EDIT

import eu.etaxonomy.cdm.validation.Level2;

import eu.etaxonomy.cdm.validation.annotation.ValidPassword;

    @ValidPassword(groups=Level2.class)

import eu.etaxonomy.cdm.validation.constraint.ValidPasswordValidator;

@Constraint(validatedBy = ValidPasswordValidator.class)

/**

* Copyright (C) 2021 EDIT

* European Distributed Institute of Taxonomy

* http://www.e-taxonomy.eu

*

* The contents of this file are subject to the Mozilla Public License Version 1.1

* See LICENSE.TXT at the top of this package for the full license terms.

*/

package eu.etaxonomy.cdm.validation.constraint;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.List;

import java.util.stream.Collectors;

import javax.validation.ConstraintValidator;

import javax.validation.ConstraintValidatorContext;

import org.passay.CharacterRule;

import org.passay.EnglishCharacterData;

import org.passay.LengthRule;

import org.passay.PasswordData;

import org.passay.PasswordData.Origin;

import org.passay.PasswordValidator;

import org.passay.RuleResult;

import org.passay.WhitespaceRule;

import eu.etaxonomy.cdm.validation.annotation.ValidPassword;

/**

 * @author a.kohlbecker

 * @since Nov 12, 2021

 */

public class ValidPasswordValidator implements ConstraintValidator<ValidPassword, String> {

    public static PasswordValidator defaultValidator;

    @Override

    public boolean isValid(String value, ConstraintValidatorContext context) {

        final PasswordValidator validator = getDefaultPasswordValidator();

        String message;

        if (value != null) {

            final RuleResult result = validator.validate(new PasswordData(value));

            if (result.isValid()) {

                return true;

            }

            message = validator.getMessages(result).stream().collect(Collectors.joining(" "));

        }else {

            message = "Null is not allowed for password";

        }

        context.disableDefaultConstraintViolation();

        context.buildConstraintViolationWithTemplate(message).addConstraintViolation();

        return false;

    }

    private static PasswordValidator getDefaultPasswordValidator() {

        if (defaultValidator == null) {

            defaultValidator = new PasswordValidator(Arrays.asList(

                // see https://www.passay.org/reference/

                // length between 8 and 16 characters

                new LengthRule(8, 256),

                // at least one upper-case character

                new CharacterRule(EnglishCharacterData.UpperCase, 1),

                // at least one lower-case character

                new CharacterRule(EnglishCharacterData.LowerCase, 1),

                // at least one digit character

                new CharacterRule(EnglishCharacterData.Digit, 1),

//                // at least one symbol (special character)

//                new CharacterRule(EnglishCharacterData.Special, 1),

                // no whitespace

                new WhitespaceRule()));

            }

        return defaultValidator;

    }

    public static class PasswordRulesValidator {

        private PasswordValidator validator = defaultValidator;

        /**

         * Validate a password which was generated by a typical human user

         *

         * @param password

         *            The password to validate

         * @return In case of rule violations the returned lost contains the

         *         violation messages, other wise the lost is empty.

         */

        public List<String> validateUserPassword(String password) {

            return readViolationMessageList(validator.validate(new PasswordData(password)));

        }

        /**

         * Validate a password which was generated by a random source

         *

         * @param password

         *            The password to validate

         * @return In case of rule violations the returned lost contains the

         *         violation messages, other wise the lost is empty.

         */

        public List<String> validateGeneratedPassword(String password) {

            return readViolationMessageList(validator.validate(new PasswordData(password, Origin.Generated)));

        }

        private List<String> readViolationMessageList(RuleResult validate) {

            if (validate.isValid()) {

                return new ArrayList<>(0);

            }

            return validator.getMessages(validate);

        }

        protected PasswordValidator getValidator() {

            return validator;

        }

    }

}

/**

* Copyright (C) 2022 EDIT

* European Distributed Institute of Taxonomy

* http://www.e-taxonomy.eu

*

* The contents of this file are subject to the Mozilla Public License Version 1.1

* See LICENSE.TXT at the top of this package for the full license terms.

*/

package eu.etaxonomy.cdm.validation;

import static org.junit.Assert.assertTrue;

import java.util.Set;

import javax.validation.ConstraintViolation;

import org.apache.commons.lang3.StringUtils;

import org.apache.log4j.Logger;

import org.junit.Before;

import org.junit.Test;

import eu.etaxonomy.cdm.model.permission.User;

import eu.etaxonomy.cdm.validation.constraint.ValidPasswordValidator;

/**

 * @author a.mueller

 * @date 21.01.2022

 */

public class ValidPasswordTest  extends ValidationTestBase {

    @SuppressWarnings("unused")

    private static final Logger logger = Logger.getLogger(ValidPasswordTest.class);

    private User user;

    private static final String valid = "Aa345678";

    @Before

    public void setUp() {

    }

/****************** TESTS *****************************/

    @Test

    public final void testValidPassword() {

        user = User.NewInstance("testuser", valid);

        Set<ConstraintViolation<User>> constraintViolations  = validator.validate(user, Level2.class);

        assertTrue("There should not be a constraint violation as the 'valid' password fullfils all requirements",constraintViolations.isEmpty());

        user.setPassword(StringUtils.leftPad(valid, 256, 'a'));

        assertTrue("There should not be a constraint violation as up to 256 characters are allowed",constraintViolations.isEmpty());

    }

    @Test

    public final void testNotValidPassword() {

        user = User.NewInstance("testuser", null);

        validateHasConstraint(user, ValidPasswordValidator.class, Level2.class);

        user.setPassword("");

        validateHasConstraint(user, ValidPasswordValidator.class, Level2.class);

        user.setPassword("A");

        validateHasConstraint(user, ValidPasswordValidator.class, Level2.class);

        user.setPassword(valid.substring(0, 7));

        validateHasConstraint(user, ValidPasswordValidator.class, Level2.class);

        user.setPassword(StringUtils.leftPad(valid, 257, 'a'));

        validateHasConstraint(user, ValidPasswordValidator.class, Level2.class);

   }

}