Adding support for optional Password Policy

README.md

@@ -283,6 +283,7 @@ var server = ParseServer({
     // optional setting to enforce strong passwords
     // can be a RegExp/String representing pattern to enforce or a function that return a bool
     validator: /^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.{8,})/, // enforce password with at least 8 char with at least 1 lower case, 1 upper case and 1 digit
+    doNotAllowUsername: true, // optional setting to disallow username in passwords
     //optional setting to set a validity duration for password reset links (in seconds)
     resetTokenValidityDuration: 24*60*60, // expire after 24 hours
   }

spec/PasswordPolicy.spec.js

@@ -3,7 +3,7 @@
 const request = require('request');
 const Config = require('../src/Config');
 
-describe("Password Policy: ", () => {
+fdescribe("Password Policy: ", () => {
 
   it('should show the invalid link page if the user clicks on the password reset link after the token expires', done => {
     const user = new Parse.User();
@@ -446,4 +446,252 @@ describe("Password Policy: ", () => {
       });
   });
 
+  it('should fail if passwordPolicy.doNotAllowUsername is not a boolean value', (done) => {
+    reconfigureServer({
+      appName: 'passwordPolicy',
+      passwordPolicy: {
+        doNotAllowUsername: 'no'
+      },
+      publicServerURL: "http://localhost:8378/1"
+    })
+      .then(() => {
+        fail('passwordPolicy.doNotAllowUsername type test failed');
+        done();
+      })
+      .catch(err => {
+        expect(err).toEqual('passwordPolicy.doNotAllowUsername must be a boolean value.');
+        done();
+      });
+  });
+
+  it('signup should fail if password contains the username and is not allowed by policy', (done) => {
+    const user = new Parse.User();
+    reconfigureServer({
+      appName: 'passwordPolicy',
+      passwordPolicy: {
+        validator: /[0-9]+/,
+        doNotAllowUsername: true
+      },
+      publicServerURL: "http://localhost:8378/1"
+    }).then(() => {
+      user.setUsername("user1");
+      user.setPassword("@user11");
+      user.set('email', '[email protected]');
+      user.signUp().then(() => {
+        fail('Should have failed as password contains username.');
+        done();
+      }, (error) => {
+        expect(error.code).toEqual(142);
+        done();
+      });
+    })
+  });
+
+  it('signup should succeed if password does not contain the username and is not allowed by policy', (done) => {
+    const user = new Parse.User();
+    reconfigureServer({
+      appName: 'passwordPolicy',
+      passwordPolicy: {
+        doNotAllowUsername: true
+      },
+      publicServerURL: "http://localhost:8378/1"
+    }).then(() => {
+      user.setUsername("user1");
+      user.setPassword("r@nd0m");
+      user.set('email', '[email protected]');
+      user.signUp().then(() => {
+        done();
+      }, (error) => {
+        fail('Should have succeeded as password does not contain username.');
+        done();
+      });
+    })
+  });
+
+  it('signup should succeed if password contains the username and it is allowed by policy', (done) => {
+    const user = new Parse.User();
+    reconfigureServer({
+      appName: 'passwordPolicy',
+      passwordPolicy: {
+        validator: /[0-9]+/
+      },
+      publicServerURL: "http://localhost:8378/1"
+    }).then(() => {
+      user.setUsername("user1");
+      user.setPassword("user1");
+      user.set('email', '[email protected]');
+      user.signUp().then(() => {
+        done();
+      }, (error) => {
+        fail('Should have succeeded as policy allows username in password.');
+        done();
+      });
+    })
+  });
+
+  it('should fail to reset password if the new password contains username and not allowed by password policy', done => {
+    var user = new Parse.User();
+    var emailAdapter = {
+      sendVerificationEmail: () => Promise.resolve(),
+      sendPasswordResetEmail: options => {
+        request.get(options.link, {
+          followRedirect: false,
+        }, (error, response, body) => {
+          if (error) {
+            jfail(error);
+            fail("Failed to get the reset link");
+            return;
+          }
+          expect(response.statusCode).toEqual(302);
+          var re = /http:\/\/localhost:8378\/1\/apps\/choose_password\?token=([a-zA-Z0-9]+)\&id=test\&username=user1/;
+          var match = response.body.match(re);
+          if (!match) {
+            fail("should have a token");
+            done();
+            return;
+          }
+          var token = match[1];
+
+          request.post({
+            url: "http://localhost:8378/1/apps/test/request_password_reset",
+            body: `new_password=xuser12&token=${token}&username=user1`,
+            headers: {
+              'Content-Type': 'application/x-www-form-urlencoded'
+            },
+            followRedirect: false,
+          }, (error, response, body) => {
+            if (error) {
+              jfail(error);
+              fail("Failed to POST request password reset");
+              return;
+            }
+            expect(response.statusCode).toEqual(302);
+            expect(response.body).toEqual(`Found. Redirecting to http://localhost:8378/1/apps/choose_password?username=user1&token=${token}&id=test&error=Password%20does%20not%20confirm%20to%20the%20Password%20Policy.&app=passwordPolicy`);
+
+            Parse.User.logIn("user1", "r@nd0m").then(function (user) {
+              done();
+            }, (err) => {
+              jfail(err);
+              fail("should login with old password");
+              done();
+            });
+
+          });
+        });
+      },
+      sendMail: () => {
+      }
+    }
+    reconfigureServer({
+      appName: 'passwordPolicy',
+      verifyUserEmails: false,
+      emailAdapter: emailAdapter,
+      passwordPolicy: {
+        doNotAllowUsername: true
+      },
+      publicServerURL: "http://localhost:8378/1"
+    })
+      .then(() => {
+        user.setUsername("user1");
+        user.setPassword("r@nd0m");
+        user.set('email', '[email protected]');
+        user.signUp().then(() => {
+          Parse.User.requestPasswordReset('[email protected]', {
+            error: (err) => {
+              jfail(err);
+              fail("Reset password request should not fail");
+              done();
+            }
+          });
+        }, error => {
+          jfail(error);
+          fail("signUp should not fail");
+          done();
+        });
+      });
+  });
+
+  it('should reset password even if the new password contains user name while the policy allows', done => {
+    var user = new Parse.User();
+    var emailAdapter = {
+      sendVerificationEmail: () => Promise.resolve(),
+      sendPasswordResetEmail: options => {
+        request.get(options.link, {
+          followRedirect: false,
+        }, (error, response, body) => {
+          if (error) {
+            jfail(error);
+            fail("Failed to get the reset link");
+            return;
+          }
+          expect(response.statusCode).toEqual(302);
+          var re = /http:\/\/localhost:8378\/1\/apps\/choose_password\?token=([a-zA-Z0-9]+)\&id=test\&username=user1/;
+          var match = response.body.match(re);
+          if (!match) {
+            fail("should have a token");
+            done();
+            return;
+          }
+          var token = match[1];
+
+          request.post({
+            url: "http://localhost:8378/1/apps/test/request_password_reset",
+            body: `new_password=uuser11&token=${token}&username=user1`,
+            headers: {
+              'Content-Type': 'application/x-www-form-urlencoded'
+            },
+            followRedirect: false,
+          }, (error, response, body) => {
+            if (error) {
+              jfail(error);
+              fail("Failed to POST request password reset");
+              return;
+            }
+            expect(response.statusCode).toEqual(302);
+            expect(response.body).toEqual('Found. Redirecting to http://localhost:8378/1/apps/password_reset_success.html');
+
+            Parse.User.logIn("user1", "uuser11").then(function (user) {
+              done();
+            }, (err) => {
+              jfail(err);
+              fail("should login with new password");
+              done();
+            });
+
+          });
+        });
+      },
+      sendMail: () => {
+      }
+    }
+    reconfigureServer({
+      appName: 'passwordPolicy',
+      verifyUserEmails: false,
+      emailAdapter: emailAdapter,
+      passwordPolicy: {
+        validator: /[0-9]+/,
+        doNotAllowUsername: false
+      },
+      publicServerURL: "http://localhost:8378/1"
+    })
+      .then(() => {
+        user.setUsername("user1");
+        user.setPassword("has 1 digit");
+        user.set('email', '[email protected]');
+        user.signUp().then(() => {
+          Parse.User.requestPasswordReset('[email protected]', {
+            error: (err) => {
+              jfail(err);
+              fail("Reset password request should not fail");
+              done();
+            }
+          });
+        }, error => {
+          jfail(error);
+          fail("signUp should not fail");
+          done();
+        });
+      });
+  });
+
 })

