Skip to content

feat: password strength checks#429

Merged
AVVS merged 7 commits intomasterfrom
pajgo-feat/passwordLimits
Oct 2, 2019
Merged

feat: password strength checks#429
AVVS merged 7 commits intomasterfrom
pajgo-feat/passwordLimits

Conversation

@AVVS
Copy link
Copy Markdown
Member

@AVVS AVVS commented Sep 27, 2019

No description provided.

@AVVS
Copy link
Copy Markdown
Member Author

AVVS commented Sep 27, 2019

@pajgo & @belkinadasha - please take a look, as for me - LGTM

@pajgo
Copy link
Copy Markdown
Collaborator

pajgo commented Sep 27, 2019

@AVVS Restored plugin behavior and added additional checks.

@pajgo pajgo mentioned this pull request Sep 27, 2019
* skipFieldNames parameter
* additional tests
@pajgo pajgo force-pushed the pajgo-feat/passwordLimits branch from 25186e7 to c5147e3 Compare September 28, 2019 11:35
Comment thread doc/password_validator.md Outdated
```

### forceCheckFieldNames __string[]__
Allows to force Validation event if the Validator disabled:
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if the Validator is disabled

Comment thread doc/password_validator.md Outdated
const validatorConfig = {
minStrength: 4,
skipFieldName: 'validate', // if `data.validate` eq true 'data.myfield' is skipped during validation
enabled:false, // Will validate the `data` object anyway
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing space after the semicolon

Comment thread doc/password_validator.md Outdated
minStrength: 4,
skipFieldName: 'validate', // if `data.validate` eq true 'data.myfield' is skipped during validation
enabled:false, // Will validate the `data` object anyway
forceCheckFieldNames: ['forceValidate'], // if `data.validate` not exists 'data.myfield' is skipped during validation
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does the comment mean?

Comment thread doc/password_validator.md Outdated

// Force validation
const data = {
myfield: 'fooBar', // in schema "myfield":{"password": true} keyword.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest to rename myfield to camelCase everywhere for a neat look

Comment thread doc/password_validator.md Outdated
* Validation skipped if `Object[field]` set.
* Validation performed if `Object[field]` not exists.

Eg:
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

E.g.

Comment thread rfcs/password_validation_limits.md Outdated
forceCheckFieldName: ['checkPassword'], // force enable password to check if the object field value set..
inputFieldNames: [ // Linked fields list, allow filter case sensitive data in the password from the parent object.
skipCheckFieldNames: ['skipPassword'], // Force disable password to check if the object field value exists.
forceCheckFieldNames: ['checkPassword'], // Force enable password check if the object field value exists.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about "forces password check <...>" and "disables password check <...>" (one line above)?

Comment thread rfcs/password_validation_limits.md Outdated
inputFieldNames: [ // Linked fields list, allow filter case sensitive data in the password from the parent object.
skipCheckFieldNames: ['skipPassword'], // Force disable password to check if the object field value exists.
forceCheckFieldNames: ['checkPassword'], // Force enable password check if the object field value exists.
inputFieldNames: [ // Linked fields list, allow filter the sensitive data in the password from the parent object.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"allows to filter sensitive data <...>" or "allows sensitive data filtering <...>"

Comment thread rfcs/password_validation_limits.md Outdated

## OTP and Empty Password
The `password` field is not defined as `required` in current `schemas`.
Validation does not happen because This field does not exist in the OTP registration request.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Validation is not performed because this field <...>

Comment thread rfcs/password_validation_limits.md Outdated
## OTP and Empty Password
The `password` field is not defined as `required` in current `schemas`.
Validation does not happen because This field does not exist in the OTP registration request.
When the Service performs password generation, `skipPassword` property does not exist in the registration request, so validation not executing on generated passwords.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • double space before skipPassword
  • <...> so the validator does not check these generated passwords.

Comment thread test/suites/register.js
});
});


Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it could be nice to add a test that uses checkPassword field that forces validation so that forceCheckFieldNames feature could have its deserved test coverage :)

@pajgo
Copy link
Copy Markdown
Collaborator

pajgo commented Oct 1, 2019

@belkinadasha Fixed. Please re ^)

@AVVS AVVS merged commit 63d8ffb into master Oct 2, 2019
@AVVS AVVS deleted the pajgo-feat/passwordLimits branch October 2, 2019 17:26
AVVS pushed a commit that referenced this pull request Oct 3, 2019
# [11.4.0](v11.3.1...v11.4.0) (2019-10-03)

### Bug Fixes

* upgrade deps, ensure schemas are valid ([5b29710](5b29710))

### Features

* optional password strength checks ([#429](#429)) ([63d8ffb](63d8ffb))
@AVVS
Copy link
Copy Markdown
Member Author

AVVS commented Oct 3, 2019

🎉 This PR is included in version 11.4.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

@AVVS AVVS added the released label Oct 3, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants