use-password-policy 2.0.0 → 3.1.0

package/dist/core.mjs

@@ -0,0 +1,586 @@
+// src/common-passwords.ts
+var COMMON_PASSWORDS = [
+  // number sequences & repeats
+  "123456",
+  "1234567",
+  "12345678",
+  "123456789",
+  "1234567890",
+  "0123456789",
+  "111111",
+  "1111111",
+  "11111111",
+  "000000",
+  "00000000",
+  "123123",
+  "123321",
+  "654321",
+  "666666",
+  "777777",
+  "7777777",
+  "888888",
+  "88888888",
+  "999999",
+  "121212",
+  "112233",
+  "123654",
+  "987654321",
+  "147258369",
+  "159753",
+  "12341234",
+  "1q2w3e",
+  "1q2w3e4r",
+  "1q2w3e4r5t",
+  "1qaz2wsx",
+  "1qazxsw2",
+  "zaq12wsx",
+  // keyboard walks
+  "qwerty",
+  "qwertyu",
+  "qwertyuiop",
+  "qwe",
+  "qweasd",
+  "qweasdzxc",
+  "qwer",
+  "qazwsx",
+  "asdf",
+  "asdfgh",
+  "asdfghjkl",
+  "zxcvbn",
+  "zxcvbnm",
+  "azerty",
+  "qwertz",
+  "abc",
+  "abcd",
+  "abcde",
+  "abcdef",
+  "abcdefg",
+  "abcdefgh",
+  "aaaaaa",
+  // the classics
+  "password",
+  "pass",
+  "passwort",
+  "passpass",
+  "secret",
+  "letmein",
+  "welcome",
+  "admin",
+  "administrator",
+  "root",
+  "login",
+  "user",
+  "guest",
+  "test",
+  "default",
+  "changeme",
+  "access",
+  "master",
+  "trustno",
+  "whatever",
+  "nothing",
+  "unknown",
+  "iloveyou",
+  "loveme",
+  "love",
+  "lovely",
+  "hello",
+  "hellokitty",
+  "freedom",
+  "monkey",
+  "dragon",
+  "shadow",
+  "sunshine",
+  "princess",
+  "superman",
+  "batman",
+  "spiderman",
+  "starwars",
+  "pokemon",
+  "naruto",
+  "matrix",
+  "ninja",
+  "killer",
+  "football",
+  "baseball",
+  "basketball",
+  "soccer",
+  "hockey",
+  "golf",
+  "tennis",
+  "liverpool",
+  "arsenal",
+  "chelsea",
+  "barcelona",
+  "realmadrid",
+  "juventus",
+  "mustang",
+  "ferrari",
+  "porsche",
+  "harley",
+  "corvette",
+  "mercedes",
+  "computer",
+  "internet",
+  "google",
+  "apple",
+  "samsung",
+  "facebook",
+  "linkedin",
+  "myspace",
+  "youtube",
+  "twitter",
+  "instagram",
+  "microsoft",
+  "windows",
+  "summer",
+  "winter",
+  "spring",
+  "autumn",
+  "monday",
+  "friday",
+  "sunday",
+  "flower",
+  "cheese",
+  "cookie",
+  "chocolate",
+  "pepper",
+  "ginger",
+  "banana",
+  "orange",
+  "purple",
+  "silver",
+  "golden",
+  "diamond",
+  "money",
+  "angel",
+  "michael",
+  "jennifer",
+  "jessica",
+  "ashley",
+  "jordan",
+  "hunter",
+  "ranger",
+  "buster",
+  "tigger",
+  "charlie",
+  "robert",
+  "thomas",
+  "daniel",
+  "andrew",
+  "joshua",
+  "maggie",
+  "bailey",
+  "matthew",
+  "anthony"
+];
+
+// src/pwned.ts
+var HIBP_RANGE = "https://api.pwnedpasswords.com/range/";
+var CACHE_LIMIT = 100;
+var responseCache = /* @__PURE__ */ new WeakMap();
+var inflight = /* @__PURE__ */ new WeakMap();
+function inflightFor(fetchFn) {
+  let map = inflight.get(fetchFn);
+  if (!map) {
+    map = /* @__PURE__ */ new Map();
+    inflight.set(fetchFn, map);
+  }
+  return map;
+}
+function cacheFor(fetchFn) {
+  let cache = responseCache.get(fetchFn);
+  if (!cache) {
+    cache = /* @__PURE__ */ new Map();
+    responseCache.set(fetchFn, cache);
+  }
+  return cache;
+}
+async function sha1Hex(input) {
+  var _a;
+  const subtle = (_a = globalThis.crypto) == null ? void 0 : _a.subtle;
+  if (!subtle) {
+    throw new Error(
+      "use-password-policy: crypto.subtle is not available. It needs a secure context (https or localhost) in browsers, or Node 20+."
