No commit suggestions generated

password/validator.go

@@ -0,0 +1,185 @@
+// Package password provides secure password handling and validation
+package password
+
+import (
+	"crypto/rand"
+	"fmt"
+	"unicode"
+)
+
+// PasswordConfig defines password policy requirements
+type PasswordConfig struct {
+	MinLength        int
+	MaxLength        int
+	RequireUppercase bool
+	RequireLowercase bool
+	RequireDigits    bool
+	RequireSpecial   bool
+	MinEntropy       float64
+}
+
+// DefaultPasswordConfig returns secure default password requirements
+func DefaultPasswordConfig() *PasswordConfig {
+	return &PasswordConfig{
+		MinLength:        12,
+		MaxLength:        128,
+		RequireUppercase: true,
+		RequireLowercase: true,
+		RequireDigits:    true,
+		RequireSpecial:   true,
+		MinEntropy:       50.0, // bits
+	}
+}
+
+// Validator validates passwords against security policies
+type Validator struct {
+	config *PasswordConfig
+}
+
+// NewValidator creates a password validator with the given configuration
+func NewValidator(config *PasswordConfig) *Validator {
+	if config == nil {
+		config = DefaultPasswordConfig()
+	}
+	return &Validator{config: config}
+}
+
+// Validate checks if a password meets security requirements
+func (v *Validator) Validate(password []byte) error {
+	// Check length
+	if len(password) < v.config.MinLength {
+		return fmt.Errorf("password must be at least %d characters", v.config.MinLength)
+	}
+	if len(password) > v.config.MaxLength {
+		return fmt.Errorf("password must not exceed %d characters", v.config.MaxLength)
+	}
+
+	// Check character requirements
+	var hasUpper, hasLower, hasDigit, hasSpecial bool
+	for _, ch := range string(password) {
+		switch {
+		case unicode.IsUpper(ch):
+			hasUpper = true
+		case unicode.IsLower(ch):
+			hasLower = true
+		case unicode.IsDigit(ch):
+			hasDigit = true
+		case unicode.IsSpace(ch):
+			// Spaces are allowed but not counted as special
+		case unicode.IsPunct(ch) || unicode.IsSymbol(ch):
+			hasSpecial = true
+		}
+	}
+
+	if v.config.RequireUppercase && !hasUpper {
+		return fmt.Errorf("password must contain at least one uppercase letter")
+	}
+	if v.config.RequireLowercase && !hasLower {
+		return fmt.Errorf("password must contain at least one lowercase letter")
+	}
+	if v.config.RequireDigits && !hasDigit {
+		return fmt.Errorf("password must contain at least one digit")
+	}
+	if v.config.RequireSpecial && !hasSpecial {
+		return fmt.Errorf("password must contain at least one special character")
+	}
+
+	// Check entropy
+	entropy := v.calculateEntropy(password)
+	if entropy < v.config.MinEntropy {
+		return fmt.Errorf("password entropy too low: %.1f bits (minimum: %.1f)",
+			entropy, v.config.MinEntropy)
+	}
+
+	return nil
+}
+
+// calculateEntropy estimates password entropy in bits
+func (v *Validator) calculateEntropy(password []byte) float64 {
+	// Count unique characters
+	charSet := make(map[byte]bool)
+	for _, b := range password {
+		charSet[b] = true
+	}
+
+	// Estimate character pool size
+	poolSize := 0
+	var hasUpper, hasLower, hasDigit, hasSpecial bool
+
+	for ch := range charSet {
+		r := rune(ch)
+		switch {
+		case unicode.IsUpper(r):
+			hasUpper = true
+		case unicode.IsLower(r):
+			hasLower = true
+		case unicode.IsDigit(r):
+			hasDigit = true
+		case unicode.IsPunct(r) || unicode.IsSymbol(r):
+			hasSpecial = true
+		}
+	}
+
+	if hasLower {
+		poolSize += 26
+	}
+	if hasUpper {
+		poolSize += 26
+	}
+	if hasDigit {
+		poolSize += 10
+	}
+	if hasSpecial {
+		poolSize += 32 // Common special characters
+	}
+
+	if poolSize == 0 {
+		return 0
+	}
+
+	// Calculate entropy: log2(poolSize^length)
+	// Simplified: length * log2(poolSize)
+	bitsPerChar := 0.0
+	temp := poolSize
+	for temp > 0 {
+		bitsPerChar++
+		temp >>= 1
+	}
+
+	return float64(len(password)) * bitsPerChar
+}
+
+// GenerateSalt generates a cryptographically secure random salt
+func GenerateSalt(size int) ([]byte, error) {
+	if size < 16 {
+		return nil, fmt.Errorf("salt size must be at least 16 bytes")
+	}
+
+	salt := make([]byte, size)
+	if _, err := rand.Read(salt); err != nil {
+		return nil, fmt.Errorf("failed to generate salt: %w", err)
+	}
+
+	return salt, nil
+}
+
+// SecureCompare performs constant-time comparison of two byte slices
+func SecureCompare(a, b []byte) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	var result byte
+	for i := 0; i < len(a); i++ {
+		result |= a[i] ^ b[i]
+	}
+
+	return result == 0
+}
+
+// ZeroBytes overwrites a byte slice with zeros
+func ZeroBytes(b []byte) {
+	for i := range b {
+		b[i] = 0
+	}
+}