@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.2

package/backend/internal/account/internal/passwords/passwords.go

@@ -0,0 +1,37 @@
+// Package passwords holds the bundled common-password blocklist (PRD §6.4,
+// rule COMMON_PASSWORD). Source and licence of the list: NOTICE in this
+// directory. The frontend lazy-loads the same file for its live checklist.
+package passwords
+
+import (
+	_ "embed"
+	"strings"
+)
+
+//go:embed common-passwords.txt
+var commonList string
+
+// common holds every list entry folded to lower case. The list is printable
+// ASCII, so strings.ToLower is an exact ASCII case fold here.
+var common = func() map[string]struct{} {
+	lines := strings.Split(commonList, "\n")
+	m := make(map[string]struct{}, len(lines))
+	for _, l := range lines {
+		l = strings.TrimSuffix(l, "\r")
+		if l != "" {
+			m[strings.ToLower(l)] = struct{}{}
+		}
+	}
+	return m
+}()
+
+// IsCommon reports whether pw equals a list entry, ignoring case. The whole
+// password is compared as submitted: nothing is trimmed, and a list entry
+// inside a longer password does not match.
+func IsCommon(pw string) bool {
+	_, ok := common[strings.ToLower(pw)]
+	return ok
+}
+
+// Len is the number of distinct entries (after case folding).
+func Len() int { return len(common) }

package/backend/internal/account/internal/passwords/passwords_test.go

@@ -0,0 +1,35 @@
+package passwords
+
+import "testing"
+
+func TestIsCommon(t *testing.T) {
+	for _, tc := range []struct {
+		pw   string
+		want bool
+	}{
+		{"password", true},
+		{"PASSWORD", true},
+		{"PassWord", true},
+		{"123456", true},
+		{"films+pic+galeries", true},
+		{"Films+Pic+Galeries", true},
+		{"eyphed", true}, // last line of the file
+		{"", false},
+		{" password", false}, // nothing is trimmed
+		{"password ", false},
+		{"password1!", false}, // not on the list
+		{"xpasswordx", false}, // an entry inside a longer password does not match
+		{"Correct-Horse-1", false},
+	} {
+		if got := IsCommon(tc.pw); got != tc.want {
+			t.Errorf("IsCommon(%q) = %v, want %v", tc.pw, got, tc.want)
+		}
+	}
+}
+
+func TestListIsLoaded(t *testing.T) {
+	// 10,001 lines, no case-folded duplicates (NOTICE).
+	if got := Len(); got != 10001 {
+		t.Errorf("Len() = %d, want 10001", got)
+	}
+}

package/backend/internal/account/keyboard.go

@@ -0,0 +1,75 @@
+package account
+
+import "strings"
+
+const minKeyboardRun = 4
+
+// keyboardRows are the four rows of US QWERTY (PRD §6.4). Rows do not join
+// and do not wrap: the end of one row is not adjacent to the start of the next.
+var keyboardRows = [...]string{
+	"1234567890-=",
+	"qwertyuiop[]",
+	"asdfghjkl;'",
+	"zxcvbnm,./",
+}
+
+// shiftedRows holds the shifted glyph of each key, position for position with
+// keyboardRows (letters are folded by case instead).
+var shiftedRows = [...]string{
+	"!@#$%^&*()_+",
+	"QWERTYUIOP{}",
+	"ASDFGHJKL:\"",
+	"ZXCVBNM<>?",
+}
+
+// keyPos is a key's row and column on the keyboard.
+type keyPos struct{ row, col int8 }
+
+// keyOf maps every unshifted and shifted glyph to its key. Glyphs on no row
+// (` ~ \ | and anything non-ASCII) are absent and break a run.
+var keyOf = func() map[rune]keyPos {
+	m := make(map[rune]keyPos, 2*len(keyboardRows[0])*4)
+	for r := range keyboardRows {
+		for c, g := range keyboardRows[r] {
+			m[g] = keyPos{int8(r), int8(c)}
+		}
+		for c, g := range shiftedRows[r] {
+			m[g] = keyPos{int8(r), int8(c)}
+		}
+	}
+	return m
+}()
+
+// violatesKeyboardRun: four or more adjacent keys on one row, read left to
+// right or right to left, case-insensitive, a shifted glyph counting as its
+// key (`!@#$` is `1234`). The same key repeated is not a run (that is REPEAT),
+// and a run must keep one direction ("qwer" yes, "qwqw" no).
+func violatesKeyboardRun(pw, _ string) bool {
+	var prev keyPos
+	have, run, dir := false, 0, int8(0)
+	for _, r := range strings.ToLower(pw) {
+		k, ok := keyOf[r]
+		if !ok {
+			have, run, dir = false, 0, 0
+			continue
+		}
+		step := int8(0)
+		if have && k.row == prev.row {
+			step = k.col - prev.col
+		}
+		if step == 1 || step == -1 {
+			if run >= 2 && step == dir {
+				run++
+			} else {
+				run, dir = 2, step
+			}
+		} else {
+			run, dir = 1, 0
+		}
+		prev, have = k, true
+		if run >= minKeyboardRun {
+			return true
+		}
+	}
+	return false
+}