+    );
+  }
+  const digest = await subtle.digest("SHA-1", new TextEncoder().encode(input));
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
+}
+async function checkPwnedPassword(password, options = {}) {
+  var _a, _b, _c;
+  if (!password) return 0;
+  const doFetch = (_a = options.fetch) != null ? _a : globalThis.fetch;
+  if (!doFetch) throw new Error("use-password-policy: no fetch implementation available.");
+  const hash = await sha1Hex(password);
+  const prefix = hash.slice(0, 5);
+  const suffix = hash.slice(5);
+  const url = `${(_b = options.endpoint) != null ? _b : HIBP_RANGE}${prefix}`;
+  const cache = cacheFor(doFetch);
+  let body = cache.get(url);
+  if (body === void 0) {
+    const pending = inflightFor(doFetch);
+    let request = pending.get(url);
+    if (!request) {
+      request = (async () => {
+        const res = await doFetch(url, { headers: options.padding ? { "Add-Padding": "true" } : void 0 });
+        if (!res.ok) throw new Error(`use-password-policy: breach check failed (HTTP ${res.status}).`);
+        const text = await res.text();
+        cache.set(url, text);
+        if (cache.size > CACHE_LIMIT) cache.delete(cache.keys().next().value);
+        return text;
+      })().finally(() => pending.delete(url));
+      pending.set(url, request);
+    }
+    body = await request;
+    if ((_c = options.signal) == null ? void 0 : _c.aborted) throw new DOMException("The check was cancelled.", "AbortError");
+  }
+  for (const line of body.split("\n")) {
+    const [lineSuffix, count] = line.trim().split(":");
+    if (lineSuffix === suffix) return parseInt(count, 10) || 0;
+  }
+  return 0;
+}
+
+// src/core.ts
+var DEFAULT_OPTIONS = {
+  minLength: 8,
+  maxLength: 0,
+  lowercaseCheck: true,
+  uppercaseCheck: true,
+  numberCheck: true,
+  specialCharCheck: true,
+  commonPasswordCheck: false,
+  commonPasswords: COMMON_PASSWORDS,
+  patternCheck: false,
+  customRules: [],
+  messages: {},
+  lowercaseRegex: /[a-z]/,
+  uppercaseRegex: /[A-Z]/,
+  numberRegex: /\d/,
+  specialCharRegex: /[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?`~]/
+};
+var presets = {
+  /** The classic checklist (these are also the defaults): 8+ chars, upper, lower, number, symbol. */
+  classic: {
+    minLength: 8,
+    lowercaseCheck: true,
+    uppercaseCheck: true,
+    numberCheck: true,
+    specialCharCheck: true
+  },
+  /**
+   * NIST SP 800-63B-4 (Aug 2025) for passwords used on their own:
+   * at least 15 characters, allow up to 64, no composition rules, block common passwords
+   * and predictable patterns. Add `breachCheck: true` to also check known breaches.
