web/src/password_quality.ts - main - githubmirror/zulip

web/src/password_quality.ts
77 строк3 KB
Anders Kaseorg
dependencies: Upgrade JavaScript dependencies.
29 июл 2026, 02:35
29 июл 2026, 02:35d257809
import {ZxcvbnFactory} from "@zxcvbn-ts/core";
import * as zxcvbnCommonPackage from "@zxcvbn-ts/language-common";
import * as zxcvbnEnPackage from "@zxcvbn-ts/language-en";

import {$t} from "./i18n.ts";

const zxcvbn = new ZxcvbnFactory({
    translations: zxcvbnEnPackage.translations,
    dictionary: {
        ...zxcvbnCommonPackage.dictionary,
        ...zxcvbnEnPackage.dictionary,
    },
    graphs: zxcvbnCommonPackage.adjacencyGraphs,
});

// Note: this module is loaded asynchronously from the app with
// import() to keep zxcvbn out of the initial page load.  Do not
// import it synchronously from the app.

// Return a boolean indicating whether the password is acceptable.
// Also updates a Bootstrap progress bar control (a jQuery object)
// if provided.
export function password_quality(
    password: string,
    $bar: JQuery | undefined,
    $password_field: JQuery,
): boolean {
    const min_length = Number($password_field.attr("data-min-length"));
    const max_length = Number($password_field.attr("data-max-length"));
    const min_guesses = Number($password_field.attr("data-min-guesses"));

    const result = zxcvbn.check(password);
    const acceptable =
        password.length >= min_length &&
        password.length <= max_length &&
        result.guesses >= min_guesses;

    if ($bar !== undefined) {
        const t = result.crackTimes.offlineSlowHashingXPerSecond.seconds;
        let bar_progress = Math.min(1, Math.log(1 + t) / 22);

        // Even if zxcvbn loves your short password, the bar should be
        // filled at most 1/3 of the way, because we won't accept it.
        if (!acceptable) {
            bar_progress = Math.min(bar_progress, 0.33);
        }

        // The bar bottoms out at 10% so there's always something
        // for the user to see.
        $bar.width(`${90 * bar_progress + 10}%`)
            .removeClass("bar-success bar-danger")
            .addClass(acceptable ? "bar-success" : "bar-danger");
    }

    return acceptable;
}

export function password_warning(password: string, $password_field: JQuery): string {
    const min_length = Number($password_field.attr("data-min-length"));
    const max_length = Number($password_field.attr("data-max-length"));

    if (password.length < min_length) {
        return $t(
            {defaultMessage: "Password should be at least {length} characters long."},
            {length: min_length},
        );
    }
    if (password.length > max_length) {
        return $t(
            {
                defaultMessage: "Maximum password length: {max} characters.",
            },
            {max: max_length},
        );
    }
    return zxcvbn.check(password).feedback.warning ?? $t({defaultMessage: "Password is too weak."});
}