pub fn validate_api_key_strength(api_key: &str) -> Result<(), WeakApiKey>Expand description
Reject API keys that are obviously too weak to be compared by digest.
Keys are looked up by SHA-256, which is a fast lookup hash and deliberately not a password hash. That is the right choice for a high-entropy secret and the wrong one for a guessable string: a low-entropy key is brute forceable online, and offline in moments if the digest table ever leaks.
This is a guardrail against obvious mistakes, not a certificate of strength. It measures length, alphabet size, and the Shannon entropy of the observed symbol distribution. It cannot see structure: a long repeating pattern drawn from a wide alphabet will pass. Generate keys from a CSPRNG rather than relying on this to grade a hand-written one.
ยงErrors
Returns the specific WeakApiKey reason the key was refused.