Would be great to manage password policy and session lifetimes in the admin UI

[MarcoSpittka]

Hi, it would be a nice addition if admins could adjust these settings in the admin UI:

• Password: minimum length and required character classes (incl. optional special characters)
• Session: lifetime of access and refresh tokens

Right now they're fixed in the code (packages/lib/src/password-policy.ts, refresh-token.service.ts). The password checklist in CSMS and portal could read the same values. Thanks for considering it!

[evtivity-admin]

Hi Marco, thank you for the suggestion. You're right that the password rules and the token lifetimes are fixed in code today, and making them admin settings that the CSMS and portal password checklists also read makes sense. We've noted it as an idea for a future release.

We're in a run of hardening releases right now, so new features are moving slower than usual. Pull requests are still very welcome, including for this one. The contributing guide covers the setup and checks. If you'd like to take it on, a short note here first about the approach would help us review it quickly.

[evtivity-admin]

Hi Marco, this is now in v0.1.48-beta.1 and ready for testing: https://github.com/EVtivity/evtivity-csms/releases/tag/v0.1.48-beta.1

Settings > Security has a new Passwords and Sessions tab:

• Passwords: minimum length (8 to 64, default 12), and whether an uppercase letter, a lowercase letter, a number and a special character are required. One policy applies to operators and drivers. New rules apply the next time someone sets a password, so current passwords keep working.
• Sessions: a sign-in check interval (5 to 1440 minutes, default 60) and an inactivity timeout (default 30 days, up to 90 for operators and 365 for drivers), set separately for operators and drivers. New values apply at sign-in and at the next background renewal.

The CSMS and driver portal password checklists read the same values from the server (GET /v1/security/public returns passwordPolicy), and a rejected password now says which rules are missing. Helm and CDK can set the same values under appSettings.security.password.* and appSettings.security.session.*.

We'd welcome feedback from your test setup, especially on the defaults and ranges.

[evtivity-admin]

Hi Marco, the password policy and session lifetime settings are now in the stable release v0.1.48, under Settings > Security > Passwords and Sessions, as described above. Thanks again for the suggestion.

[MarcoSpittka]

Hi,

thanks, this works perfectly for us. We are on v0.1.49-beta.8 in production and have configured the settings under Settings > Security > Passwords and Sessions:

• Session check interval: 60 minutes for operators and drivers
• Sign-out after inactivity: 30 days for operators and drivers

The defaults fit our needs well, and the ranges give enough room should we need to tighten them later. The German translation and the explanations next to each field make the settings easy to understand.

From our side this topic is complete, so I'm closing the discussion. Thanks again for implementing it so quickly.

Marco

[evtivity-admin]

@MarcoSpittka Glad to hear your feedback. Thanks.