Realm setting for password rotation

cmd/server/assets/realm.html

@@ -172,6 +172,32 @@ <h1>Realm settings</h1>
               </select>
             </div>
           </div>
+
+          <div class="form-group row">
+            <label for="pwdRotate" class="col-sm-3">Password rotation every:</label>
+            <div class="col-sm-2">
+              <select class="form-control" name="pwdRotate" id="pwdRotate">
+                {{$current := $realm.PasswordRotationPeriodDays}}
+                {{range $prd := .pwdRotateDays}}
+                <option value="{{$prd}}" {{if (eq $prd $current)}}selected{{end}}>{{if (eq $prd 0)}}Off{{else}}{{$prd}}{{end}}</option>
+                {{end}}
+              </select>
+            </div>
+            <div class="col-sm-1">days</div>
+          </div>
+
+          <div class="form-group row">
+            <label for="pwdWarn" class="col-sm-3">Password rotation warning:</label>
+            <div class="col-sm-2">
+              <select class="form-control{{if $realm.ErrorsFor "pwdWarn"}} is-invalid{{end}}" name="pwdWarn" id="pwdWarn">
+                {{$current := $realm.PasswordRotationWarningDays}}
+                {{range $pwd := .pwdWarnDays}}
+                <option value="{{$pwd }}" {{if (eq $pwd $current)}}selected{{end}}>{{if (eq $pwd 0)}}Off{{else}}{{$pwd}}{{end}}</option>
+                {{end}}
+              </select>
+            </div>
+            <div class="col-sm-3">days before rotation</div>
+          </div>
         </div>
       </div>
 

pkg/controller/realmadmin/save.go

@@ -27,10 +27,12 @@ import (
 )
 
 var (
-	shortCodeLengths = []int{6, 7, 8}
-	shortCodeMinutes = []int{}
-	longCodeLengths  = []int{12, 13, 14, 15, 16}
-	longCodeHours    = []int{}
+	shortCodeLengths            = []int{6, 7, 8}
+	shortCodeMinutes            = []int{}
+	longCodeLengths             = []int{12, 13, 14, 15, 16}
+	longCodeHours               = []int{}
+	passwordRotationPeriodDays  = []int{0, 30, 60, 90, 365}
+	passwordRotationWarningDays = []int{0, 1, 3, 5, 7, 30}
 )
 
 func init() {
@@ -44,13 +46,15 @@ func init() {
 
 func (c *Controller) HandleSave() http.Handler {
 	type FormData struct {
-		Name              string            `form:"name"`
-		RegionCode        string            `form:"regionCode"`
-		AllowedTestTypes  database.TestType `form:"allowedTestTypes"`
-		MFAMode           int16             `form:"MFAMode"`
-		EmailVerifiedMode int16             `form:"emailVerifiedMode"`
-		RequireDate       bool              `form:"requireDate"`
-		WelcomeMessage    string            `form:"welcomeMessage"`
+		Name               string            `form:"name"`
+		RegionCode         string            `form:"regionCode"`
+		AllowedTestTypes   database.TestType `form:"allowedTestTypes"`
+		MFAMode            int16             `form:"MFAMode"`
+		EmailVerifiedMode  int16             `form:"emailVerifiedMode"`
+		PasswordRotateDays uint              `form:"pwdRotate"`
+		PasswordWarnDays   uint              `form:"pwdWarn"`
+		RequireDate        bool              `form:"requireDate"`
+		WelcomeMessage     string            `form:"welcomeMessage"`
 
 		CodeLength          uint   `form:"codeLength"`
 		CodeDurationMinutes int64  `form:"codeDuration"`
@@ -111,6 +115,8 @@ func (c *Controller) HandleSave() http.Handler {
 		realm.SMSTextTemplate = form.SMSTextTemplate
 		realm.MFAMode = database.AuthRequirement(form.MFAMode)
 		realm.EmailVerifiedMode = database.AuthRequirement(form.EmailVerifiedMode)
+		realm.PasswordRotationPeriodDays = form.PasswordRotateDays
+		realm.PasswordRotationWarningDays = form.PasswordWarnDays
 		realm.AbusePreventionEnabled = form.AbusePreventionEnabled
 		realm.AbusePreventionLimitFactor = form.AbusePreventionLimitFactor
 		if err := c.db.SaveRealm(realm); err != nil {
@@ -208,6 +214,10 @@ func (c *Controller) renderShow(ctx context.Context, w http.ResponseWriter, r *h
 		"likely":    database.TestTypeConfirmed | database.TestTypeLikely,
 		"negative":  database.TestTypeConfirmed | database.TestTypeLikely | database.TestTypeNegative,
 	}
+	// Valid settings for pwd rotation.
+	m["pwdRotateDays"] = passwordRotationPeriodDays
+	m["pwdWarnDays"] = passwordRotationWarningDays
+
 	// Valid settings for code parameters.
 	m["shortCodeLengths"] = shortCodeLengths
 	m["shortCodeMinutes"] = shortCodeMinutes

pkg/database/realm.go

@@ -99,6 +99,14 @@ type Realm struct {
 	// EmailVerifiedMode represents the mode for email verification requirements for the realm.
 	EmailVerifiedMode AuthRequirement `gorm:"type:smallint; not null; default: 0"`
 
+	// PasswordRotationPeriodDays is the number of days before the user must
+	// rotate their password.
+	PasswordRotationPeriodDays uint `gorm:"type:smallint; not null; default: 0"`
+
+	// PasswordRotationWarningDays is the number of days before Password expiry
+	// that the user should receive a warning.
+	PasswordRotationWarningDays uint `gorm:"type:smallint; not null; default: 0"`
+
 	// AllowedTestTypes is the type of tests that this realm permits. The default
 	// value is to allow all test types.
 	AllowedTestTypes TestType `gorm:"type:smallint; not null; default: 14"`
@@ -209,6 +217,10 @@ func (r *Realm) BeforeSave(tx *gorm.DB) error {
 		}
 	}
 
+	if r.PasswordRotationWarningDays > r.PasswordRotationPeriodDays {
+		r.AddError("pwdWarn", "may not be longer than password rotation period")
+	}
+
 	if r.CodeLength < 6 {
 		r.AddError("codeLength", "must be at least 6")
 	}