Trait PasswordPolicy

Source

pub trait PasswordPolicy: Send + Sync {
    // Required methods
    fn validate(&self, candidate: &str) -> Result<(), PasswordPolicyError>;
    fn min_length(&self) -> usize;
}

Expand description

Validates a candidate password against project-defined rules.

The framework ships DefaultPasswordPolicy (length-only floor) as the secure-by-default baseline. Projects layer a stronger policy via crate::admin::Admin::password_policy when regulation or risk requires it. The trait is Send + Sync so the Arc<dyn PasswordPolicy> lives on Admin and is cheap to clone into async futures.

§Implementing a custom policy

use rustio_admin::auth::{PasswordPolicy, PasswordPolicyError};

struct OrgPolicy;
impl PasswordPolicy for OrgPolicy {
    fn validate(&self, candidate: &str) -> Result<(), PasswordPolicyError> {
        let len = candidate.chars().count();
        if len < 16 {
            return Err(PasswordPolicyError::TooShort { min: 16, actual: len });
        }
        if !candidate.chars().any(|c| c.is_ascii_digit()) {
            return Err(PasswordPolicyError::Custom(
                "Password must contain at least one digit.".into(),
            ));
        }
        Ok(())
    }
    fn min_length(&self) -> usize { 16 }
}

Implementations MUST treat the borrowed candidate as a secret: no logging, no panic-with-the-plaintext, no inclusion in the returned error. The framework’s audit + log helpers redact passwords (audit::redact_password()); custom policies that want to surface a project-specific message use PasswordPolicyError::Custom with a user-safe string.