feat: add --pad/-p option to the pw command (#247)

.changeset/large-kangaroos-call.md

@@ -0,0 +1,5 @@
+---
+'pwned': minor
+---
+
+Add the `--pad` (`-p`) option to the `pw` command, allowing you to ask the remote API to add padding to the response to obscure the password prefix. See https://www.troyhunt.com/enhancing-pwned-passwords-privacy-with-padding/ for more information.

src/commands/pw.ts

@@ -9,11 +9,13 @@ export const describe = 'securely check a password for public exposure';
 
 interface PwArgvOptions {
   password: string;
+  p?: boolean;
   r?: boolean;
 }
 
 interface PwHandlerOptions {
   password: string;
+  pad?: boolean;
   raw?: boolean;
 }
 
@@ -30,13 +32,19 @@ export function builder(yargs: Argv<PwArgvOptions>): Argv<PwHandlerOptions> {
       }
       return true;
     })
+    .option('p', {
+      alias: 'pad',
+      describe: 'add padding to the API response to obscure the contents',
+      type: 'boolean',
+      default: false,
+    })
     .option('r', {
       alias: 'raw',
       describe: 'disable the console spinner',
       type: 'boolean',
       default: false,
     })
-    .group(['r'], 'Command Options:')
+    .group(['r', 'p'], 'Command Options:')
     .group(['h', 'v'], 'Global Options:');
 }
 /* c8 ignore stop */
@@ -52,14 +60,18 @@ export function builder(yargs: Argv<PwArgvOptions>): Argv<PwHandlerOptions> {
  */
 export async function handler({
   password,
+  pad,
   raw,
 }: PwHandlerOptions): Promise<void> {
   if (!raw) {
     spinner.start();
   }
 
   try {
-    const pwnCount = await pwnedPassword(password, { userAgent });
+    const pwnCount = await pwnedPassword(password, {
+      userAgent,
+      addPadding: pad,
+    });
     if (pwnCount) {
       const pwnedMessage = `Oh no — pwned ${pwnCount} times!`;
       if (!raw) {