package/backend/internal/account/keyboard_test.go

@@ -0,0 +1,43 @@
+package account
+
+import "testing"
+
+func TestViolatesKeyboardRun(t *testing.T) {
+	for _, tc := range []struct {
+		pw   string
+		want bool
+	}{
+		{"", false},
+		{"qwe", false},
+		{"qwer", true},
+		{"rewq", true},
+		{"QwEr", true},
+		{"1234", true},
+		{"4321", true},
+		{"!@#$", true},
+		{"1@3$", true},
+		{"=-09", true},
+		{"[poi", true},
+		{"zxcv", true},
+		{"/.,m", true},
+		{"asdf", true},
+		{"';lk", true},
+		{"{POI", true},
+		{"xqwertyx", true},
+		{"p-asdf", true}, // rows do not join: only asdf counts
+		{"pasd", false},  // no wrap row to row
+		{"0-=q", false},  // "0-=" is 3 keys, then a new row
+		{"qwewq", false}, // direction change restarts the count
+		{"qw~er", false},
+		{"qwdf", false},
+		{"qqqq", false},
+		{"1111", false},
+		{"`123", false},
+		{"éqwe", false},
+		{"aaa-sdf", false},
+	} {
+		if got := violatesKeyboardRun(tc.pw, ""); got != tc.want {
+			t.Errorf("violatesKeyboardRun(%q) = %v, want %v", tc.pw, got, tc.want)
+		}
+	}
+}

package/backend/internal/account/logging_integration_test.go

@@ -43,7 +43,7 @@ func TestRegisterLogsNeverContainPassword(t *testing.T) {
 	auditSvc := audit.New(db, log)
 	errs := server.ErrorAdapter{Audit: auditSvc, Log: log}
 	api := server.API{Account: account.Handler{
-		Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
+		Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.DefaultPolicy()},
 		Fail:    errs.Write,
 	}}
 	e := env{db: db, h: apispec.Load(t).Validate(t, server.NewPublic(log, server.Mount(api)))}

