50 lines
1.4 KiB
Go
50 lines
1.4 KiB
Go
|
package utils
|
||
|
|
|
||
|
|
import (
|
||
|
|
"errors"
|
||
|
|
"strings"
|
||
|
|
"unicode/utf8"
|
||
|
|
)
|
||
|
|
|
||
|
|
const PasswordSpecialCharacters = "!@#$%^&*()_+-=[]{}|;:,.<>?"
|
||
|
|
|
||
|
|
var (
|
||
|
|
ErrPasswordPolicy = errors.New("password must be 3-32 characters and no more than 72 bytes")
|
||
|
|
ErrComplexPasswordPolicy = errors.New(
|
||
|
|
"password must be 8-32 characters and no more than 72 bytes, and contain uppercase and lowercase " +
|
||
|
|
"letters, numbers, and special characters")
|
||
|
|
)
|
||
|
|
|
||
|
|
// ValidatePasswordPolicy is shared by account registration, rotation and
|
||
|
|
// workspace user management. Keep the byte limit in addition to the Unicode
|
||
|
|
// character limit because bcrypt rejects inputs longer than 72 bytes.
|
||
|
|
func ValidatePasswordPolicy(password string, complexPasswordEnabled bool) error {
|
||
|
|
length := utf8.RuneCountInString(password)
|
||
|
|
if !utf8.ValidString(password) || length < 3 || length > 32 || len(password) > 72 {
|
||
|
|
return ErrPasswordPolicy
|
||
|
|
}
|
||
|
|
if !complexPasswordEnabled {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
if length < 8 {
|
||
|
|
return ErrComplexPasswordPolicy
|
||
|
|
}
|
||
|
|
var hasUpper, hasLower, hasDigit, hasSpecial bool
|
||
|
|
for _, r := range password {
|
||
|
|
switch {
|
||
|
|
case r >= 'A' && r <= 'Z':
|
||
|
|
hasUpper = true
|
||
|
|
case r >= 'a' && r <= 'z':
|
||
|
|
hasLower = true
|
||
|
|
case r >= '0' && r <= '9':
|
||
|
|
hasDigit = true
|
||
|
|
case strings.ContainsRune(PasswordSpecialCharacters, r):
|
||
|
|
hasSpecial = true
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if !hasUpper || !hasLower || !hasDigit || !hasSpecial {
|
||
|
|
return ErrComplexPasswordPolicy
|
||
|
|
}
|
||
|
|
return nil
|
||
|
|
}
|