@tbs-fitness/contract 0.7.0 → 0.8.0

package/README.md

@@ -43,6 +43,10 @@ const result = createFlagSchema.safeParse(input); // The same rules as the API.
 
 Requests have two types. Clients use `*Input`, where fields with a default are optional. The backend uses `*Body`, which is the result after validation. List queries come from the URL as strings, so they have no `*Input`: use `Partial<PaginationQuery>` or `Partial<AuditLogQuery>`.
 
+## Version 0.8.0 (breaking)
+
+- `newPasswordSchema` now matches the new-password screens: at least 8 characters (was 12) and at least one number. `MIN_PASSWORD_LENGTH` is `8`, and the new `PASSWORD_DIGIT_PATTERN` lets apps show the number rule as it is typed. Sign-up, password change and reset all use it; login does not, so existing passwords keep working.
+
 ## Version 0.7.0
 
 Permission names, CSRF names and the client feature-flag response. Additive; consumers install `^0.7.0` explicitly.

package/dist/cjs/auth/auth.dto.d.ts

@@ -1,6 +1,8 @@
 import { z } from 'zod';
-export declare const MIN_PASSWORD_LENGTH = 12;
+export declare const MIN_PASSWORD_LENGTH = 8;
 export declare const MAX_PASSWORD_LENGTH = 128;
+/** A new password must contain at least one character that matches this. */
+export declare const PASSWORD_DIGIT_PATTERN: RegExp;
 /** Every one-time code the API sends has this many digits. */
 export declare const OTP_LENGTH = 6;
 export declare const otpCodeSchema: z.ZodString;

package/dist/cjs/auth/auth.dto.js

@@ -1,15 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.revokedSessionsResponseSchema = exports.adminAccountResponseSchema = exports.passwordResetRequestedResponseSchema = exports.logoutAllResponseSchema = exports.sessionResponseSchema = exports.loginResponseSchema = exports.accountResponseSchema = exports.updateTimezoneSchema = exports.timezonePreferenceSchema = exports.tokenResponseSchema = exports.idParamSchema = exports.setStatusSchema = exports.setRoleSchema = exports.passwordResetConfirmSchema = exports.passwordResetRequestSchema = exports.changePasswordSchema = exports.refreshSchema = exports.loginSchema = exports.opaqueTokenSchema = exports.submittedPasswordSchema = exports.newPasswordSchema = exports.otpCodeSchema = exports.OTP_LENGTH = exports.MAX_PASSWORD_LENGTH = exports.MIN_PASSWORD_LENGTH = void 0;
+exports.revokedSessionsResponseSchema = exports.adminAccountResponseSchema = exports.passwordResetRequestedResponseSchema = exports.logoutAllResponseSchema = exports.sessionResponseSchema = exports.loginResponseSchema = exports.accountResponseSchema = exports.updateTimezoneSchema = exports.timezonePreferenceSchema = exports.tokenResponseSchema = exports.idParamSchema = exports.setStatusSchema = exports.setRoleSchema = exports.passwordResetConfirmSchema = exports.passwordResetRequestSchema = exports.changePasswordSchema = exports.refreshSchema = exports.loginSchema = exports.opaqueTokenSchema = exports.submittedPasswordSchema = exports.newPasswordSchema = exports.otpCodeSchema = exports.OTP_LENGTH = exports.PASSWORD_DIGIT_PATTERN = exports.MAX_PASSWORD_LENGTH = exports.MIN_PASSWORD_LENGTH = void 0;
 const zod_1 = require("zod");
 const contact_schema_js_1 = require("../common/contact.schema.js");
 const date_time_schema_js_1 = require("../common/date-time.schema.js");
 const safe_text_schema_js_1 = require("../common/safe-text.schema.js");
 const index_js_1 = require("../enums/index.js");
-// Per OWASP: length is what matters, with no composition rules. The upper limit
-// stops very long inputs from being used to exhaust the hashing function.
-exports.MIN_PASSWORD_LENGTH = 12;
+// The product's new-password rules: at least 8 characters and one number. The
+// upper limit stops very long inputs from being used to exhaust the hashing function.
+exports.MIN_PASSWORD_LENGTH = 8;
 exports.MAX_PASSWORD_LENGTH = 128;
+/** A new password must contain at least one character that matches this. */
+exports.PASSWORD_DIGIT_PATTERN = /\d/;
 const MAX_OPAQUE_TOKEN_LENGTH = 512;
 /** Every one-time code the API sends has this many digits. */
 exports.OTP_LENGTH = 6;
@@ -22,7 +24,8 @@ exports.otpCodeSchema = zod_1.z
 exports.newPasswordSchema = zod_1.z
     .string()
     .min(exports.MIN_PASSWORD_LENGTH)
-    .max(exports.MAX_PASSWORD_LENGTH);
+    .max(exports.MAX_PASSWORD_LENGTH)
+    .regex(exports.PASSWORD_DIGIT_PATTERN, { error: 'Include at least one number' });
 /** No minimum at login, so an old short password fails like any wrong password. */
 exports.submittedPasswordSchema = zod_1.z
     .string()

package/dist/esm/auth/auth.dto.d.ts

@@ -1,6 +1,8 @@
 import { z } from 'zod';
-export declare const MIN_PASSWORD_LENGTH = 12;
+export declare const MIN_PASSWORD_LENGTH = 8;
 export declare const MAX_PASSWORD_LENGTH = 128;
+/** A new password must contain at least one character that matches this. */
+export declare const PASSWORD_DIGIT_PATTERN: RegExp;
 /** Every one-time code the API sends has this many digits. */
 export declare const OTP_LENGTH = 6;
 export declare const otpCodeSchema: z.ZodString;

package/dist/esm/auth/auth.dto.js

@@ -3,10 +3,12 @@ import { emailSchema } from '../common/contact.schema.js';
 import { timezoneSchema, utcTimestampSchema, } from '../common/date-time.schema.js';
 import { safeTextSchema } from '../common/safe-text.schema.js';
 import { ACCOUNT_STATUSES, ADMIN_SETTABLE_ACCOUNT_STATUSES, ROLES, TIMEZONE_SOURCES, TOKEN_TRANSPORTS, } from '../enums/index.js';
-// Per OWASP: length is what matters, with no composition rules. The upper limit
-// stops very long inputs from being used to exhaust the hashing function.
-export const MIN_PASSWORD_LENGTH = 12;
+// The product's new-password rules: at least 8 characters and one number. The
+// upper limit stops very long inputs from being used to exhaust the hashing function.
+export const MIN_PASSWORD_LENGTH = 8;
 export const MAX_PASSWORD_LENGTH = 128;
+/** A new password must contain at least one character that matches this. */
+export const PASSWORD_DIGIT_PATTERN = /\d/;
 const MAX_OPAQUE_TOKEN_LENGTH = 512;
 /** Every one-time code the API sends has this many digits. */
 export const OTP_LENGTH = 6;
@@ -19,7 +21,8 @@ export const otpCodeSchema = z
 export const newPasswordSchema = z
     .string()
     .min(MIN_PASSWORD_LENGTH)
-    .max(MAX_PASSWORD_LENGTH);
+    .max(MAX_PASSWORD_LENGTH)
+    .regex(PASSWORD_DIGIT_PATTERN, { error: 'Include at least one number' });
 /** No minimum at login, so an old short password fails like any wrong password. */
 export const submittedPasswordSchema = z
     .string()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tbs-fitness/contract",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "TBS API contract: Zod schemas, DTO types and enums shared by the backend, web and mobile apps",
   "license": "UNLICENSED",
   "type": "module",