Module password_validators 

Pluggable AUTH_PASSWORD_VALIDATORS chain — run an ordered list of password_validators::PasswordValidators at signup / password-change. Built-ins: MinimumLengthValidator, MaximumLengthValidator, NumericPasswordValidator, UserAttributeSimilarityValidator, CommonPasswordValidator. Issue #54 (partial). Pluggable password validator chain — Django’s AUTH_PASSWORD_VALIDATORS = [...] setting.

Plug an ordered list of [PasswordValidator]s into a [PasswordValidatorChain]; call [PasswordValidatorChain::validate] at signup / password-change time. The chain runs every validator and accumulates errors so the user sees the full problem list in one round-trip, not one failure at a time.

use rustango::password_validators::{
    PasswordValidatorChain, MinimumLengthValidator,
    NumericPasswordValidator, UserAttributes,
};

let chain = PasswordValidatorChain::new()
    .with(Box::new(MinimumLengthValidator::new(8)))
    .with(Box::new(NumericPasswordValidator));

let attrs = UserAttributes::new().with("username", "alice");
chain.validate("hunter2", &attrs)?;

Built-in validators

• [MinimumLengthValidator] — Django’s MinimumLengthValidator.
• [MaximumLengthValidator] — extra rustango safeguard; some password hashers cap input length, so the validator surfaces “too long” before the hasher does.
• [NumericPasswordValidator] — Django’s same-named validator.
• [UserAttributeSimilarityValidator] — Django’s same. Rejects passwords that contain (or are too similar to) a value from the user attributes bag.
• [CommonPasswordValidator] — small built-in top-N list. The real Django uses ~20k entries; this ship the top-100 to keep the binary lean. Pass with_list(...) for a longer list.

Custom validators implement [PasswordValidator] (one method).

Issue #54 — second piece of crate::auth_backends.

Structs

CommonPasswordValidator

Reject passwords from a stash list. Ships with the top 100 most-common passwords; real deployments pass a longer list via Self::with_list.

MaximumLengthValidator

Reject passwords longer than max_length characters. Pairs with hasher input limits (Argon2 has no hard cap but stash-anywhere patterns benefit from one).

MinimumLengthValidator

Reject passwords shorter than min_length characters (Unicode scalar values, not bytes).

NumericPasswordValidator

Reject passwords made entirely of digits ("12345678"). Django rationale: pure-digit passwords are trivially brute-forceable even at long lengths, and users default to them when forced into “must be 8 chars” without a complexity rule.

PasswordValidatorChain

Ordered list of validators run together.

UserAttributeSimilarityValidator

Reject passwords that contain (case-insensitive) one of the user’s attributes — username, email local-part, display name — as a substring of length ≥ threshold chars. Defaults: threshold=4, checks every attribute.

UserAttributes

Per-user bag of attribute values that UserAttributeSimilarityValidator checks the password against. Typically username + email + display name — anything an attacker is likely to guess from the user’s public profile.

ValidationError

One validator’s complaint. Each entry has a stable code (for programmatic checks / template branches) and a human message.

ValidationErrors

Accumulated errors from the chain. Use Self::is_empty to gate the success path; iterate errors to render every complaint.

Traits

PasswordValidator

One link in the chain. validate returns Ok(()) on pass; one ValidationError on failure. The chain runs every validator and collects errors (not short-circuit) so users see the full problem set per round-trip.