use-password-policy 2.0.0 → 3.0.0

package/dist/core.mjs

@@ -0,0 +1,431 @@
+// src/common-passwords.ts
+var COMMON_PASSWORDS = [
+  // number sequences & repeats
+  "123456",
+  "1234567",
+  "12345678",
+  "123456789",
+  "1234567890",
+  "0123456789",
+  "111111",
+  "1111111",
+  "11111111",
+  "000000",
+  "00000000",
+  "123123",
+  "123321",
+  "654321",
+  "666666",
+  "777777",
+  "7777777",
+  "888888",
+  "88888888",
+  "999999",
+  "121212",
+  "112233",
+  "123654",
+  "987654321",
+  "147258369",
+  "159753",
+  "12341234",
+  "1q2w3e",
+  "1q2w3e4r",
+  "1q2w3e4r5t",
+  "1qaz2wsx",
+  "1qazxsw2",
+  "zaq12wsx",
+  // keyboard walks
+  "qwerty",
+  "qwertyu",
+  "qwertyuiop",
+  "qwe",
+  "qweasd",
+  "qweasdzxc",
+  "qwer",
+  "qazwsx",
+  "asdf",
+  "asdfgh",
+  "asdfghjkl",
+  "zxcvbn",
+  "zxcvbnm",
+  "azerty",
+  "qwertz",
+  "abc",
+  "abcd",
+  "abcde",
+  "abcdef",
+  "abcdefg",
+  "abcdefgh",
+  "aaaaaa",
+  // the classics
+  "password",
+  "pass",
+  "passwort",
+  "passpass",
+  "secret",
+  "letmein",
+  "welcome",
+  "admin",
+  "administrator",
+  "root",
+  "login",
+  "user",
+  "guest",
+  "test",
+  "default",
+  "changeme",
+  "access",
+  "master",
+  "trustno",
+  "whatever",
+  "nothing",
+  "unknown",
+  "iloveyou",
+  "loveme",
+  "love",
+  "lovely",
+  "hello",
+  "hellokitty",
+  "freedom",
+  "monkey",
+  "dragon",
+  "shadow",
+  "sunshine",
+  "princess",
+  "superman",
+  "batman",
+  "spiderman",
+  "starwars",
+  "pokemon",
+  "naruto",
+  "matrix",
+  "ninja",
+  "killer",
+  "football",
+  "baseball",
+  "basketball",
+  "soccer",
+  "hockey",
+  "golf",
+  "tennis",
+  "liverpool",
+  "arsenal",
+  "chelsea",
+  "barcelona",
+  "realmadrid",
+  "juventus",
+  "mustang",
+  "ferrari",
+  "porsche",
+  "harley",
+  "corvette",
+  "mercedes",
+  "computer",
+  "internet",
+  "google",
+  "apple",
+  "samsung",
+  "facebook",
+  "linkedin",
+  "myspace",
+  "youtube",
+  "twitter",
+  "instagram",
+  "microsoft",
+  "windows",
+  "summer",
+  "winter",
+  "spring",
+  "autumn",
+  "monday",
+  "friday",
+  "sunday",
+  "flower",
+  "cheese",
+  "cookie",
+  "chocolate",
+  "pepper",
+  "ginger",
+  "banana",
+  "orange",
+  "purple",
+  "silver",
+  "golden",
+  "diamond",
+  "money",
+  "angel",
+  "michael",
+  "jennifer",
+  "jessica",
+  "ashley",
+  "jordan",
+  "hunter",
+  "ranger",
+  "buster",
+  "tigger",
+  "charlie",
+  "robert",
+  "thomas",
+  "daniel",
+  "andrew",
+  "joshua",
+  "maggie",
+  "bailey",
+  "matthew",
+  "anthony"
+];
+
+// src/pwned.ts
+var HIBP_RANGE = "https://api.pwnedpasswords.com/range/";
+async function sha1Hex(input) {
+  var _a;
+  const subtle = (_a = globalThis.crypto) == null ? void 0 : _a.subtle;
+  if (!subtle) {
+    throw new Error(
+      "use-password-policy: crypto.subtle is not available. It needs a secure context (https or localhost) in browsers, or Node 20+."
