EDIT

    </dependency>

    <dependency>

      <groupId>org.passay</groupId>

      <artifactId>passay</artifactId>

    </dependency>

/**

* Copyright (C) 2021 EDIT

* European Distributed Institute of Taxonomy

* http://www.e-taxonomy.eu

*

* The contents of this file are subject to the Mozilla Public License Version 1.1

* See LICENSE.TXT at the top of this package for the full license terms.

*/

package eu.etaxonomy.cdm.validation.annotation;

import java.lang.annotation.Documented;

import java.lang.annotation.Retention;

import java.lang.annotation.Target;

import javax.validation.Constraint;

import javax.validation.Payload;

import eu.etaxonomy.cdm.validation.constraint.PasswordConstraintValidator;

/**

 * @author a.kohlbecker

 * @since Nov 12, 2021

 */

@Documented

@Constraint(validatedBy = PasswordConstraintValidator.class)

@Target({ TYPE, FIELD, ANNOTATION_TYPE })

@Retention(RUNTIME)

public  @interface ValidPassword {

    String message() default "Invalid Password";

    Class<?>[] groups() default {};

    Class<? extends Payload>[] payload() default {};

}

/**

* Copyright (C) 2021 EDIT

* European Distributed Institute of Taxonomy

* http://www.e-taxonomy.eu

*

* The contents of this file are subject to the Mozilla Public License Version 1.1

* See LICENSE.TXT at the top of this package for the full license terms.

*/

package eu.etaxonomy.cdm.validation.constraint;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.List;

import java.util.stream.Collectors;

import org.passay.CharacterRule;

import org.passay.EnglishCharacterData;

import org.passay.LengthRule;

import org.passay.PasswordData;

import org.passay.PasswordData.Origin;

import org.passay.PasswordValidator;

import org.passay.RuleResult;

import org.passay.WhitespaceRule;

import eu.etaxonomy.cdm.validation.annotation.ValidPassword;

import jakarta.validation.ConstraintValidator;

import jakarta.validation.ConstraintValidatorContext;

/**

 * @author a.kohlbecker

 * @since Nov 12, 2021

 */

public class PasswordConstraintValidator implements ConstraintValidator<ValidPassword, String> {

    @Override

    public boolean isValid(String value, ConstraintValidatorContext context) {

        final PasswordValidator validator = defaultPasswordValidator();

        final RuleResult result = validator.validate(new PasswordData(value));

        if (result.isValid()) {

            return true;

        }

        context.disableDefaultConstraintViolation();

        context.buildConstraintViolationWithTemplate(

                validator.getMessages(result).stream().collect(Collectors.joining(", "))).addConstraintViolation();

        return false;

    }

    private static PasswordValidator defaultPasswordValidator() {

        return new PasswordValidator(Arrays.asList(

                // see https://www.passay.org/reference/

                // length between 8 and 16 characters

                new LengthRule(8, Integer.MAX_VALUE),

                // at least one upper-case character

                new CharacterRule(EnglishCharacterData.UpperCase, 1),

                // at least one lower-case character

                new CharacterRule(EnglishCharacterData.LowerCase, 1),

                // at least one digit character

                new CharacterRule(EnglishCharacterData.Digit, 1),

//                // at least one symbol (special character)

//                new CharacterRule(EnglishCharacterData.Special, 1),

                // no whitespace

                new WhitespaceRule()));

    }

    public static class PasswordRulesValidator {

        private PasswordValidator validator = PasswordConstraintValidator.defaultPasswordValidator();

        /**

         * Validate a password which was generated by a typical human user

         *

         * @param password

         *            The password to validate

         * @return In case of rule violations the returned lost contains the

         *         violation messages, other wise the lost is empty.

         */

        public List<String> validateUserPassword(String password) {

            return readViolationMessageList(validator.validate(new PasswordData(password)));

        }

        /**

         * Validate a password which was generated by a random source

         *

         * @param password

         *            The password to validate

         * @return In case of rule violations the returned lost contains the

         *         violation messages, other wise the lost is empty.

         */

        public List<String> validateGeneratedPassword(String password) {

            return readViolationMessageList(validator.validate(new PasswordData(password, Origin.Generated)));

        }

        private List<String> readViolationMessageList(RuleResult validate) {

            if (validate.isValid()) {

                return new ArrayList<>(0);

            }

            return validator.getMessages(validate);

        }

        protected PasswordValidator getValidator() {

            return validator;

        }

    }

}

      </dependency>

      <dependency>

        <groupId>org.passay</groupId>

        <artifactId>passay</artifactId>

        <version>1.6.1</version>

      </dependency>