🤖 backported "Added new strong-enough password type" (metabase#75243)

Added new `strong-enough` password type (metabase#75104)

* Added new `strong-enough` password type

* Revert password policy to default normal

* Numbers only test added

* Misc

Co-authored-by: Benoit Vinay <ben@benoitvinay.com>

Author: github-automation-metabase

docs/configuring-metabase/environment-variables.md

@@ -2763,14 +2763,15 @@ Comma-separated namespaces to trace. **WARNING:** Could log sensitive informatio
 
 ### `MB_PASSWORD_COMPLEXITY`
 
-Type: string (`"weak"`, `"normal"`, `"strong"`)<br>
+Type: string (`"weak"`, `"normal"`, `"strong"`, `"strong-enough"`)<br>
 Default: `"normal"`
 
 Enforce a password complexity rule to increase security for regular logins. This only applies to new users or users that are changing their password. Related [MB_PASSWORD_LENGTH](#mb_password_length)
 
 - `weak` no character constraints
 - `normal` at least 1 digit
 - `strong` minimum 8 characters w/ 2 lowercase, 2 uppercase, 1 digit, and 1 special character
+- `strong-enough` minimum 15 characters
 
 ### `MB_PASSWORD_LENGTH`
 

docs/people-and-groups/changing-password-complexity.md

@@ -20,6 +20,7 @@ The settings above can be used independently, so it's fine to use only one or th
 - `weak` = no character constraints
 - `normal` = at least 1 digit
 - `strong` = minimum 8 characters w/ 2 lowercase, 2 uppercase, 1 digit, and 1 special character
+- `strong-enough` = minimum 15 characters
 
 By default, Metabase also prevents users from setting passwords that are in a list of common passwords (like `qwerty123` and
 `passw0rd`). Changing the complexity requirement to `weak` disables this behavior.

src/metabase/cmd/resources/other-env-vars.md

@@ -452,14 +452,15 @@ Comma-separated namespaces to trace. **WARNING:** Could log sensitive informatio
 
 ### `MB_PASSWORD_COMPLEXITY`
 
-Type: string (`"weak"`, `"normal"`, `"strong"`)<br>
+Type: string (`"weak"`, `"normal"`, `"strong"`, `"strong-enough"`)<br>
 Default: `"normal"`
 
 Enforce a password complexity rule to increase security for regular logins. This only applies to new users or users that are changing their password. Related [MB_PASSWORD_LENGTH](#mb_password_length)
 
 - `weak` no character constraints
 - `normal` at least 1 digit
 - `strong` minimum 8 characters w/ 2 lowercase, 2 uppercase, 1 digit, and 1 special character
+- `strong-enough` minimum 15 characters
 
 ### `MB_PASSWORD_LENGTH`
 

src/metabase/util/password.clj

@@ -27,14 +27,15 @@
 
 (def ^:private ^:const complexity->char-type->min
   "Minimum counts of each class of character a password should have for a given password complexity level."
-  {:weak   {:total   6} ; total here effectively means the same thing as a minimum password length
-   :normal {:total   6
-            :digit   1}
-   :strong {:total   8
-            :lower   2
-            :upper   2
-            :digit   1
-            :special 1}})
+  {:weak          {:total 6} ; total here effectively means the same thing as a minimum password length
+   :normal        {:total 6
+                   :digit 1}
+   :strong        {:total 8
+                   :lower   2
+                   :upper   2
+                   :digit   1
+                   :special 1}
+   :strong-enough {:total 15}})
 
 (defn- password-has-char-counts?
   "Check that PASSWORD satisfies the minimum count requirements for each character class.

test/metabase/util/password_test.clj

@@ -1,6 +1,8 @@
 (ns metabase.util.password-test
   (:require
    [clojure.test :refer :all]
+   [environ.core :as env]
+   [metabase.config.core :as config]
    [metabase.test :as mt]
    [metabase.test.fixtures :as fixtures]
    [metabase.util.password :as u.password]))
@@ -69,6 +71,11 @@
         (is (= expected
                (u.password/is-valid? input)))))))
 
+(deftest default-password-complexity-config-test
+  (testing "When MB_PASSWORD_COMPLEXITY is unset, default is :normal"
+    (with-redefs [env/env (dissoc env/env :mb-password-complexity)]
+      (is (= :normal (config/config-kw :mb-password-complexity))))))
+
 (deftest is-valid?-weak-test
   (testing "Do some tests with password complexity requirements set to :weak.
             Common password list should not be checked."
@@ -81,6 +88,19 @@
           (is (= expected
                  (u.password/is-valid? input))))))))
 
+(deftest is-valid?-strong-enough-test
+  (testing "Do some tests with password complexity requirements set to :strong-enough."
+    (mt/with-temp-env-var-value! [:mb-password-complexity "strong-enough"]
+      (doseq [[input expected] {"ABC"                false
+                                "ABCDEFGHIJKLM"    false
+                                "abcdefghijklmno"  true
+                                "123456789012345"  true
+                                "unc0mmonpw12345"  true
+                                "123456789987654321" false}]
+        (testing (pr-str (list 'is-valid? input))
+          (is (= expected
+                 (u.password/is-valid? input))))))))
+
 (deftest passsword-length-test
   (testing "Password length can be set by the env variable MB_PASSWORD_LENGTH"
     (mt/with-temp-env-var-value! [:mb-password-length 3