From 195eb24187cb3fe4550786711a2c44c20a3c6144 Mon Sep 17 00:00:00 2001
From: sumanvpacewisdom <suman.v@pacewisdom.com>
Date: Tue, 19 Mar 2024 15:32:27 +0530
Subject: [PATCH 1/2] Audit Bug - 1148 , 1152 , 1153

---
 src/constants/common.js      |  2 +-
 src/envVariables.js          |  4 ++--
 src/locales/en.json          |  4 +++-
 src/services/org-admin.js    | 13 +++++++++++++
 src/validators/v1/account.js | 20 ++++++++++++++++++--
 src/validators/v1/admin.js   | 10 +++++++++-
 6 files changed, 46 insertions(+), 7 deletions(-)

diff --git a/src/constants/common.js b/src/constants/common.js
index 159efde6f..ce9011075 100644
--- a/src/constants/common.js
+++ b/src/constants/common.js
@@ -28,7 +28,7 @@ module.exports = {
 		'/user/v1/user-role/default',
 	],
 	notificationEmailType: 'email',
-	accessTokenExpiry: `${process.env.ACCESS_TOKEN_EXPIRY}d`,
+	accessTokenExpiry: process.env.ACCESS_TOKEN_EXPIRY,
 	refreshTokenExpiry: `${process.env.REFRESH_TOKEN_EXPIRY}d`,
 	refreshTokenExpiryInMs: Number(process.env.REFRESH_TOKEN_EXPIRY) * 24 * 60 * 60 * 1000,
 	refreshTokenLimit: 3,
diff --git a/src/envVariables.js b/src/envVariables.js
index e5ad54689..b61ff67ae 100644
--- a/src/envVariables.js
+++ b/src/envVariables.js
@@ -96,11 +96,11 @@ let enviromentVariables = {
 		optional: process.env.CLOUD_STORAGE === 'AZURE' ? false : true,
 	},
 	ACCESS_TOKEN_EXPIRY: {
-		message: 'Required access token expiry in days',
+		message: 'Required access token expiry',
 		optional: false,
 	},
 	REFRESH_TOKEN_EXPIRY: {
-		message: 'Required refresh token expiry in days',
+		message: 'Required refresh token expiry',
 		optional: false,
 	},
 	API_DOC_URL: {
diff --git a/src/locales/en.json b/src/locales/en.json
index 9cba64a1a..b5dad36d7 100644
--- a/src/locales/en.json
+++ b/src/locales/en.json
@@ -113,5 +113,7 @@
 	"ROLES_HAS_EMPTY_LIST": "Empty roles list",
 	"COLUMN_DOES_NOT_EXISTS": "Role column does not exists",
 	"PERMISSION_DENIED": "You do not have the required permissions to access this resource. Please contact your administrator for assistance.",
-	"RELATED_ORG_REMOVAL_FAILED": "Requested organization not related the organization. Please check the values."
+	"RELATED_ORG_REMOVAL_FAILED": "Requested organization not related the organization. Please check the values.",
+	"INAVLID_ORG_ROLE_REQ": "Invalid organisation request"
+
 }
diff --git a/src/services/org-admin.js b/src/services/org-admin.js
index 3b5d136bc..bd496d222 100644
--- a/src/services/org-admin.js
+++ b/src/services/org-admin.js
@@ -237,6 +237,19 @@ module.exports = class OrgAdminHelper {
 			const requestId = bodyData.request_id
 			delete bodyData.request_id
 
+			const requestDetail = await orgRoleReqQueries.requestDetails({
+				id: requestId,
+				organization_id: tokenInformation.organization_id,
+			})
+
+			if (requestDetail.status !== common.REQUESTED_STATUS) {
+				return responses.failureResponse({
+					message: 'INAVLID_ORG_ROLE_REQ',
+					statusCode: httpStatusCode.bad_request,
+					responseCode: 'CLIENT_ERROR',
+				})
+			}
+
 			bodyData.handled_by = tokenInformation.id
 			const rowsAffected = await orgRoleReqQueries.update(
 				{ id: requestId, organization_id: tokenInformation.organization_id },
diff --git a/src/validators/v1/account.js b/src/validators/v1/account.js
index 449860c2d..260c05c98 100644
--- a/src/validators/v1/account.js
+++ b/src/validators/v1/account.js
@@ -25,7 +25,15 @@ module.exports = {
 			.withMessage('email is invalid')
 			.normalizeEmail({ gmail_remove_dots: false })
 
