fix: align password validation with backend ASCII policy (WealthLedger/backend#60) (#89)

src/features/auth/model/auth.schema.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from "vitest";
+
+import { loginSchema, registerSchema } from "./auth.schema";
+
+const email = "user@example.com";
+
+function canLogIn(password: string) {
+	return loginSchema.safeParse({ email, password }).success;
+}
+
+function canRegister(password: string, confirmation = password) {
+	return registerSchema.safeParse({
+		email,
+		password,
+		passwordConfirmation: confirmation,
+	}).success;
+}
+
+// Register policy: 8..72 printable ASCII (bcrypt reads 72 bytes, so non-ASCII could be
+// truncated). Login stays lenient so accounts created under the old policy still sign in.
+describe("auth password policy", () => {
+	it.each([
+		["7 chars", "a".repeat(7), false],
+		["8 chars", "a".repeat(8), true],
+		["72 chars", "a".repeat(72), true],
+		["73 chars", "a".repeat(73), false],
+		["printable symbols and space", "Aa1 !~\"#$%&'()*+,-./:;<=>?@", true],
+		["Cyrillic, 8+ chars", "пароль-пароль", false],
+		["emoji", "passw😀rd", false],
+		["tab", "pass\tword1", false],
+		["newline", "password1\n", false],
+		["DEL", "password\u{7F}1", false],
+	])("register: %s", (_, password, accepted) => {
+		expect(canRegister(password)).toBe(accepted);
+	});
+
+	it("register compares the raw password with its confirmation", () => {
+		const padded = "  spaced pass  ";
+
+		expect(canRegister(padded)).toBe(true);
+		expect(canRegister(padded, padded.trim())).toBe(false);
+	});
+
+	it.each([
+		["legacy Cyrillic password", "пароль-пароль", true],
+		["short legacy password", "short", true],
+		["72 bytes", "a".repeat(72), true],
+		["73 bytes", "a".repeat(73), false],
+		["36 Cyrillic letters = 72 bytes", "я".repeat(36), true],
+		["37 Cyrillic letters = 74 bytes", "я".repeat(37), false],
+		["empty", "", false],
+	])("login: %s", (_, password, accepted) => {
+		expect(canLogIn(password)).toBe(accepted);
+	});
+});

src/features/auth/model/auth.schema.ts

@@ -7,8 +7,10 @@ const EMAIL_PART_COUNT = 2;
 const ASCII_SPACE = 32;
 const ASCII_DELETE = 127;
 const MAX_EMAIL_LENGTH = 254;
-const MIN_PASSWORD_BYTES = 12;
+const MIN_PASSWORD_LENGTH = 8;
 const MAX_PASSWORD_BYTES = 72;
+// Printable ASCII keeps characters == bytes, within the bcrypt 72-byte limit.
+const ASCII_TILDE = 126;
 
 function isEmailCharacterInvalid(character: string): boolean {
 	const codePoint = character.codePointAt(0);
@@ -20,6 +22,14 @@ function isEmailCharacterInvalid(character: string): boolean {
 	);
 }
 
+function isPrintableAscii(value: string): boolean {
+	return value.split("").every((character) => {
+		const code = character.codePointAt(0) ?? 0;
+
+		return code >= ASCII_SPACE && code <= ASCII_TILDE;
+	});
+}
+
 const email = z
 	.string()
 	.trim()
@@ -33,28 +43,42 @@ const email = z
 		{ error: validationMessage("auth.validation.invalidEmail") },
 	);
 
-const password = z
+// Login stays lenient: accounts created under an older policy must still sign in.
+const loginPassword = z
 	.string()
+	.min(1)
 	.refine(
-		value =>
-			new TextEncoder().encode(value).length >= MIN_PASSWORD_BYTES
-				&& new TextEncoder().encode(value).length <= MAX_PASSWORD_BYTES,
-		{ error: validationMessage("auth.validation.invalidPasswordLength") },
+		value => new TextEncoder().encode(value).length <= MAX_PASSWORD_BYTES,
+		{ error: validationMessage("auth.validation.passwordTooLong") },
 	);
 
+const registerPassword = z
+	.string()
+	.min(MIN_PASSWORD_LENGTH, {
+		error: validationMessage("auth.validation.invalidPasswordLength"),
+	})
+	.max(MAX_PASSWORD_BYTES, {
+		error: validationMessage("auth.validation.invalidPasswordLength"),
+	})
+	.refine(isPrintableAscii, {
+		error: validationMessage("auth.validation.invalidPasswordLength"),
+	});
+
 const loginSchema = z.object({
 	email,
-	password,
+	password: loginPassword,
 	passwordConfirmation: z.string().optional(),
 });
 
-const registerSchema = loginSchema.refine(
-	value => value.password === value.passwordConfirmation,
-	{
-		error: validationMessage("auth.validation.passwordsDoNotMatch"),
-		path: ["passwordConfirmation"],
-	},
-);
+const registerSchema = loginSchema
+	.extend({ password: registerPassword })
+	.refine(
+		value => value.password === value.passwordConfirmation,
+		{
+			error: validationMessage("auth.validation.passwordsDoNotMatch"),
+			path: ["passwordConfirmation"],
+		},
+	);
 
 type AuthFormValues = z.input<typeof loginSchema>;