Implementing password strength check

assets/locales/ur/auth.json

@@ -10,7 +10,7 @@
 		"EMAIL_INVALID": "Invalid Email",
 		"EMAIL_ALREADY_REGISTERED": "Email is already registered",
 		"DATE_OF_BIRTH_UNDERAGE": "You need to be {{years}} years or older",
-                "PASSWORD_REQUIREMENTS_MIN_LENGTH": "Must be at least {{min}} characters long.",
+                "PASSWORD_BAD_PASSWORD": "Password is too weak or common to use.",
                 "CONSENT_REQUIRED": "You must agree to the Terms of Service and Privacy Policy.",
 		"USERNAME_TOO_MANY_USERS": "Too many users have this username, please try another"
 	}

src/api/routes/auth/register.ts

@@ -18,6 +18,7 @@
 
 import {
 	IPAnalysis,
+	checkPassword,
 	getIpAdress,
 	isProxy,
 	route,
@@ -159,7 +160,6 @@ router.post(
 		}
 
 		// TODO: gift_code_sku_id?
-		// TODO: check password strength
 
 		if (email) {
 			// replace all dots and chars after +, if its a gmail.com email
@@ -225,17 +225,11 @@ router.post(
 		}
 
 		if (body.password) {
-			const min = register.password.minLength
-				? register.password.minLength
-				: 8;
-			if (body.password.length < min) {
+			if (checkPassword(body.password) < register.password.strength) {
 				throw FieldErrors({
 					password: {
-						code: "PASSWORD_REQUIREMENTS_MIN_LENGTH",
-						message: req.t(
-							"auth:register.PASSWORD_REQUIREMENTS_MIN_LENGTH",
-							{ min: min },
-						),
+						code: "PASSWORD_BAD_PASSWORD",
+						message: req.t("auth:register.PASSWORD_BAD_PASSWORD"),
 					},
 				});
 			}

src/api/util/utility/passwordStrength.ts

@@ -20,8 +20,8 @@ import { Config } from "@spacebar/util";
 import "missing-native-js-functions";
 
 const reNUMBER = /[0-9]/g;
-const reUPPERCASELETTER = /[A-Z]/g;
-const reSYMBOLS = /[A-Z,a-z,0-9]/g;
+const reUPPER = /[A-Z]/g;
+const reSYMBOLS = /[^a-zA-Z0-9\s]/g;
 
 // const blocklist: string[] = []; // TODO: update ones passwordblocklist is stored in db
 /*
@@ -35,39 +35,43 @@ const reSYMBOLS = /[A-Z,a-z,0-9]/g;
  *
  * Returns: 0 > pw > 1
  */
+
+function calculateEntropy(str: string) {
+	// TODO: calculate the shannon entropy
+	return 0;
+}
+
 export function checkPassword(password: string): number {
-	const { minLength, minNumbers, minUpperCase, minSymbols } =
-		Config.get().register.password;
 	let strength = 0;
 
 	// checks for total password len
-	if (password.length >= minLength - 1) {
-		strength += 0.05;
-	}
+	if (password.length >= 7) strength += 0.2;
 
-	// checks for amount of Numbers
-	if (password.count(reNUMBER) >= minNumbers - 1) {
-		strength += 0.05;
-	}
+	// checks for numbers
+	const numbers = password.match(reNUMBER);
+	if (numbers) strength += 0.2;
 
-	// checks for amount of Uppercase Letters
-	if (password.count(reUPPERCASELETTER) >= minUpperCase - 1) {
-		strength += 0.05;
-	}
+	// checks for uppercase Letters
+	const uppercase = password.match(reUPPER);
+	if (uppercase) strength += 0.3;
 
-	// checks for amount of symbols
-	if (password.replace(reSYMBOLS, "").length >= minSymbols - 1) {
-		strength += 0.05;
-	}
+	// checks for symbols
+	const symbols = password.match(reSYMBOLS);
+	if (symbols) strength += 0.3;
 
 	// checks if password only consists of numbers or only consists of chars
-	if (
-		password.length == password.count(reNUMBER) ||
-		password.length === password.count(reUPPERCASELETTER)
-	) {
-		strength = 0;
+	if (numbers && uppercase) {
+		if (
+			password.length == numbers.length ||
+			password.length === uppercase.length
+		) {
+			strength = 0;
+		}
 	}
 
+	/*
+   * this seems to be broken
+   *
 	const entropyMap: { [key: string]: number } = {};
 	for (let i = 0; i < password.length; i++) {
 		if (entropyMap[password[i]]) entropyMap[password[i]]++;
@@ -80,5 +84,8 @@ export function checkPassword(password: string): number {
 	strength +=
 		entropies.reduceRight((a: number, x: number) => a - x * Math.log2(x)) /
 		Math.log2(password.length);
+  */
+
+	strength += calculateEntropy(password);
 	return strength;
 }

src/util/config/types/subconfigurations/register/Password.ts

@@ -18,8 +18,5 @@
 
 export class PasswordConfiguration {
 	required: boolean = false;
-	minLength: number = 8;
-	minNumbers: number = 2;
-	minUpperCase: number = 2;
-	minSymbols: number = 0;
+	strength: number = 0.5;
 }