+    );
+  }
+  const digest = await subtle.digest("SHA-1", new TextEncoder().encode(input));
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
+}
+async function checkPwnedPassword(password, options = {}) {
+  var _a, _b;
+  if (!password) return 0;
+  const doFetch = (_a = options.fetch) != null ? _a : globalThis.fetch;
+  if (!doFetch) throw new Error("use-password-policy: no fetch implementation available.");
+  const hash = await sha1Hex(password);
+  const prefix = hash.slice(0, 5);
+  const suffix = hash.slice(5);
+  const res = await doFetch(`${(_b = options.endpoint) != null ? _b : HIBP_RANGE}${prefix}`, {
+    signal: options.signal,
+    headers: options.padding ? { "Add-Padding": "true" } : void 0
+  });
+  if (!res.ok) throw new Error(`use-password-policy: breach check failed (HTTP ${res.status}).`);
+  const body = await res.text();
+  for (const line of body.split("\n")) {
+    const [lineSuffix, count] = line.trim().split(":");
+    if (lineSuffix === suffix) return parseInt(count, 10) || 0;
+  }
+  return 0;
+}
+
+// src/core.ts
+var DEFAULT_OPTIONS = {
+  minLength: 8,
+  maxLength: 0,
+  lowercaseCheck: true,
+  uppercaseCheck: true,
+  numberCheck: true,
+  specialCharCheck: true,
+  commonPasswordCheck: false,
+  commonPasswords: COMMON_PASSWORDS,
+  customRules: [],
+  messages: {},
+  lowercaseRegex: /[a-z]/,
+  uppercaseRegex: /[A-Z]/,
+  numberRegex: /\d/,
+  specialCharRegex: /[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?`~]/
+};
+var presets = {
+  /** The classic checklist (these are also the defaults): 8+ chars, upper, lower, number, symbol. */
+  classic: {
+    minLength: 8,
+    lowercaseCheck: true,
+    uppercaseCheck: true,
+    numberCheck: true,
+    specialCharCheck: true
+  },
+  /**
+   * NIST SP 800-63B-4 (Aug 2025) for passwords used on their own:
+   * at least 15 characters, allow up to 64, no composition rules, block common passwords.
+   */
+  nist: {
+    minLength: 15,
+    maxLength: 64,
+    lowercaseCheck: false,
+    uppercaseCheck: false,
+    numberCheck: false,
+    specialCharCheck: false,
+    commonPasswordCheck: true
+  },
+  /** NIST SP 800-63B-4 when the password is one factor of MFA: at least 8 characters. */
+  nistMfa: {
+    minLength: 8,
+    maxLength: 64,
+    lowercaseCheck: false,
+    uppercaseCheck: false,
+    numberCheck: false,
+    specialCharCheck: false,
+    commonPasswordCheck: true
+  }
+};
+var DEFAULT_MESSAGES = {
+  minLength: (o) => `At least ${o.minLength} characters`,
+  maxLength: (o) => `At most ${o.maxLength} characters`,
+  uppercase: "An uppercase letter",
+  lowercase: "A lowercase letter",
+  number: "A number",
+  specialChar: "A special character",
+  notCommon: "Not a commonly used password",
+  match: "Passwords match",
+  strength: "Hard to guess"
+};
+var STRENGTH_LABELS = ["Very Weak", "Weak", "Medium", "Strong", "Very Strong"];
+function resolveOptions(options = {}) {
+  const merged = { ...DEFAULT_OPTIONS };
+  for (const [key, value] of Object.entries(options)) {
+    if (key !== "password" && value !== void 0) merged[key] = value;
+  }
+  return merged;
+}
+var LEET = { "@": "a", "4": "a", "8": "b", "3": "e", "1": "i", "!": "i", "0": "o", "$": "s", "5": "s", "7": "t" };
+var unleet = (s) => s.replace(/[@483!1$057]/g, (c) => {
+  var _a;
+  return (_a = LEET[c]) != null ? _a : c;
+});
+var commonSetCache = /* @__PURE__ */ new WeakMap();
+function getCommonSet(list) {
+  let set = commonSetCache.get(list);
+  if (!set) {
+    set = new Set(list.map((p) => p.toLowerCase()));
+    commonSetCache.set(list, set);
+  }
+  return set;
+}
+function isCommonPassword(password, list = COMMON_PASSWORDS) {
+  if (!password) return false;
+  const set = getCommonSet(list);
+  const lower = password.toLowerCase();
+  const noTrailingSymbols = lower.replace(/[^a-z0-9]+$/, "");
+  const trimmed = lower.replace(/[^a-z]+$/, "");
+  const base = unleet(trimmed);
+  const baseNoLeading = unleet(trimmed.replace(/^[^a-z]+/, ""));
+  return [lower, noTrailingSymbols, base, baseNoLeading].some((c) => c.length > 0 && set.has(c));
+}
+var prettify = (name) => name.replace(/([A-Z])/g, " $1").replace(/^./, (s) => s.toUpperCase()).trim();
+function resolveMessage(rule, options) {
+  var _a, _b;
+  const msg = (_b = (_a = options.messages[rule.name]) != null ? _a : rule.message) != null ? _b : DEFAULT_MESSAGES[rule.name];
+  if (typeof msg === "function") return msg(options);
+  return msg != null ? msg : prettify(rule.name);
