forked from mirror/crumbs-original
Frederic CabassutandClaude Opus 5
51dd844f96
Groundwork for issue #77 (admin cannot reset other users' passwords). Two pure, colocated-tested modules shared by the API route and the settings UI that follow. password.ts — generatePassword() over a charset pinned at exactly 64 characters. 64 is a power of two, so nanoid's customAlphabet takes its exactly-uniform masking path (256 % 64 === 0) rather than the rejection branch; 120 bits of entropy at the default length of 20. Visually ambiguous characters (0 O o 1 l I) are excluded so a password survives being read aloud or retyped. Class coverage is guaranteed by discarding and regenerating a whole password that is missing a group, which stays uniform over exactly the set of valid passwords — rather than forcing characters into positions and shuffling, which would need its own unbiased index source. auth-methods.ts — canResetPassword() and passwordResetBlockedReason(), the single source of truth for eligibility so the endpoint and the component cannot drift. Password login is gated on authProvider (verifyPassword matches only rows where it equals 'password'), so writing a hash for any other provider stores a credential that can never be used to sign in. The reason lookup is a Map, not an object literal: an object inherits Object.prototype, so a lookup for 'toString' or '__proto__' resolves to an inherited member and the nullish fallback never fires — returning a function where the signature promises string | null. A Map has no such keys, so totality holds by construction instead of by a guard a later refactor could drop. DoD items verified: - [x] 1. generatePassword() returns 20 chars; explicit length honoured - [x] 2. always >=1 lowercase, uppercase, digit and symbol - [x] 3. never contains 0 O o 1 l I - [x] 4. randomness from nanoid customAlphabet; no Math.random - [x] 5. throws for length < 8 (the server minimum) - [x] 6. retry bounded at 100 with an unconditional throw (inspection) - [x] 7. canResetPassword true only for 'password' - [x] 8. totality: every blocked input yields a non-empty string - [x] 9. exact reason copy per provider; null when allowed - [x] 10. colocated tests pass Verified independently by the orchestrator: pnpm check 0 errors / 14 pre-existing warnings; pnpm test:unit 306 passed / 26 files (from 288 / 24); coverage 45.52 lines, 45.52 statements, 54.01 functions, 84.87 branches — every metric above both its .coverage-thresholds.json floor and the previous baseline, new files at 100%. Reviewed-by: adversarial-review (PASS, second reviewer; first found a prototype-chain totality violation, since fixed and re-reviewed fresh) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RbqJcFofZSbhbGwUwZP3wU
60 lines
2.3 KiB
TypeScript
60 lines
2.3 KiB
TypeScript
import { customAlphabet } from 'nanoid';
|
|
|
|
// The excluded characters — 0 O o 1 l I — are visually ambiguous, so a generated
|
|
// password survives being read aloud or retyped from a screenshot.
|
|
const LOWERCASE = 'abcdefghijkmnpqrstuvwxyz'; // no l, no o
|
|
const UPPERCASE = 'ABCDEFGHJKLMNPQRSTUVWXYZ'; // no I, no O
|
|
const DIGITS = '23456789'; // no 0, no 1
|
|
const SYMBOLS = '!@#$%^&*';
|
|
|
|
/**
|
|
* Pinned at exactly 64 characters. 64 is a power of two, so nanoid's masking
|
|
* takes its exactly-uniform fast path (256 % 64 === 0) and no character is
|
|
* favoured over another. At 64 symbols a 20-character password carries 120 bits
|
|
* of entropy — 119.79 once conditioned on the class-completeness retry below.
|
|
* Do not change the size without understanding both consequences.
|
|
*/
|
|
export const PASSWORD_ALPHABET = LOWERCASE + UPPERCASE + DIGITS + SYMBOLS;
|
|
|
|
const GROUPS = [LOWERCASE, UPPERCASE, DIGITS, SYMBOLS];
|
|
|
|
/** The server rejects anything shorter. */
|
|
const MIN_LENGTH = 8;
|
|
|
|
/**
|
|
* Per-attempt failure is 13.5% at the default length of 20 and 61.9% at the
|
|
* minimum of 8, so exhausting the cap has probability ~1e-87 and ~1e-21
|
|
* respectively — unreachable in practice. The bound exists so a future charset
|
|
* edit cannot turn the retry into an infinite loop.
|
|
*/
|
|
const MAX_ATTEMPTS = 100;
|
|
|
|
const randomString = customAlphabet(PASSWORD_ALPHABET);
|
|
|
|
function containsAnyOf(password: string, group: string): boolean {
|
|
return [...password].some((char) => group.includes(char));
|
|
}
|
|
|
|
/**
|
|
* Generates a random password containing at least one lowercase letter, one
|
|
* uppercase letter, one digit and one symbol.
|
|
*
|
|
* A password missing a group is discarded whole and regenerated, which keeps the
|
|
* result uniform over exactly the set of valid passwords. Forcing characters
|
|
* into chosen positions and shuffling would need its own unbiased index source.
|
|
*/
|
|
export function generatePassword(length = 20): string {
|
|
if (length < MIN_LENGTH) {
|
|
throw new Error(`Password length must be at least ${MIN_LENGTH}, got ${length}`);
|
|
}
|
|
|
|
for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
|
|
const password = randomString(length);
|
|
if (GROUPS.every((group) => containsAnyOf(password, group))) return password;
|
|
}
|
|
|
|
throw new Error(
|
|
`Failed to generate a password with all character groups after ${MAX_ATTEMPTS} attempts`
|
|
);
|
|
}
|