package/backend/internal/account/password.go

@@ -0,0 +1,131 @@
+package account
+
+import (
+	"strings"
+	"unicode/utf8"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/account/internal/passwords"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// Password policy (PRD §6.4). Rule ids are the wire contract (errors[].rule).
+const (
+	RuleLength        = "LENGTH"
+	RuleCharset       = "CHARSET"
+	RuleComplexity    = "COMPLEXITY"
+	RuleCommon        = "COMMON_PASSWORD"
+	RuleKeyboardRun   = "KEYBOARD_RUN"
+	RuleSequence      = "SEQUENCE"
+	RuleRepeat        = "REPEAT"
+	RuleContainsEmpNo = "CONTAINS_EMP_NO"
+)
+
+const (
+	minPassLen     = 12
+	maxPassLen     = 64 // code points
+	minPassClasses = 3
+	maxRepeat      = 2 // 3+ identical characters in a row is a violation
+)
+
+// Rule is one row of the §6.4 table. Violated reports whether password breaks
+// the rule; empNo is "" when the submitted employee ID is malformed.
+type Rule struct {
+	ID       string
+	Violated func(password, empNo string) bool
+}
+
+// Policy runs its rules in order and reports every violated one. The slice
+// order is the PRD §6.4 table order, which is part of the contract
+// (testdata/password.json): later PRs add their rule at its table position.
+type Policy struct{ Rules []Rule }
+
+// DefaultPolicy returns all eight rules of the PRD §6.4 table, in table order.
+func DefaultPolicy() *Policy {
+	return &Policy{Rules: []Rule{
+		{RuleLength, violatesLength},
+		{RuleCharset, violatesCharset},
+		{RuleComplexity, violatesComplexity},
+		{RuleCommon, violatesCommon},
+		{RuleKeyboardRun, violatesKeyboardRun},
+		{RuleSequence, violatesSequence},
+		{RuleRepeat, violatesRepeat},
+		{RuleContainsEmpNo, violatesEmpNo},
+	}}
+}
+
+// Check implements PasswordPolicy. Each violation is a PASSWORD_POLICY error
+// on field "password" carrying the rule id.
+func (p *Policy) Check(password, empNo string) []web.FieldError {
+	var out []web.FieldError
+	for _, r := range p.Rules {
+		if r.Violated(password, empNo) {
+			out = append(out, web.FieldError{Field: fieldPassword, Code: web.CodePasswordPolicy, Rule: r.ID})
+		}
+	}
+	return out
+}
+
+func violatesLength(pw, _ string) bool {
+	n := utf8.RuneCountInString(pw)
+	return n < minPassLen || n > maxPassLen
+}
+
+func violatesCharset(pw, _ string) bool {
+	for _, r := range pw {
+		if r < 0x20 || r > 0x7E { // also catches U+FFFD from invalid UTF-8
+			return true
+		}
+	}
+	return false
+}
+
+// violatesComplexity counts upper, lower, digit and symbol; a symbol is any
+// printable non-alphanumeric ASCII character, space included. Characters
+// outside printable ASCII belong to no class (CHARSET reports them).
+func violatesComplexity(pw, _ string) bool {
+	var upper, lower, digit, symbol bool
+	for _, r := range pw {
+		switch {
+		case r >= 'A' && r <= 'Z':
+			upper = true
+		case r >= 'a' && r <= 'z':
+			lower = true
+		case r >= '0' && r <= '9':
+			digit = true
+		case r >= 0x20 && r <= 0x7E:
+			symbol = true
+		}
+	}
+	n := 0
+	for _, c := range [...]bool{upper, lower, digit, symbol} {
+		if c {
+			n++
+		}
+	}
+	return n < minPassClasses
+}
+
+// violatesCommon: the whole password equals an entry of the bundled Top-10,000
+// list, ignoring case (internal/passwords/NOTICE for the source).
+func violatesCommon(pw, _ string) bool { return passwords.IsCommon(pw) }
+
+// violatesRepeat: the same character three or more times in a row, compared
+// exactly (case-sensitive: "aAa" is fine).
+func violatesRepeat(pw, _ string) bool {
+	run, prev := 0, rune(-1)
+	for _, r := range pw {
+		if r == prev {
+			run++
+		} else {
+			run, prev = 1, r
+		}
+		if run > maxRepeat {
+			return true
+		}
+	}
+	return false
+}
+
+func violatesEmpNo(pw, empNo string) bool {
+	return empNo != "" && strings.Contains(pw, empNo)
+}

package/backend/internal/account/sequence.go

@@ -0,0 +1,54 @@
+package account
+
+const minSequence = 4
+
+// seqKey places a character on one of two alphabets: letters a–z (case
+// folded) and digits 0–9. ok is false for anything else, which breaks a
+// sequence. Letters and digits never join each other ("89ab" is two runs of 2),
+// and neighbours in ASCII outside an alphabet do not count ("xyz{" is 3).
+func seqKey(r rune) (alpha int8, pos int8, ok bool) {
+	switch {
+	case r >= 'a' && r <= 'z':
+		return 0, int8(r - 'a'), true
+	case r >= 'A' && r <= 'Z':
+		return 0, int8(r - 'A'), true
+	case r >= '0' && r <= '9':
+		return 1, int8(r - '0'), true
+	}
+	return 0, 0, false
+}
+
+// violatesSequence: four or more consecutive letters or digits, ascending or
+// descending, case-insensitive ("abcd", "DcBa", "4321"). Sequences do not wrap
+// ("xyza", "9012" are fine), the same character repeated is not a sequence
+// (that is REPEAT), and a run must keep one direction ("abcba" is fine).
+// Mirrors violatesKeyboardRun.
+func violatesSequence(pw, _ string) bool {
+	var prevAlpha, prevPos int8
+	have, run, dir := false, 0, int8(0)
+	for _, r := range pw {
+		a, p, ok := seqKey(r)
+		if !ok {
+			have, run, dir = false, 0, 0
+			continue
+		}
+		step := int8(0)
+		if have && a == prevAlpha {
+			step = p - prevPos
+		}
+		if step == 1 || step == -1 {
+			if run >= 2 && step == dir {
+				run++
+			} else {
+				run, dir = 2, step
+			}
+		} else {
+			run, dir = 1, 0
+		}
+		prevAlpha, prevPos, have = a, p, true
+		if run >= minSequence {
+			return true
+		}
+	}
+	return false
+}

