@sjolystinnovation/app-kit 0.7.0 → 0.8.0

package/README.md

@@ -613,6 +613,24 @@ toast passes through, and so do the error states of `toast.promise`.
 import { toast } from "@sjolystinnovation/app-kit/toast";
 ```
 
+### `passwordSchema(strings?)`
+
+From `@sjolystinnovation/app-kit/validation`. A zod schema for a new password, with the rules the APIs
+enforce through ASP.NET Identity: at least 8 characters, with a lowercase letter, an uppercase letter
+and a digit. No symbol is needed. Identity counts only ASCII, so the letters are A to Z and the digits
+0 to 9, and "Å" does not count as uppercase. Identity sets no upper limit. An app whose API does adds
+it with `.max()`. A failing password gets one issue per rule it breaks, each with its message from
+`strings`. Missing messages fall back to `defaultPasswordStrings`, which are English.
+
+```ts
+import { passwordSchema } from "@sjolystinnovation/app-kit/validation";
+
+const result = passwordSchema({ uppercase: "Ta med en stor bokstav fra A til Z." }).safeParse(newPassword);
+const gargeRule = passwordSchema().max(128, "Be at most 128 characters long.");
+```
+
+`PASSWORD_MIN_LENGTH` holds the minimum, for hint text.
+
 ## Theming
 
 The components draw every colour, corner radius and label size from theme variables with a light
@@ -680,6 +698,7 @@ with it and has to set the ones it uses itself.
 
 - Next.js 16, React 19, next-auth 4.24 or later and axios 1.20 or later, as peer dependencies the
   app installs itself.
+- For `@sjolystinnovation/app-kit/validation`: zod 4, as an optional peer dependency.
 - For `@sjolystinnovation/app-kit/toast`: sonner 2, as an optional peer dependency. Install a single
   copy, because two copies keep two separate toast stores.
 - `jsonwebtoken` comes with the package. `@sjolystinnovation/app-kit/auth` uses it on the server.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjolystinnovation/app-kit",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Building blocks for Next.js apps that sign in against a JWT API through next-auth",
   "license": "Apache-2.0",
   "author": "Sjølyst Innovation AS",
@@ -24,6 +24,7 @@
     "./server": "./src/server/index.ts",
     "./ui": "./src/ui/index.ts",
     "./toast": "./src/toast/index.ts",
+    "./validation": "./src/validation/index.ts",
     "./styles.css": "./src/styles.css"
   },
   "files": [
@@ -44,11 +45,15 @@
     "next-auth": "^4.24",
     "react": "^19",
     "react-dom": "^19",
-    "sonner": "^2"
+    "sonner": "^2",
+    "zod": "^4"
   },
   "peerDependenciesMeta": {
     "sonner": {
       "optional": true
+    },
+    "zod": {
+      "optional": true
     }
   },
   "devDependencies": {
@@ -67,7 +72,8 @@
     "react-dom": "^19.3.0",
     "sonner": "^2.0.8",
     "typescript": "^6.0.3",
-    "vitest": "^5.0.3"
+    "vitest": "^5.0.3",
+    "zod": "^4.6.5"
   },
   "keywords": [
     "next.js",

package/src/validation/index.ts

@@ -0,0 +1,2 @@
+export { PASSWORD_MIN_LENGTH, defaultPasswordStrings, passwordSchema } from "./password";
+export type { PasswordStrings } from "./password";

package/src/validation/password.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+import { withDefaults, type TextOverrides } from "../ui/withDefaults";
+
+/** The fewest characters a password may have. */
+export const PASSWORD_MIN_LENGTH = 8;
+
+/** The message for each password rule that fails. */
+export interface PasswordStrings {
+  tooShort: string;
+  lowercase: string;
+  uppercase: string;
+  digit: string;
+}
+
+export const defaultPasswordStrings: PasswordStrings = {
+  tooShort: `Use at least ${PASSWORD_MIN_LENGTH} characters.`,
+  lowercase: "Include a lowercase letter from a to z.",
+  uppercase: "Include an uppercase letter from A to Z.",
+  digit: "Include a digit from 0 to 9.",
+};
+
+/**
+ * A zod schema for a new password, with the rules the APIs enforce through ASP.NET Identity. Identity
+ * counts only ASCII letters and digits, so "Å" is neither an uppercase nor a lowercase letter here.
+ * Length counts UTF-16 code units, as Identity does. There is no upper limit, because Identity has
+ * none. An app whose API sets one adds it with `.max()`. A failing password gets one issue per rule
+ * it breaks.
+ */
+export function passwordSchema(strings?: TextOverrides<PasswordStrings>) {
+  const text = withDefaults(defaultPasswordStrings, strings);
+  return z
+    .string()
+    .min(PASSWORD_MIN_LENGTH, text.tooShort)
+    .regex(/[a-z]/, text.lowercase)
+    .regex(/[A-Z]/, text.uppercase)
+    .regex(/[0-9]/, text.digit);
+}