npwg 0.5.1

Securely generate random passwords
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

// SPDX-License-Identifier: MIT
// Project: npwg
// File: src/policy.rs
// Author: Volker Schwaberow <volker@schwaberow.de>

use crate::config::{PasswordGeneratorConfig, Separator};
use crate::error::Result;
use crate::profile::apply_allowed_sets;
use clap::ValueEnum;

#[derive(Clone, Copy, Debug, ValueEnum)]
pub enum PolicyName {
    #[clap(alias = "windows", alias = "ad")]
    WindowsAd,
    #[clap(alias = "pci")]
    PciDss,
    #[clap(alias = "nist")]
    NistHigh,
}

pub struct PolicyDetails {
    pub label: &'static str,
    pub description: &'static str,
    pub minimum_length: usize,
    pub recommended_entropy_bits: f64,
}

pub fn apply_policy(
    policy: PolicyName,
    config: &mut PasswordGeneratorConfig,
) -> Result<PolicyDetails> {
    match policy {
        PolicyName::WindowsAd => apply_windows_ad(config),
        PolicyName::PciDss => apply_pci_dss(config),
        PolicyName::NistHigh => apply_nist_high(config),
    }
}

fn ensure_length(config: &mut PasswordGeneratorConfig, minimum: usize) {
    if config.length < minimum {
        config.length = minimum;
    }
}

fn ensure_separator(config: &mut PasswordGeneratorConfig) {
    if config.mode == crate::config::PasswordGeneratorMode::Diceware && config.separator.is_none() {
        config.separator = Some(Separator::Fixed(' '));
    }
}

fn apply_windows_ad(config: &mut PasswordGeneratorConfig) -> Result<PolicyDetails> {
    ensure_length(config, 14);
    apply_allowed_sets(config, "upperletter,lowerletter,digit,symbol2")?;
    config.set_avoid_repeating(false);
    config.pattern = None;
    config.pronounceable = false;
    config.mode = crate::config::PasswordGeneratorMode::Password;
    ensure_separator(config);
    Ok(PolicyDetails {
        label: "Windows Active Directory",
        description: "Requires 14+ characters including upper, lower, digits, and symbols.",
        minimum_length: 14,
        recommended_entropy_bits: 84.0,
    })
}

fn apply_pci_dss(config: &mut PasswordGeneratorConfig) -> Result<PolicyDetails> {
    ensure_length(config, 12);
    apply_allowed_sets(config, "upperletter,lowerletter,digit,symbol2")?;
    config.set_avoid_repeating(false);
    config.mode = crate::config::PasswordGeneratorMode::Password;
    ensure_separator(config);
    Ok(PolicyDetails {
        label: "PCI DSS",
        description: "Minimum 12 characters with mixed character classes per PCI DSS 4.0.",
        minimum_length: 12,
        recommended_entropy_bits: 72.0,
    })
}

fn apply_nist_high(config: &mut PasswordGeneratorConfig) -> Result<PolicyDetails> {
    ensure_length(config, 16);
    apply_allowed_sets(config, "upperletter,lowerletter,digit,symbol2")?;
    config.set_avoid_repeating(true);
    config.mode = crate::config::PasswordGeneratorMode::Password;
    ensure_separator(config);
    Ok(PolicyDetails {
        label: "NIST SP 800-63B High",
        description: "High assurance memorized secret guidance (16+ characters)",
        minimum_length: 16,
        recommended_entropy_bits: 96.0,
    })
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::config::PasswordGeneratorConfig;

    #[test]
    fn windows_policy_enforces_length_and_sets() {
        let mut config = PasswordGeneratorConfig::new();
        config.length = 8;
        let details = apply_policy(PolicyName::WindowsAd, &mut config).unwrap();
        assert_eq!(details.minimum_length, 14);
        assert!(config.length >= 14);
        assert!(config.allowed_chars.iter().any(|c| c.is_ascii_uppercase()));
        assert!(config
            .allowed_chars
            .iter()
            .any(|c| !c.is_ascii_alphanumeric()));
    }

    #[test]
    fn policy_can_raise_entropy_expectations() {
        let mut config = PasswordGeneratorConfig::new();
        let details = apply_policy(PolicyName::NistHigh, &mut config).unwrap();
        assert_eq!(details.recommended_entropy_bits as u32, 96);
        assert!(config.length >= 16);
    }
}