package/backend/internal/account/sequence_test.go

@@ -0,0 +1,38 @@
+package account
+
+import "testing"
+
+func TestViolatesSequence(t *testing.T) {
+	for _, tc := range []struct {
+		pw   string
+		want bool
+	}{
+		{"", false},
+		{"abc", false},
+		{"abcd", true},
+		{"dcba", true},
+		{"aBcD", true},
+		{"WXYZ", true},
+		{"0123", true},
+		{"9876", true},
+		{"3210", true},
+		{"x-abcdefg-y", true}, // longer run, inside other text
+		{"xyza", false},       // no wrap
+		{"9012", false},       // no wrap
+		{"zyxw", true},
+		{"abcba", false},  // direction change restarts the count
+		{"abbc", false},   // a repeat breaks the run
+		{"aaaa", false},   // repeat is not a sequence
+		{"89ab", false},   // letters and digits do not join
+		{"xyz{", false},   // ASCII neighbour outside the alphabet
+		{"/012", false},   // ASCII neighbour outside the alphabet
+		{"ab-cd", false},  // a separator breaks the run
+		{"abécd", false},  // non-ASCII breaks the run
+		{"ab12cd", false}, // alphabets switching break the run
+		{"abc0123", true},
+	} {
+		if got := violatesSequence(tc.pw, ""); got != tc.want {
+			t.Errorf("violatesSequence(%q) = %v, want %v", tc.pw, got, tc.want)
+		}
+	}
+}

package/backend/internal/account/validate.go

@@ -9,10 +9,9 @@ import (
 
 // Field limits (PRD §6.3).
 const (
-	empNoLen     = 6
-	maxNameLen   = 50
-	maxEmailLen  = 254
-	maxPassBytes = 72 // bcrypt silently ignores (x/crypto: rejects) anything longer
+	empNoLen    = 6
+	maxNameLen  = 50
+	maxEmailLen = 254
 )
 
 // Field names as they appear in errors[]; the order is the form order.
@@ -65,28 +64,12 @@ func checkEmail(s string) (string, text.Problem) {
 }
 
 // PasswordPolicy checks a candidate password and lists every violation, in
-// PRD §6.4 table order. empNo is the submitted employee ID when it is
+// PRD §6.4 table order (see Policy). empNo is the submitted employee ID when it is
 // well-formed and "" otherwise (the CONTAINS_EMP_NO rule is then skipped).
 type PasswordPolicy interface {
 	Check(password, empNo string) []web.FieldError
 }
 
-// StubPolicy is the placeholder until B1b-01 delivers the §6.4 rules. It only
-// refuses what the account cannot store: an empty password and one bcrypt
-// cannot hash (longer than 72 bytes). Everything else is accepted.
-type StubPolicy struct{}
-
-// Check implements PasswordPolicy.
-func (StubPolicy) Check(password, _ string) []web.FieldError {
-	switch {
-	case password == "":
-		return []web.FieldError{{Field: fieldPassword, Code: web.CodeRequired}}
-	case len(password) > maxPassBytes:
-		return []web.FieldError{{Field: fieldPassword, Code: web.CodeOutOfRange}}
-	}
-	return nil
-}
-
 // topCode is the response code of a 422: the first field error's code when it
 // is a specific registered code, else VALIDATION_FAILED (error-codes.md §2).
 func topCode(fields []web.FieldError) web.ErrorCode {