class

KemalIdentity::Passwords::Policy

Inherits Reference < Object

Whether a password is acceptable to set. Nothing to do with verifying one.

Separate from Hasher on purpose: hashing is the shard's business, and deciding what counts as an acceptable password is the application's. This contract is the seam.

No composition rules ship, and none will. "One uppercase, one lowercase, one digit, one symbol" is not supported by current guidance, and hard-coding it in a library forces it on every consumer — docs/02-security-model.md names a competing shard that documents exactly such a rule as a feature. Mandatory rotation is likewise absent. An application that must have either writes its own Policy; that is what the contract is for.

Instance methods

acceptable?(password : Secret) : Bool
Source
violations(password : Secret) : Array(PolicyViolation)

Every reason this password is unacceptable. Empty means acceptable.

All of them, not the first one: telling somebody their password is too short, and then after they fix it that it is also breached, is a worse experience than saying both at once.

Source