src/Config.js

@@ -126,6 +126,10 @@ export class Config {
       if(passwordPolicy.validator && typeof passwordPolicy.validator !== 'string' && !(passwordPolicy.validator instanceof RegExp) && typeof passwordPolicy.validator !== 'function' ) {
         throw 'passwordPolicy.validator must be a RegExp, a string or a function.';
       }
+
+      if(passwordPolicy.doNotAllowUsername && typeof passwordPolicy.doNotAllowUsername !== 'boolean') {
+        throw 'passwordPolicy.doNotAllowUsername must be a boolean value.';
+      }
     }
   }
 

src/RestWrite.js

@@ -369,18 +369,47 @@ RestWrite.prototype.transformUser = function() {
       return;
     }
 
+    let defer = Promise.resolve();
+
     // check if the password confirms to the defined password policy if configured
-    if (this.config.passwordPolicy && this.config.passwordPolicy.validator && !this.config.passwordPolicy.validator(this.data.password)) {
-      return Promise.reject(new Parse.Error(Parse.Error.VALIDATION_ERROR, 'Password does not confirm to the Password Policy.'))
+    if (this.config.passwordPolicy) {
+      const policyError = 'Password does not confirm to the Password Policy.';
+
+      // check whether the password confirms to the policy
+      if (this.config.passwordPolicy.validator && !this.config.passwordPolicy.validator(this.data.password)) {
+        return Promise.reject(new Parse.Error(Parse.Error.VALIDATION_ERROR, policyError))
+      }
+
+      // check whether password contain username
+      if (this.config.passwordPolicy.doNotAllowUsername === true) {
+        if (this.data.username) { // username is not passed during password reset
+          if (this.data.password.indexOf(this.data.username) >= 0)
+            return Promise.reject(new Parse.Error(Parse.Error.VALIDATION_ERROR, policyError));
+
+        } else { // retrieve the User object using objectId during password reset
+          defer = this.config.database.find('_User', {objectId: this.objectId()})
+            .then(results => {
+              if (results.length != 1) {
+                throw undefined;
+              }
+              if (this.data.password.indexOf(results[0].username) >= 0)
+                return Promise.reject(new Parse.Error(Parse.Error.VALIDATION_ERROR, policyError));
+              return Promise.resolve();
+            });
+        }
+      }
     }
 
-    if (this.query && !this.auth.isMaster ) {
+    if (this.query && !this.auth.isMaster) {
       this.storage['clearSessions'] = true;
       this.storage['generateNewSession'] = true;
     }
-    return passwordCrypto.hash(this.data.password).then((hashedPassword) => {
-      this.data._hashed_password = hashedPassword;
-      delete this.data.password;
+
+    return defer.then(() => {
+      return passwordCrypto.hash(this.data.password).then((hashedPassword) => {
+        this.data._hashed_password = hashedPassword;
+        delete this.data.password;
+      });
     });
 
   }).then(() => {