@budibase/backend-core 2.13.52 → 2.13.53

package/dist/index.js

@@ -6571,6 +6571,7 @@ __export(src_exports, {
   queue: () => queue_exports,
   redis: () => redis_exports,
   roles: () => roles_exports,
+  security: () => security_exports,
   sessions: () => sessions_exports,
   tenancy: () => tenancy,
   timers: () => timers_exports,
@@ -10510,6 +10511,35 @@ async function getSession(userId, sessionId) {
 
 // src/users/db.ts
 init_src();
+
+// src/security/index.ts
+var security_exports = {};
+__export(security_exports, {
+  PASSWORD_MAX_LENGTH: () => PASSWORD_MAX_LENGTH,
+  PASSWORD_MIN_LENGTH: () => PASSWORD_MIN_LENGTH,
+  validatePassword: () => validatePassword
+});
+
+// src/security/auth.ts
+var PASSWORD_MIN_LENGTH = +(process.env.PASSWORD_MIN_LENGTH || 8);
+var PASSWORD_MAX_LENGTH = +(process.env.PASSWORD_MAX_LENGTH || 512);
+function validatePassword(password) {
+  if (!password || password.length < PASSWORD_MIN_LENGTH) {
+    return {
+      valid: false,
+      error: `Password invalid. Minimum ${PASSWORD_MIN_LENGTH} characters.`
+    };
+  }
+  if (password.length > PASSWORD_MAX_LENGTH) {
+    return {
+      valid: false,
+      error: `Password invalid. Maximum ${PASSWORD_MAX_LENGTH} characters.`
+    };
+  }
+  return { valid: true };
+}
+
+// src/users/db.ts
 var bulkDeleteProcessing = async (dbUser) => {
   const userId = dbUser._id;
   await users_exports2.removeUser(dbUser);
@@ -10551,6 +10581,10 @@ var UserDB = class _UserDB {
       if (await _UserDB.isPreventPasswordActions(user, account)) {
         throw new HTTPError("Password change is disabled for this user", 400);
       }
+      const passwordValidation = validatePassword(password);
+      if (!passwordValidation.valid) {
+        throw new HTTPError(passwordValidation.error, 400);
+      }
       hashedPassword = opts.hashPassword ? await hash(password) : password;
     } else if (dbUser) {
       hashedPassword = dbUser.password;
@@ -13787,6 +13821,7 @@ var init8 = (opts = {}) => {
   queue,
   redis,
   roles,
+  security,
   sessions,
   tenancy,
   timers,