fix(auth): lower new-password minimum to 8 chars and cap length at 128 - #4
Merged
Conversation
The 16-char minimum for new passwords was stricter than intended and inconsistent with the TUI form and OpenRPC schema, which already said 8. Also adds a 128-char maximum: the password feeds the Argon2id derivation (256 MB memory cost) on the unauthenticated authenticate path, so input must be bounded. Argon2 itself has no truncation limit, so 128 is purely input hygiene (NIST 800-63B asks for at least 64 to be accepted).
andrespineli
force-pushed
the
fix/password-policy-8-128
branch
from
August 7, 2026 11:36
ea1be12 to
4a0d73a
Compare
deno audit was failing the Quality gate on three high advisories in transitive deps: fast-uri <3.1.5 (host confusion, via ajv) and ip-address <=10.3.0 (SSRF octal-octet bypass, via ssh2/socks). Regenerating the lockfile resolves fast-uri 3.1.5, ip-address 10.4.0, hono 4.13.0 and @hono/node-server 2.1.0, which also clears the four moderate advisories. Full suite stays green.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Password.strong()), fixing the inconsistency where the TUI form and OpenRPC schema already advertised a minimum of 8 but the server rejected anything under 16.Passwordconstructor so it also bounds the unauthenticatedauth.authenticatepath.Why 128 as the maximum?
The password feeds the Argon2id key derivation (
hash-wasm, 256 MB / 3 iterations) that unlocks the AES-256-GCM key. Unlike bcrypt, Argon2 has no truncation limit, so there is no crypto-correctness constraint — the cap is input hygiene: without it, an arbitrarily long string flows into a 256 MB KDF on an unauthenticated endpoint. NIST SP 800-63B requires accepting at least 64 characters; 128 leaves ample room for passphrases.Changes
server/src/auth/domain/models/password.ts—STRONG_MINIMUM16 → 8, newMAXIMUM = 128enforced in the constructorserver/src/auth/domain/exceptions/password-too-long.ts— new parameterized exception, mirroringWeakPasswordlibs/jsonrpc-schemas/auth.openrpc.json—maxLength: 128onMasterPasswordandMasterPasswordVerify, description updated;auth.gen.tsregenerated viadeno task contracts:codegentui/ink/src/auth/configure-password-form.tsx— client-side max gate + hint text "8-128 characters"Testing
deno task check— cleandeno task test— 622 passed, 0 failed (an unrelatedStationDetailScreenTUI render test flaked once under full-suite load; it passes in isolation and on re-run, onmainand on this branch alike)