feat: implement password change dialog and validation in agent settings

#157

Author: tacxou

apps/api/src/core/agents/agents.controller.ts

@@ -405,9 +405,10 @@ export class AgentsController extends AbstractController {
       }
 
       const newPassword = `${payload.password}`.trim();
-      if ((await this.passwdadmService.checkPolicies(newPassword)) === false) {
+      const policyViolation = await this.passwdadmService.getPolicyViolation(newPassword);
+      if (policyViolation) {
         throw new BadRequestException({
-          message: 'Une erreur est survenue : Le mot de passe ne respecte pas la politique des mots de passe',
+          message: policyViolation,
           error: 'Bad Request',
           statusCode: 400,
         });
@@ -778,9 +779,10 @@ export class AgentsController extends AbstractController {
     const payload: Record<string, any> = { ...(body as Record<string, any>) };
     if (typeof payload.password === 'string' && payload.password.trim().length > 0) {
       const newPassword = `${payload.password}`.trim();
-      if ((await this.passwdadmService.checkPolicies(newPassword)) === false) {
+      const policyViolation = await this.passwdadmService.getPolicyViolation(newPassword);
+      if (policyViolation) {
         throw new BadRequestException({
-          message: 'Une erreur est survenue : Le mot de passe ne respecte pas la politique des mots de passe',
+          message: policyViolation,
           error: 'Bad Request',
           statusCode: 400,
         });

apps/api/src/settings/passwdadm.service.ts

@@ -15,54 +15,55 @@ export class PasswdadmService extends AbstractSettingsService {
     return this.setParameter('passwordpolicies', policies);
   }
 
-  public async checkPolicies(password: string): Promise<boolean> {
+  public async getPolicyViolation(password: string): Promise<string | null> {
     const policies = await this.getPolicies();
     if (password.length < policies.len) {
       this.logger.error('Password too short');
-      return false;
+      return `Le mot de passe est trop court (minimum ${policies.len} caractères)`;
     }
-    //tes caracteres speciaux
     if (policies.hasSpecialChars > 0) {
       if (/[!@#\$%\^\&*\)\(+=._-]/.test(password) === false) {
         this.logger.error('must have special characters');
-        return false;
+        return 'Le mot de passe doit contenir au moins un caractère spécial';
       }
     }
     if (policies.hasLowerCase > 0) {
       if (/[a-z]/.test(password) === false) {
         this.logger.error('must have lower case characters');
-        return false;
+        return 'Le mot de passe doit contenir au moins une minuscule';
       }
     }
     if (policies.hasUpperCase > 0) {
       if (/[A-Z]/.test(password) === false) {
         this.logger.error('must have upper case characters');
-        return false;
+        return 'Le mot de passe doit contenir au moins une majuscule';
       }
     }
     if (policies.hasNumbers > 0) {
       if (/[0-9]/.test(password) === false) {
         this.logger.error('must have number');
-        return false;
+        return 'Le mot de passe doit contenir au moins un chiffre';
       }
     }
-    //calcul de l'entropie
     if (policies.minComplexity > 0) {
       const c = stringEntropy(password);
       if (c < policies.minComplexity) {
         this.logger.error('entropie trop faible');
-        return false;
+        return 'La complexité du mot de passe est insuffisante';
       }
     }
 
-    // check si le mdp est pwned
     if (policies.checkPwned === true) {
       const numPwns = await pwnedPassword(password);
       if (numPwns > 0) {
-        return false;
+        return "Ce mot de passe est déjà apparu lors d'une violation de données";
       }
     }
-    return true;
+    return null;
+  }
+
+  public async checkPolicies(password: string): Promise<boolean> {
+    return (await this.getPolicyViolation(password)) === null;
   }
 
   protected async defaultValues<T = PasswordPoliciesDto>(): Promise<T> {

apps/api/tests/unit/settings/passwdadm.service.spec.ts

@@ -1,6 +1,6 @@
 import { PasswdadmService } from '~/settings/passwdadm.service';
 
-describe('PasswdadmService.checkPolicies', () => {
+describe('PasswdadmService.getPolicyViolation', () => {
   it('should reject when hasNumbers enabled and password has no digits', async () => {
     const ctx = {
       getPolicies: async () => ({
@@ -15,8 +15,8 @@ describe('PasswdadmService.checkPolicies', () => {
       logger: { error: jest.fn() },
     } as any;
 
-    const ok = await PasswdadmService.prototype.checkPolicies.call(ctx, 'NoDigitsHere!');
-    expect(ok).toBe(false);
+    const violation = await PasswdadmService.prototype.getPolicyViolation.call(ctx, 'NoDigitsHere!');
+    expect(violation).toBe('Le mot de passe doit contenir au moins un chiffre');
   });
 
   it('should accept when hasNumbers enabled and password has digits', async () => {
@@ -33,7 +33,7 @@ describe('PasswdadmService.checkPolicies', () => {
       logger: { error: jest.fn() },
     } as any;
 
-    const ok = await PasswdadmService.prototype.checkPolicies.call(ctx, 'Has1Digit');
-    expect(ok).toBe(true);
+    const violation = await PasswdadmService.prototype.getPolicyViolation.call(ctx, 'Has1Digit');
+    expect(violation).toBeNull();
   });
 });