+   */
+  nist: {
+    minLength: 15,
+    maxLength: 64,
+    lowercaseCheck: false,
+    uppercaseCheck: false,
+    numberCheck: false,
+    specialCharCheck: false,
+    commonPasswordCheck: true,
+    patternCheck: true
+  },
+  /** NIST SP 800-63B-4 when the password is one factor of MFA: at least 8 characters. */
+  nistMfa: {
+    minLength: 8,
+    maxLength: 64,
+    lowercaseCheck: false,
+    uppercaseCheck: false,
+    numberCheck: false,
+    specialCharCheck: false,
+    commonPasswordCheck: true,
+    patternCheck: true
+  }
+};
+var DEFAULT_MESSAGES = {
+  minLength: (o) => `At least ${o.minLength} characters`,
+  maxLength: (o) => `At most ${o.maxLength} characters`,
+  uppercase: "An uppercase letter",
+  lowercase: "A lowercase letter",
+  number: "A number",
+  specialChar: "A special character",
+  notCommon: "Not a commonly used password",
+  noPattern: "No repeats, sequences or keyboard patterns",
+  notBreached: "Not found in known data breaches",
+  breachUnavailable: "Couldn't check known data breaches. Try again",
+  match: "Passwords match",
+  strength: "Hard to guess"
+};
+var STRENGTH_LABELS = ["Very Weak", "Weak", "Medium", "Strong", "Very Strong"];
+function resolveOptions(options = {}) {
+  const merged = { ...DEFAULT_OPTIONS };
+  for (const [key, value] of Object.entries(options)) {
+    if (key !== "password" && value !== void 0) merged[key] = value;
+  }
+  return merged;
+}
+var LEET = { "@": "a", "4": "a", "8": "b", "3": "e", "1": "i", "!": "i", "0": "o", "$": "s", "5": "s", "7": "t" };
+var unleet = (s) => s.replace(/[@483!1$057]/g, (c) => {
+  var _a;
+  return (_a = LEET[c]) != null ? _a : c;
+});
+var commonSetCache = /* @__PURE__ */ new WeakMap();
+function getCommonSet(list) {
+  let set = commonSetCache.get(list);
+  if (!set) {
+    set = new Set(list.map((p) => p.toLowerCase()));
+    commonSetCache.set(list, set);
+  }
+  return set;
+}
+var passwordLength = (password) => Array.from(password).length;
+function isCommonCombo(word, set) {
+  const n = word.length;
+  if (n < 6) return false;
+  const reachable = new Array(n + 1).fill(false);
+  reachable[0] = true;
+  for (let end = 3; end <= n; end++) {
+    for (let start = Math.max(0, end - 20); start <= end - 3; start++) {
+      if (reachable[start] && set.has(word.slice(start, end))) {
+        reachable[end] = true;
+        break;
+      }
+    }
+  }
+  return reachable[n];
+}
+function isCommonPassword(password, list = COMMON_PASSWORDS) {
+  if (!password) return false;
+  const set = getCommonSet(list);
+  const lower = password.toLowerCase();
+  const noTrailingSymbols = lower.replace(/[^a-z0-9]+$/, "");
+  const trimmed = lower.replace(/[^a-z]+$/, "");
+  const base = unleet(trimmed);
+  const baseNoLeading = unleet(trimmed.replace(/^[^a-z]+/, ""));
+  if ([lower, noTrailingSymbols, base, baseNoLeading].some((c) => c.length > 0 && set.has(c))) return true;
+  const lettersOnly = lower.replace(/[^a-z]/g, "");
+  const unleetedLetters = unleet(baseNoLeading).replace(/[^a-z]/g, "");
+  return isCommonCombo(lettersOnly, set) || isCommonCombo(unleetedLetters, set);
+}
+var KEYBOARD_ROWS = ["1234567890", "qwertyuiop", "asdfghjkl", "zxcvbnm", "abcdefghijklmnopqrstuvwxyz"];
+function isStep(a, b) {
+  if (a === b) return false;
+  for (const row of KEYBOARD_ROWS) {
+    const i = row.indexOf(a);
+    const j = row.indexOf(b);
+    if (i >= 0 && j >= 0 && (Math.abs(i - j) === 1 || Math.abs(i - j) === row.length - 1)) return true;
+  }
+  return false;
+}
+function isPredictablePattern(password) {
+  if (!password) return false;
+  if (password.trim() === "") return true;
+  const chars = Array.from(password.toLowerCase());
+  if (new Set(chars).size <= 3) return true;
+  const compact = chars.filter((c) => /[a-z0-9]/.test(c) || c.toUpperCase() !== c).join("");
+  for (const s of [compact, compact.replace(/\d+$/, "")]) {
+    if (s.length >= 6 && /^(.+?)\1+$/.test(s)) return true;
+  }
+  if (chars.length >= 4) {
