+    preventCommonPasswords?: boolean;
+    /** Reject passwords built from the account's own email or username. */
+    preventUserInfoInPassword?: boolean;
+}
+export interface PasswordValidation {
+    valid: boolean;
+    errors: string[];
+}
+/** True when the password is one of the passwords tried first. */
+export declare function isCommonPassword(pwd: string): boolean;
+/**
+ * True when the password is built out of the account's own identity.
+ *
+ * Checks the whole identity, its local part when it is an email, and the
+ * domain's first label -- in both directions, because `ayse@firma.com` picking
+ * `Ayse2024!` and picking `firma` are the same mistake.
+ */
+export declare function containsUserInfo(pwd: string, identity?: string): boolean;
+/**
+ * Applies a policy to a password. With no policy, the rules are the ones this
+ * product has always applied to registration: min 8, upper, lower, digit.
+ */
+export declare function validateAgainstPolicy(pwd: string, policy?: AppliedPasswordPolicy, identity?: string): PasswordValidation;

package/dist/src/Nucleus/routes/auth/register/utils.d.ts

@@ -1,3 +1,4 @@
+import { type AppliedPasswordPolicy } from '../passwordPolicy';
 export declare function hashPassword(plainPassword: string): Promise<string>;
 export declare function generateVerificationToken(): string;
 /**
@@ -7,7 +8,16 @@ export declare function generateVerificationToken(): string;
  */
 export declare function hashVerificationToken(token: string): string;
 export declare function parseTimeToMs(time: string): number;
-export declare function validatePasswordStrength(pwd: string): {
+/**
+ * The check every password write path outside the cohort import uses.
+ *
+ * It was four hardcoded rules that no configuration could reach, which is why
+ * `authentication.passwordPolicy` -- including its two security flags -- applied
+ * to exactly one endpoint in the product. It now delegates to the shared policy:
+ * called with one argument it behaves exactly as it always did, and a caller
+ * that has the install's policy and the account can hand them over.
+ */
+export declare function validatePasswordStrength(pwd: string, policy?: AppliedPasswordPolicy, identity?: string): {
     valid: boolean;
     errors: string[];
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nucleus-core-ts",
-  "version": "0.10.21",
+  "version": "0.10.23",
   "description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
   "author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
   "license": "SEE LICENSE IN LICENSE",