WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

internal/utils/password_policy.go

@@ -0,0 +1,49 @@
+package utils
+
+import (
+	"errors"
+	"strings"
+	"unicode/utf8"
+)
+
+const PasswordSpecialCharacters = "!@#$%^&*()_+-=[]{}|;:,.<>?"
+
+var (
+	ErrPasswordPolicy        = errors.New("password must be 3-32 characters and no more than 72 bytes")
+	ErrComplexPasswordPolicy = errors.New(
+		"password must be 8-32 characters and no more than 72 bytes, and contain uppercase and lowercase " +
+			"letters, numbers, and special characters")
+)
+
+// ValidatePasswordPolicy is shared by account registration, rotation and
+// workspace user management. Keep the byte limit in addition to the Unicode
+// character limit because bcrypt rejects inputs longer than 72 bytes.
+func ValidatePasswordPolicy(password string, complexPasswordEnabled bool) error {
+	length := utf8.RuneCountInString(password)
+	if !utf8.ValidString(password) || length < 3 || length > 32 || len(password) > 72 {
+		return ErrPasswordPolicy
+	}
+	if !complexPasswordEnabled {
+		return nil
+	}
+	if length < 8 {
+		return ErrComplexPasswordPolicy
+	}
+	var hasUpper, hasLower, hasDigit, hasSpecial bool
+	for _, r := range password {
+		switch {
+		case r >= 'A' && r <= 'Z':
+			hasUpper = true
+		case r >= 'a' && r <= 'z':
+			hasLower = true
+		case r >= '0' && r <= '9':
+			hasDigit = true
+		case strings.ContainsRune(PasswordSpecialCharacters, r):
+			hasSpecial = true
+		}
+	}
+	if !hasUpper || !hasLower || !hasDigit || !hasSpecial {
+		return ErrComplexPasswordPolicy
+	}
+	return nil
+}