From 195eb24187cb3fe4550786711a2c44c20a3c6144 Mon Sep 17 00:00:00 2001 From: sumanvpacewisdom Date: Tue, 19 Mar 2024 15:32:27 +0530 Subject: [PATCH 1/2] Audit Bug - 1148 , 1152 , 1153 --- src/constants/common.js | 2 +- src/envVariables.js | 4 ++-- src/locales/en.json | 4 +++- src/services/org-admin.js | 13 +++++++++++++ src/validators/v1/account.js | 20 ++++++++++++++++++-- src/validators/v1/admin.js | 10 +++++++++- 6 files changed, 46 insertions(+), 7 deletions(-) diff --git a/src/constants/common.js b/src/constants/common.js index 159efde6f..ce9011075 100644 --- a/src/constants/common.js +++ b/src/constants/common.js @@ -28,7 +28,7 @@ module.exports = { '/user/v1/user-role/default', ], notificationEmailType: 'email', - accessTokenExpiry: `${process.env.ACCESS_TOKEN_EXPIRY}d`, + accessTokenExpiry: process.env.ACCESS_TOKEN_EXPIRY, refreshTokenExpiry: `${process.env.REFRESH_TOKEN_EXPIRY}d`, refreshTokenExpiryInMs: Number(process.env.REFRESH_TOKEN_EXPIRY) * 24 * 60 * 60 * 1000, refreshTokenLimit: 3, diff --git a/src/envVariables.js b/src/envVariables.js index e5ad54689..b61ff67ae 100644 --- a/src/envVariables.js +++ b/src/envVariables.js @@ -96,11 +96,11 @@ let enviromentVariables = { optional: process.env.CLOUD_STORAGE === 'AZURE' ? false : true, }, ACCESS_TOKEN_EXPIRY: { - message: 'Required access token expiry in days', + message: 'Required access token expiry', optional: false, }, REFRESH_TOKEN_EXPIRY: { - message: 'Required refresh token expiry in days', + message: 'Required refresh token expiry', optional: false, }, API_DOC_URL: { diff --git a/src/locales/en.json b/src/locales/en.json index 9cba64a1a..b5dad36d7 100644 --- a/src/locales/en.json +++ b/src/locales/en.json @@ -113,5 +113,7 @@ "ROLES_HAS_EMPTY_LIST": "Empty roles list", "COLUMN_DOES_NOT_EXISTS": "Role column does not exists", "PERMISSION_DENIED": "You do not have the required permissions to access this resource. Please contact your administrator for assistance.", - "RELATED_ORG_REMOVAL_FAILED": "Requested organization not related the organization. Please check the values." + "RELATED_ORG_REMOVAL_FAILED": "Requested organization not related the organization. Please check the values.", + "INAVLID_ORG_ROLE_REQ": "Invalid organisation request" + } diff --git a/src/services/org-admin.js b/src/services/org-admin.js index 3b5d136bc..bd496d222 100644 --- a/src/services/org-admin.js +++ b/src/services/org-admin.js @@ -237,6 +237,19 @@ module.exports = class OrgAdminHelper { const requestId = bodyData.request_id delete bodyData.request_id + const requestDetail = await orgRoleReqQueries.requestDetails({ + id: requestId, + organization_id: tokenInformation.organization_id, + }) + + if (requestDetail.status !== common.REQUESTED_STATUS) { + return responses.failureResponse({ + message: 'INAVLID_ORG_ROLE_REQ', + statusCode: httpStatusCode.bad_request, + responseCode: 'CLIENT_ERROR', + }) + } + bodyData.handled_by = tokenInformation.id const rowsAffected = await orgRoleReqQueries.update( { id: requestId, organization_id: tokenInformation.organization_id }, diff --git a/src/validators/v1/account.js b/src/validators/v1/account.js index 449860c2d..260c05c98 100644 --- a/src/validators/v1/account.js +++ b/src/validators/v1/account.js @@ -25,7 +25,15 @@ module.exports = { .withMessage('email is invalid') .normalizeEmail({ gmail_remove_dots: false }) - req.checkBody('password').trim().notEmpty().withMessage('password field is empty') + req.checkBody('password') + .notEmpty() + .withMessage('Password field is empty') + .matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/) + .withMessage( + 'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long' + ) + .custom((value) => !/\s/.test(value)) + .withMessage('Password cannot contain spaces') if (req.body.role) { req.checkBody('role').trim().not().isIn([common.ADMIN_ROLE]).withMessage("User does't have admin access") @@ -64,7 +72,15 @@ module.exports = { resetPassword: (req) => { req.checkBody('email').notEmpty().withMessage('email field is empty').isEmail().withMessage('email is invalid') - req.checkBody('password').notEmpty().withMessage('password field is empty') + req.checkBody('password') + .notEmpty() + .withMessage('Password field is empty') + .matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/) + .withMessage( + 'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long' + ) + .custom((value) => !