+    let steps = 0;
+    for (let i = 1; i < chars.length; i++) if (isStep(chars[i - 1], chars[i])) steps++;
+    if (steps / (chars.length - 1) >= 0.75) return true;
+  }
+  return false;
+}
+var prettify = (name) => name.replace(/([A-Z])/g, " $1").replace(/^./, (s) => s.toUpperCase()).trim();
+function resolveMessage(rule, options) {
+  var _a, _b;
+  const msg = (_b = (_a = options.messages[rule.name]) != null ? _a : rule.message) != null ? _b : DEFAULT_MESSAGES[rule.name];
+  if (typeof msg === "function") return msg(options);
+  return msg != null ? msg : prettify(rule.name);
+}
+function builtInRules(options, estimate) {
+  const rules = [];
+  if (options.minLength > 0) {
+    rules.push({ name: "minLength", optionsKey: "minLength", test: (p, o) => passwordLength(p) >= o.minLength });
+  }
+  if (options.maxLength > 0) {
+    rules.push({ name: "maxLength", optionsKey: "maxLength", test: (p, o) => passwordLength(p) <= o.maxLength });
+  }
+  if (options.uppercaseCheck) {
+    rules.push({ name: "uppercase", optionsKey: "uppercaseCheck", test: (p, o) => o.uppercaseRegex.test(p) });
+  }
+  if (options.lowercaseCheck) {
+    rules.push({ name: "lowercase", optionsKey: "lowercaseCheck", test: (p, o) => o.lowercaseRegex.test(p) });
+  }
+  if (options.numberCheck) {
+    rules.push({ name: "number", optionsKey: "numberCheck", test: (p, o) => o.numberRegex.test(p) });
+  }
+  if (options.specialCharCheck) {
+    rules.push({ name: "specialChar", optionsKey: "specialCharCheck", test: (p, o) => o.specialCharRegex.test(p) });
+  }
+  if (options.commonPasswordCheck) {
+    rules.push({
+      name: "notCommon",
+      optionsKey: "commonPasswordCheck",
+      test: (p, o) => p.length > 0 && !isCommonPassword(p, o.commonPasswords)
+    });
+  }
+  if (options.patternCheck) {
+    rules.push({
+      name: "noPattern",
+      optionsKey: "patternCheck",
+      test: (p) => p.length > 0 && !isPredictablePattern(p)
+    });
+  }
+  if (options.confirmPassword !== void 0) {
+    rules.push({
+      name: "match",
+      optionsKey: "confirmPassword",
+      test: (p, o) => p.length > 0 && p === o.confirmPassword
+    });
+  }
+  if (estimate && options.minStrength !== void 0) {
+    const min = options.minStrength;
+    rules.push({ name: "strength", optionsKey: "minStrength", test: () => estimate.score >= min });
+  }
+  return rules;
+}
+function validatePassword(password, options = {}) {
+  const pw = password != null ? password : "";
+  const resolved = resolveOptions(options);
+  const estimate = resolved.strengthEstimator ? resolved.strengthEstimator(pw) : void 0;
+  const rules = [...builtInRules(resolved, estimate), ...resolved.customRules];
+  const policyState = {};
+  const requirements = [];
+  const errors = [];
+  let passedCount = 0;
+  for (const rule of rules) {
+    const passed = Boolean(rule.test(pw, resolved));
+    const message = resolveMessage(rule, resolved);
+    policyState[rule.name] = passed;
+    requirements.push({ name: rule.name, passed, message });
+    if (passed) passedCount++;
+    else errors.push(message);
+  }
+  const total = rules.length;
+  let strengthPercent;
+  let strengthLabel;
+  if (estimate) {
+    const score = Math.max(0, Math.min(4, Math.round(estimate.score)));
+    strengthPercent = pw.length === 0 ? 0 : score / 4;
+    strengthLabel = STRENGTH_LABELS[score];
+  } else {
+    strengthPercent = total > 0 ? passedCount / total : 0;
+    if (strengthPercent >= 1) strengthLabel = "Very Strong";
+    else if (strengthPercent >= 0.75) strengthLabel = "Strong";
+    else if (strengthPercent >= 0.5) strengthLabel = "Medium";
+    else if (strengthPercent > 0) strengthLabel = "Weak";
+    else strengthLabel = "Very Weak";
+  }
+  return {
+    isValid: total > 0 && passedCount === total,
+    policyState,
+    requirements,
+    errors,
+    strengthScore: passedCount,
+    strengthPercent,
+    strengthLabel,
+    ...estimate ? { estimate } : {}
+  };
+}
+function breachOptions(option) {
