Find a matching password string then check if the password is not a duplicate and is still valid.

password-validation.js

// Test data.
var userData = {
  "password": "$2a$12$cZnjMBhqUI97xlKyizJh9uf43Kz5h0RC5wXVfy9WhTuth.mCbfzl.",
  "password_history": [
    {
      "created": "2017-05-01T23:00:00.000Z",
      "password": "password"
    },
    {
      "created": "2017-04-25T23:00:00.000Z",
      "password": "password1"
    },
    {
      "created": "2017-04-13T23:00:00.000Z",
      "password": "password2"
    },
    {
      "created": "2017-03-27T23:00:00.000Z",
      "password": "password3"
    }
  ],
  "password_reset_token": "84f96b2c-537a-4354-bc70-f9f28356b901",
  "password_reset_token_issued": "2017-05-02T15:44:43.000Z"
};


/**
 * Find a matching password string then check if the password
 * is not a duplicate and is still valid.
 *
 * @param Object userData
 * @param string passwordToMatch
 * @param int dupeLimit
 * @param int validity
 * @returns {*}
 */
function findEvalPassword(userData, passwordToMatch, dupeLimit, validity) {
    // If no values are passed duplicate limit and validity period then set them to 0 (ignore).
    dupeLimit = typeof dupeLimit !== 'undefined' ? dupeLimit : 0,
    validity = typeof validity !== 'undefined' ? validity : 0;

    for (var i = 0; i < userData.password_history.length; i++) {
        // Add new return values for duplicate and valid.
        userData.password_history[i].dupe_limit = false;
        userData.password_history[i].valid = true;

        // If the password strings do not match then continue.
        if (userData.password_history[i].password !== passwordToMatch) {
          continue;
        }
        
        // If the duplicate password limit has been reached then set dupe_limit flag to true.
        if ((i + 1) <= dupeLimit && dupeLimit !== 0) {
          userData.password_history[i].dupe_limit = true
        }
      
        // If the validity period (in days) is less than the created date
        // of the password then set validity flag to true.
        if (
          daysBetweenDates(Date.parse(userData.password_history[i].created)) > validity &&
          validity !== 0
        ) {
          userData.password_history[i].invalid = false;
        }
      
      	// Clear password from the result.
      	delete userData.password_history[i].password;
        
        // Return password information.
        return userData.password_history[i];
    }
}

/**
 * Returns the number of days between two dates.
 
 * @param int firstDate
 * @param int secondDate
 * @returns {number}
 */
function daysBetweenDates(firstDate, secondDate) {
    secondDate = typeof secondDate !== 'undefined' ? secondDate : Date.now();
    var oneDay = 24*60*60*1000; // hours*minutes*seconds*milliseconds.
    
    return Math.round(Math.abs((firstDate - secondDate)/(oneDay)));
}

console.log(JSON.stringify(findEvalPassword(userData, 'password3', 3, 90)));