Adds password validation function to dbAuth

[cannikin]

Closes #6237

Release Notes

If you're using dbAuth you can now validate a user's password on the server at signup, checking for length, randomness, etc. Along with signup.handler() you can now define signup.passwordValidation() in api/src/functions/auth.js:

import { DbAuthHandler, PasswordValidationError } from '@redwoodjs/api'

const signupOptions = {
  handler: ({ username, hashedPassword, salt }) => {
    return db.user.create({
      data: {
        email: username,
        hashedPassword: hashedPassword,
        salt: salt,
      },
    })
  },

  passwordValidation: (password) => {
    if (password.length < 8) {
      throw new PasswordValidationError('Password must be at least 8 characters')
    }
    if (!password.match(/[A-Z]/) {
      throw new PasswordValidationError('Password must contain at least one capital letter')
    }

    return true
  },
}

In a newly setup instance of dbAuth, this function will simply return true meaning that any password would be considered valid (the same as the previous behavior).

For the best user experience you want to check for these same things on the web-side, to avoid a round trip to the server just to see an error message, but having the check on the server is essential for security.

[replay-io]

14 replays were recorded for 1fdde3d.

0 Failed

14 Passed

• Smoke test with dev server
• useAuth hook, auth redirects checks
• useAuth hook, auth redirects checks
• requireAuth graphql checks
• RBAC: Should not be able to delete contact as non-admin user
• RBAC: Should not be able to delete contact as non-admin user
• RBAC: Should not be able to delete contact as non-admin user
• RBAC: Should not be able to delete contact as non-admin user
• RBAC: Admin user should be able to delete contacts
• Smoke test with rw serve
• Loads Cell Stories
• Loads MDX Stories
• Loads Cell mocks when Cell is nested in another story
• Mocks current user, and updates UI while dev server is running

View test run on Replay ↗︎