Allow configuration of additional password validations

[rrelmy]

This is a basic implementation of custom validation rules for user passwords discussed in statamic/ideas#422
We need this to satisfy a government customer requiring more strict password rules

I replaced all occurrences of required|confirmed on password validations, please check if all three are ok.

It allows to add any validation to the optional config parameter

'password_validation' => ['min:8'],

I did my best writing a description matching the pattern, feel free to give feedback on naming.

---

Edit: I additionally added the password validation to the MakeUser command, before the password was not validated at all. An empty password could be entered (did not work to login!)

[duncanmcclean]

Hope you don't mind @rrelmy but I noticed a couple of little things...

But it's a really nice implementation though! Can definitely see it coming in useful 😄

[duncanmcclean]

I wonder if it might be worth adding in the default password validation rules here so the user knows what they are extending upon?

[rrelmy]

I didn't want to do that because removing them could be catastrophically.
But I am open to suggestions :-)

Also the confirmed is not always needed

---

And adding something like min:6 what would make sense IMHO but could be a breaking change

[duncanmcclean]

I didn't want to do that because removing them could be catastrophically.

What do you mean, as in, stuff would fail?

[rrelmy]

I did not test if but removing confirmed could lead to user input errors and unknown passwords.
Removing required could lead to empty password being accepted I suppose

[duncanmcclean]

Hmm, that's a good shout. I guess that's probably something for the Core Team to decide on...

[duncanmcclean]

If you go down the route of adding the default password rules in the config, it means you'll no longer need the array_merge here anymore (or in the other places you're doing it).

You'll probably also want to fallback to the default rules, in case the user doesn't add the option to their config file.

'password' => config('statamic.users.password_validation', ['required', 'confirmed']),

[rrelmy]

Same as in the first comment, as confirmed is not be needed everywhere (see MakeUser command) I see little benefit in it.

IMHO it is safer and cleaner to have the hardcoded rules and adding additional rules.

I would rather drop support for PHP < 7.4 and be able to use 😂

['required', 'confirmed', ...config('statamic.users.password_validation')]

[duncanmcclean]

Yeah, I see where you're coming from... maybe it can just stay how it is 😎

[jasonvarga]

Laravel recently introduced default password rules.

https://laravel.com/docs/8.x/validation#defining-default-password-rules

I think it might be a good idea to leverage that.

Since it's only on Laravel 8, I think that's fine, and we can just fall back to the existing required|confirmed|min:8 if using <8.

[rrelmy]

I have to look into how such an implementation would look like.
@jasonvarga Do you have an example how you already leverage a feature depending on the laravel version?

[jasonvarga]

Here's an example where we check if Laravel is 7+.

cms/src/Http/Middleware/CP/SwapExceptionHandler.php

Line 13 in e8d977a

return version_compare(app()->version(), 7, '>=')

[rrelmy]

@jasonvarga With a fallback you mean something like:

public static function getPasswordRules() {
  if (version_compare(app()->version(), 8, '<') ) {
    // fallback to the minimum on laravel < 8
    return 'min:8';
  }

  return Password::defaults();
}

// ...

'password' => ['required', Something::getPasswordRules()],

pseudocode, not test

And on Laravel 8+ one can use the existing rules
https://laravel.com/docs/8.x/validation#defining-default-password-rules

[jasonvarga]

That's right. If you are using an older Laravel version, you are stuck with whatever password rules we have been using up until now.

[rrelmy]

Closing because of #3823