+  if (!option) return null;
+  return option === true ? {} : option;
+}
+function applyBreachResult(result, breach, options = {}) {
+  var _a;
+  const failOpen = ((_a = breachOptions(options.breachCheck)) != null ? _a : {}).failOpen !== false;
+  const resolved = resolveOptions(options);
+  const message = resolveMessage({ name: "notBreached", test: () => true }, resolved);
+  const pending = breach.status === "idle" || breach.status === "checking";
+  const passed = breach.status === "safe" || breach.status === "error" && failOpen;
+  const requirement = pending ? { name: "notBreached", passed: false, message, pending: true } : { name: "notBreached", passed, message };
+  const errors = [...result.errors];
+  if (!pending && !passed) {
+    errors.push(
+      breach.status === "error" ? resolveMessage({ name: "breachUnavailable", test: () => true }, resolved) : message
+    );
+  }
+  const pwned = breach.status === "pwned";
+  return {
+    ...result,
+    isValid: result.isValid && passed,
+    policyState: { ...result.policyState, notBreached: passed },
+    requirements: [...result.requirements.filter((r) => r.name !== "notBreached"), requirement],
+    errors,
+    strengthScore: result.strengthScore + (passed ? 1 : 0),
+    strengthPercent: pwned ? 0 : result.strengthPercent,
+    strengthLabel: pwned ? "Very Weak" : result.strengthLabel,
+    breach
+  };
+}
+async function validatePasswordAsync(password, options = {}) {
+  const result = validatePassword(password, options);
+  const b = breachOptions(options.breachCheck);
+  if (!b) return result;
+  if (!result.isValid) return applyBreachResult(result, { status: "idle", count: 0 }, options);
+  try {
+    const count = await checkPwnedPassword(password != null ? password : "", { fetch: b.fetch, endpoint: b.endpoint, padding: b.padding });
+    return applyBreachResult(result, { status: count > 0 ? "pwned" : "safe", count }, options);
+  } catch {
+    return applyBreachResult(result, { status: "error", count: 0 }, options);
+  }
+}
+function fromZxcvbn(zxcvbn, userInputs) {
+  const run = typeof zxcvbn === "function" ? zxcvbn : (pw, inputs) => zxcvbn.check(pw, inputs);
+  return (password) => {
+    var _a, _b, _c;
+    const result = run(password, userInputs);
+    const score = Math.max(0, Math.min(4, Math.round(result.score)));
+    const feedback = ((_a = result.feedback) == null ? void 0 : _a.warning) || ((_c = (_b = result.feedback) == null ? void 0 : _b.suggestions) == null ? void 0 : _c[0]) || void 0;
+    return feedback ? { score, feedback } : { score };
+  };
+}
+function zodPasswordRule(options = {}, { allErrors = true } = {}) {
+  return (value, ctx) => {
+    const { errors } = validatePassword(value, options);
+    for (const message of allErrors ? errors : errors.slice(0, 1)) {
+      ctx.addIssue({ code: "custom", message });
+    }
+  };
+}
+function zodPasswordRuleAsync(options = {}, { allErrors = true } = {}) {
+  return async (value, ctx) => {
+    const { errors } = await validatePasswordAsync(value, options);
+    for (const message of allErrors ? errors : errors.slice(0, 1)) {
+      ctx.addIssue({ code: "custom", message });
+    }
+  };
+}
+function passwordValidatorAsync(options = {}) {
+  return async (value) => {
+    const { errors } = await validatePasswordAsync(value != null ? value : "", options);
+    return errors.length === 0 ? true : errors[0];
+  };
+}
+function passwordValidator(options = {}) {
+  return (value) => {
+    const { errors } = validatePassword(value != null ? value : "", options);
+    return errors.length === 0 ? true : errors[0];
+  };
+}
+export {
+  COMMON_PASSWORDS,
+  DEFAULT_MESSAGES,
+  DEFAULT_OPTIONS,
+  applyBreachResult,
+  checkPwnedPassword,
+  fromZxcvbn,
+  isCommonPassword,
+  isPredictablePattern,
+  passwordLength,
+  passwordValidator,
+  passwordValidatorAsync,
+  presets,
+  resolveOptions,
+  validatePassword,
+  validatePasswordAsync,
+  zodPasswordRule,
+  zodPasswordRuleAsync
+};