-		req.checkBody('password').trim().notEmpty().withMessage('password field is empty')
+			req.checkBody('password')
+			.notEmpty()
+			.withMessage('Password field is empty')
+			.matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/)
+			.withMessage(
+				'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long'
+			)
+			.custom((value) => !/\s/.test(value))
+			.withMessage('Password cannot contain spaces')
 
 		if (req.body.role) {
 			req.checkBody('role').trim().not().isIn([common.ADMIN_ROLE]).withMessage("User does't have admin access")
@@ -64,7 +72,15 @@ module.exports = {
 
 	resetPassword: (req) => {
 		req.checkBody('email').notEmpty().withMessage('email field is empty').isEmail().withMessage('email is invalid')
-		req.checkBody('password').notEmpty().withMessage('password field is empty')
+		req.checkBody('password')
+			.notEmpty()
+			.withMessage('Password field is empty')
+			.matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/)
+			.withMessage(
+				'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long'
+			)
+			.custom((value) => !/\s/.test(value))
+			.withMessage('Password cannot contain spaces')
 
 		req.checkBody('otp')
 			.notEmpty()
diff --git a/src/validators/v1/admin.js b/src/validators/v1/admin.js
index 575be9190..75ffdbc89 100644
--- a/src/validators/v1/admin.js
+++ b/src/validators/v1/admin.js
@@ -27,7 +27,15 @@ module.exports = {
 			.withMessage('email is invalid')
 			.normalizeEmail()
 
-		req.checkBody('password').trim().notEmpty().withMessage('password field is empty')
+			req.checkBody('password')
+			.notEmpty()
+			.withMessage('Password field is empty')
+			.matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/)
+			.withMessage(
+				'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long'
+			)
+			.custom((value) => !/\s/.test(value))
+			.withMessage('Password cannot contain spaces')
 	},
 
 	login: (req) => {

From 5817165679a96671c4b515f8b55fc5f688ddfdae Mon Sep 17 00:00:00 2001
From: sumanvpacewisdom <suman.v@pacewisdom.com>
Date: Wed, 20 Mar 2024 16:21:17 +0530
Subject: [PATCH 2/2] Comment Changes regarding the password

---
 src/envVariables.js          | 11 +++++++++++
 src/validators/v1/account.js | 14 +++++---------
 src/validators/v1/admin.js   |  8 +++-----
 3 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/src/envVariables.js b/src/envVariables.js
index b61ff67ae..0a9a29855 100644
--- a/src/envVariables.js
+++ b/src/envVariables.js
@@ -237,6 +237,17 @@ let enviromentVariables = {
 		optional: true,
 		default: '*',
 	},
+	PASSWORD_POLICY_REGEX: {
+		message: 'Required password policy',
+		optional: true,
+		default: '/^(?=.*[A-Z])(?=.*d)(?=.*[!@#$%^&*()_+{}|:<>?~`-=[];,./])[^ ]{11,}$/',
+	},
+	PASSWORD_POLICY_MESSAGE: {
+		message: 'Required password policy message',
+		optional: true,
+		default:
+			'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long',
+	},
 }
 
 let success = true
diff --git a/src/validators/v1/account.js b/src/validators/v1/account.js
index 260c05c98..aa906017c 100644
--- a/src/validators/v1/account.js
+++ b/src/validators/v1/account.js
@@ -25,13 +25,11 @@ module.exports = {
 			.withMessage('email is invalid')
 			.normalizeEmail({ gmail_remove_dots: false })
 
-			req.checkBody('password')
+		req.checkBody('password')
 			.notEmpty()
 			.withMessage('Password field is empty')
-			.matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/)
-			.withMessage(
-				'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long'
-			)
+			.matches(process.env.PASSWORD_POLICY_REGEX)
+			.withMessage(process.env.PASSWORD_POLICY_MESSAGE)
 			.custom((value) => !/\s/.test(value))
 			.withMessage('Password cannot contain spaces')
 
@@ -75,10 +73,8 @@ module.exports = {
 		req.checkBody('password')
 			.notEmpty()
 			.withMessage('Password field is empty')
-			.matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/)
-			.withMessage(
-				'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long'
-			)
+			.matches(process.env.PASSWORD_POLICY_REGEX)
+			.withMessage(process.env.PASSWORD_POLICY_MESSAGE)
 			.custom((value) => !/\s/.test(value))
 			.withMessage('Password cannot contain spaces')
 
diff --git a/src/validators/v1/admin.js b/src/validators/v1/admin.js
index 75ffdbc89..1877d9f36 100644
--- a/src/validators/v1/admin.js
+++ b/src/validators/v1/admin.js
@@ -27,13 +27,11 @@ module.exports = {
 			.withMessage('email is invalid')
 			.normalizeEmail()
 
-			req.checkBody('password')
+		req.checkBody('password')
 			.notEmpty()
 			.withMessage('Password field is empty')
-			.matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/)
-			.withMessage(
-				'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long'
-			)
+			.matches(process.env.PASSWORD_POLICY_REGEX)
+			.withMessage(process.env.PASSWORD_POLICY_MESSAGE)
 			.custom((value) => !/\s/.test(value))
 			.withMessage('Password cannot contain spaces')
 	},
