auth.validate-password-change

matches = verifyPassword(currentPassword, user.passwordHash)
validatePasswordChange(currentPassword, newPassword, matches, user.email, user.name,
                       passwordPolicy("nist-800-63b-4-single-factor"))
# {valid: false, fields: {"currentPassword": "That is not your current password."}}

def validate_password_change(current_password: str, new_password: str, current_password_matches: bool, email: str, name: str, policy: PasswordPolicy) -> PasswordChangeCheck

@dataclass(frozen=True)
class PasswordChangeCheck:
    """A change-password form's verdict, shaped for an API's validation error and a form's field messages."""

    valid: bool
    #: field name (currentPassword, newPassword) to message; empty when valid
    fields: Dict[str, str]

from fune.auth.validate_password_change import validate_password_change  # auth.validate-password-change@^1

from typing import Any, Dict, List

from .auth_password_policy_check_password import check_password
from .auth_password_policy_types import PasswordPolicy
from .auth_validate_password_change_types import PasswordChangeCheck


def _text(value: Any) -> str:
    # A non-string (a malformed JSON body) is an empty field, not an exception.
    return value if isinstance(value, str) else ""


def validate_password_change(
    current_password: str,
    new_password: str,
    current_password_matches: bool,
    email: str,
    name: str,
    policy: PasswordPolicy,
) -> PasswordChangeCheck:
    """A change-password form checked in one call: the current password must
    be given and correct, the new one must meet the policy and differ from it."""
    current, new = _text(current_password), _text(new_password)
    fields: Dict[str, str] = {}

    if current == "":
        fields["currentPassword"] = "Enter your current password."
    elif current_password_matches is not True:
        fields["currentPassword"] = "That is not your current password."

    # Checked even when empty, so a nonsensical policy always throws.
    check = check_password(new, email, name, policy)
    if new == "":
        fields["newPassword"] = "Enter a new password."
    else:
        messages: List[str] = [f.message for f in check.failures]
        if new == current:
            messages.append("Choose a password that is different from your current one.")
        if messages:
            fields["newPassword"] = " ".join(messages)

    return PasswordChangeCheck(valid=len(fields) == 0, fields=fields)

Install

fune build

With that line in your source, in a Python project (language python in fune.project), fune build resolves it and its 1 dependency, pins them in fune.lock, downloads only the Python package of each, and builds the code above into your project’s .fune/build, one readable file per capability with a header linking back here. Or pin a range in fune.project and build in one step:

fune add auth.validate-password-change

The manifest, vectors and README with only the Python implementation. Install it without the registry with fune add ./auth.validate-password-change-1.0.0-python.fune, or fetch it from a terminal with fune pull auth.validate-password-change@1.0.0:python.

The whole function, every language, is one file too: auth.validate-password-change-1.0.0.fune, 17,269 bytes, sha256 c95e8fac3c2b80b7c7368d312f2ba8b40486e94e4e24148e6e53940224cd20c1. It installs into a project of any language.

# fune: before auth.validate-password-change

# fune: after auth.validate-password-change

# fune: replace auth.password-policy in auth.validate-password-change

# fune: step auth.validate-password-change after <n|label>

More from the author

Checking the hash is not a pure function's job (it needs the stored hash), so its answer comes in as `currentPasswordMatches`; the rule of what to say about it lives here, next to the other messages. A wrong current password is a field message (400), not a 401: the person's session is fine, they mistyped.

**currentPassword**: empty is "Enter your current password."; otherwise `currentPasswordMatches` false is "That is not your current password.". An empty password never counts as matching, whatever the flag says.

**newPassword**: empty is "Enter a new password."; otherwise every failure of `auth.password-policy`'s `checkPassword` against the account's stored email and name, in the policy's order, and then "Choose a password that is different from your current one." when it is exactly the current password, all joined with a space. Use the same policy name sign-up uses, so a password that could not be chosen at sign-up cannot be chosen here either.

Passwords are compared exactly as typed: not trimmed and not case-folded, so `"correct horse battery staple "` with a trailing space is a different password. `fields` is keyed `currentPassword` then `newPassword`, the JSON body's own names. A value that is not a string is treated as empty. A nonsensical policy throws, as in `checkPassword`.

After a valid change the API stores a new hash and revokes every token the account holds (`auth.access-token`: bump the token version).

Files