/\s/.test(value)) + .withMessage('Password cannot contain spaces') req.checkBody('otp') .notEmpty() diff --git a/src/validators/v1/admin.js b/src/validators/v1/admin.js index 575be9190..75ffdbc89 100644 --- a/src/validators/v1/admin.js +++ b/src/validators/v1/admin.js @@ -27,7 +27,15 @@ module.exports = { .withMessage('email is invalid') .normalizeEmail() - req.checkBody('password').trim().notEmpty().withMessage('password field is empty') + req.checkBody('password') + .notEmpty() + .withMessage('Password field is empty') + .matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/) + .withMessage( + 'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long' + ) + .custom((value) => !/\s/.test(value)) + .withMessage('Password cannot contain spaces') }, login: (req) => { From 5817165679a96671c4b515f8b55fc5f688ddfdae Mon Sep 17 00:00:00 2001 From: sumanvpacewisdom Date: Wed, 20 Mar 2024 16:21:17 +0530 Subject: [PATCH 2/2] Comment Changes regarding the password --- src/envVariables.js | 11 +++++++++++ src/validators/v1/account.js | 14 +++++--------- src/validators/v1/admin.js | 8 +++----- 3 files changed, 19 insertions(+), 14 deletions(-) diff --git a/src/envVariables.js b/src/envVariables.js index b61ff67ae..0a9a29855 100644 --- a/src/envVariables.js +++ b/src/envVariables.js @@ -237,6 +237,17 @@ let enviromentVariables = { optional: true, default: '*', }, + PASSWORD_POLICY_REGEX: { + message: 'Required password policy', + optional: true, + default: '/^(?=.*[A-Z])(?=.*d)(?=.*[!@#$%^&*()_+{}|:<>?~`-=[];,./])[^ ]{11,}$/', + }, + PASSWORD_POLICY_MESSAGE: { + message: 'Required password policy message', + optional: true, + default: + 'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long', + }, } let success = true diff --git a/src/validators/v1/account.js b/src/validators/v1/account.js index 260c05c98..aa906017c 100644 --- a/src/validators/v1/account.js +++ b/src/validators/v1/account.js @@ -25,13 +25,11 @@ module.exports = { .withMessage('email is invalid') .normalizeEmail({ gmail_remove_dots: false }) - req.checkBody('password') + req.checkBody('password') .notEmpty() .withMessage('Password field is empty') - .matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/) - .withMessage( - 'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long' - ) + .matches(process.env.PASSWORD_POLICY_REGEX) + .withMessage(process.env.PASSWORD_POLICY_MESSAGE) .custom((value) => !/\s/.test(value)) .withMessage('Password cannot contain spaces') @@ -75,10 +73,8 @@ module.exports = { req.checkBody('password') .notEmpty() .withMessage('Password field is empty') - .matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/) - .withMessage( - 'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long' - ) + .matches(process.env.PASSWORD_POLICY_REGEX) + .withMessage(process.env.PASSWORD_POLICY_MESSAGE) .custom((value) => !/\s/.test(value)) .withMessage('Password cannot contain spaces') diff --git a/src/validators/v1/admin.js b/src/validators/v1/admin.js index 75ffdbc89..1877d9f36 100644 --- a/src/validators/v1/admin.js +++ b/src/validators/v1/admin.js @@ -27,13 +27,11 @@ module.exports = { .withMessage('email is invalid') .normalizeEmail() - req.checkBody('password') + req.checkBody('password') .notEmpty() .withMessage('Password field is empty') - .matches(/^(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+{}|:"<>?~`\-=[\];',.\/])[^ ]{10,}$/) - .withMessage( - 'Password must have at least one uppercase letter, one number, one special character, and be at least 10 characters long' - ) + .matches(process.env.PASSWORD_POLICY_REGEX) + .withMessage(process.env.PASSWORD_POLICY_MESSAGE) .custom((value) => !/\s/.test(value)) .withMessage('Password cannot contain spaces') },