+}
+function builtInRules(options, estimate) {
+  const rules = [];
+  if (options.minLength > 0) {
+    rules.push({ name: "minLength", optionsKey: "minLength", test: (p, o) => p.length >= o.minLength });
+  }
+  if (options.maxLength > 0) {
+    rules.push({ name: "maxLength", optionsKey: "maxLength", test: (p, o) => p.length <= o.maxLength });
+  }
+  if (options.uppercaseCheck) {
+    rules.push({ name: "uppercase", optionsKey: "uppercaseCheck", test: (p, o) => o.uppercaseRegex.test(p) });
+  }
+  if (options.lowercaseCheck) {
+    rules.push({ name: "lowercase", optionsKey: "lowercaseCheck", test: (p, o) => o.lowercaseRegex.test(p) });
+  }
+  if (options.numberCheck) {
+    rules.push({ name: "number", optionsKey: "numberCheck", test: (p, o) => o.numberRegex.test(p) });
+  }
+  if (options.specialCharCheck) {
+    rules.push({ name: "specialChar", optionsKey: "specialCharCheck", test: (p, o) => o.specialCharRegex.test(p) });
+  }
+  if (options.commonPasswordCheck) {
+    rules.push({
+      name: "notCommon",
+      optionsKey: "commonPasswordCheck",
+      test: (p, o) => p.length > 0 && !isCommonPassword(p, o.commonPasswords)
+    });
+  }
+  if (options.confirmPassword !== void 0) {
+    rules.push({
+      name: "match",
+      optionsKey: "confirmPassword",
+      test: (p, o) => p.length > 0 && p === o.confirmPassword
+    });
+  }
+  if (estimate && options.minStrength !== void 0) {
+    const min = options.minStrength;
+    rules.push({ name: "strength", optionsKey: "minStrength", test: () => estimate.score >= min });
+  }
+  return rules;
+}
+function validatePassword(password, options = {}) {
+  const pw = password != null ? password : "";
+  const resolved = resolveOptions(options);
+  const estimate = resolved.strengthEstimator ? resolved.strengthEstimator(pw) : void 0;
+  const rules = [...builtInRules(resolved, estimate), ...resolved.customRules];
+  const policyState = {};
+  const requirements = [];
+  const errors = [];
+  let passedCount = 0;
+  for (const rule of rules) {
+    const passed = Boolean(rule.test(pw, resolved));
+    const message = resolveMessage(rule, resolved);
+    policyState[rule.name] = passed;
+    requirements.push({ name: rule.name, passed, message });
+    if (passed) passedCount++;
+    else errors.push(message);
+  }
+  const total = rules.length;
+  let strengthPercent;
+  let strengthLabel;
+  if (estimate) {
+    const score = Math.max(0, Math.min(4, Math.round(estimate.score)));
+    strengthPercent = pw.length === 0 ? 0 : score / 4;
+    strengthLabel = STRENGTH_LABELS[score];
+  } else {
+    strengthPercent = total > 0 ? passedCount / total : 0;
+    if (strengthPercent >= 1) strengthLabel = "Very Strong";
+    else if (strengthPercent >= 0.75) strengthLabel = "Strong";
+    else if (strengthPercent >= 0.5) strengthLabel = "Medium";
+    else if (strengthPercent > 0) strengthLabel = "Weak";
+    else strengthLabel = "Very Weak";
+  }
+  return {
+    isValid: total > 0 && passedCount === total,
+    policyState,
+    requirements,
+    errors,
+    strengthScore: passedCount,
+    strengthPercent,
+    strengthLabel,
+    ...estimate ? { estimate } : {}
+  };
+}
+function fromZxcvbn(zxcvbn, userInputs) {
+  const run = typeof zxcvbn === "function" ? zxcvbn : (pw, inputs) => zxcvbn.check(pw, inputs);
+  return (password) => {
+    var _a, _b, _c;
+    const result = run(password, userInputs);
+    const score = Math.max(0, Math.min(4, Math.round(result.score)));
+    const feedback = ((_a = result.feedback) == null ? void 0 : _a.warning) || ((_c = (_b = result.feedback) == null ? void 0 : _b.suggestions) == null ? void 0 : _c[0]) || void 0;
+    return feedback ? { score, feedback } : { score };
+  };
+}
+function zodPasswordRule(options = {}, { allErrors = true } = {}) {
+  return (value, ctx) => {
+    const { errors } = validatePassword(value, options);
+    for (const message of allErrors ? errors : errors.slice(0, 1)) {
+      ctx.addIssue({ code: "custom", message });
+    }
+  };
+}
+function passwordValidator(options = {}) {
+  return (value) => {
+    const { errors } = validatePassword(value != null ? value : "", options);
+    return errors.length === 0 ? true : errors[0];
+  };
+}
+export {
+  COMMON_PASSWORDS,
+  DEFAULT_MESSAGES,
+  DEFAULT_OPTIONS,
+  checkPwnedPassword,
+  fromZxcvbn,
+  isCommonPassword,
+  passwordValidator,
+  presets,
+  resolveOptions,
+  validatePassword,
+  zodPasswordRule
+};