fix(auth): relax password complexity requirements to suggestions-only (#5764)

apps/nextjs/src/app/[locale]/init/_steps/user/init-user-form.tsx

@@ -1,15 +1,15 @@
 "use client";
 
-import { Button, PasswordInput, Stack, TextInput } from "@mantine/core";
+import { Button, Stack, TextInput } from "@mantine/core";
 import type { z } from "zod/v4";
 
 import { clientApi } from "@homarr/api/client";
 import { signIn } from "@homarr/auth/client";
 import { revalidatePathActionAsync } from "@homarr/common/client";
 import { useZodForm } from "@homarr/form";
+import { UserCreatePasswordFields } from "@homarr/forms-collection";
 import { showErrorNotification, showSuccessNotification } from "@homarr/notifications";
 import { useScopedI18n } from "@homarr/translation/client";
-import { CustomPasswordInput } from "@homarr/ui";
 import { userInitSchema } from "@homarr/validation/user";
 
 export const InitUserForm = () => {
@@ -59,12 +59,10 @@ export const InitUserForm = () => {
       >
         <Stack gap="lg">
           <TextInput label={t("field.username.label")} {...form.getInputProps("username")} />
-          <CustomPasswordInput
-            withPasswordRequirements
-            label={t("field.password.label")}
-            {...form.getInputProps("password")}
+          <UserCreatePasswordFields
+            passwordInputProps={form.getInputProps("password")}
+            confirmPasswordInputProps={form.getInputProps("confirmPassword")}
           />
-          <PasswordInput label={t("field.passwordConfirm.label")} {...form.getInputProps("confirmPassword")} />
           <Button type="submit" fullWidth loading={isPending}>
             {t("action.create")}
           </Button>

apps/nextjs/src/app/[locale]/manage/users/create/_components/create-user-stepper.tsx

@@ -1,20 +1,7 @@
 "use client";
 
 import { startTransition, useCallback, useState } from "react";
-import {
-  Badge,
-  Button,
-  Card,
-  Group,
-  PasswordInput,
-  Stack,
-  Stepper,
-  Table,
-  Text,
-  TextInput,
-  Title,
-  Tooltip,
-} from "@mantine/core";
+import { Badge, Button, Card, Group, Stack, Stepper, Table, Text, TextInput, Title, Tooltip } from "@mantine/core";
 import { useListState } from "@mantine/hooks";
 import { IconPlus, IconUserCheck } from "@tabler/icons-react";
 import { z } from "zod/v4";
@@ -24,10 +11,11 @@ import type { GroupPermissionKey } from "@homarr/definitions";
 import { everyoneGroup, groupPermissions } from "@homarr/definitions";
 import type { IsValid } from "@homarr/form";
 import { useZodForm } from "@homarr/form";
+import { UserCreatePasswordFields } from "@homarr/forms-collection";
 import { useModalAction } from "@homarr/modals";
 import { showErrorNotification } from "@homarr/notifications";
 import { useI18n, useScopedI18n } from "@homarr/translation/client";
-import { CustomPasswordInput, UserAvatar } from "@homarr/ui";
+import { UserAvatar } from "@homarr/ui";
 import { createCustomErrorParams } from "@homarr/validation/form/i18n";
 import { userPasswordSchema } from "@homarr/validation/user";
 
@@ -167,18 +155,10 @@ export const UserCreateStepperComponent = ({ initialGroups }: UserCreateStepperC
           <form>
             <Card p="xl">
               <Stack gap="md">
-                <CustomPasswordInput
-                  withPasswordRequirements
-                  label={tUserField("password.label")}
+                <UserCreatePasswordFields
                   variant="filled"
-                  withAsterisk
-                  {...securityForm.getInputProps("password")}
-                />
-                <PasswordInput
-                  label={tUserField("passwordConfirm.label")}
-                  variant="filled"
-                  withAsterisk
-                  {...securityForm.getInputProps("confirmPassword")}
+                  passwordInputProps={securityForm.getInputProps("password")}
+                  confirmPasswordInputProps={securityForm.getInputProps("confirmPassword")}
                 />
               </Stack>
             </Card>

packages/api/src/router/test/user.spec.ts

@@ -81,13 +81,7 @@ describe("initUser should initialize the first user", () => {
     await expect(actAsync()).rejects.toThrow("passwordsDoNotMatch");
   });
 
-  it.each([
-    ["aB2%"], // too short
-    ["abc123DEF"], // does not contain special characters
-    ["abcDEFghi+"], // does not contain numbers
-    ["ABC123+/-"], // does not contain lowercase
-    ["abc123+/-"], // does not contain uppercase
-  ])("should throw error that password requirements do not match for '%s' as password", async (password) => {
+  it.each([["aB2%"], ["short"]])("should reject passwords shorter than 8 characters for '%s'", async (password) => {
     const db = createDb();
     await createOnboardingStepAsync(db, "user");
     const caller = userRouter.createCaller({
@@ -103,7 +97,55 @@ describe("initUser should initialize the first user", () => {
         confirmPassword: password,
       });
 
-    await expect(actAsync()).rejects.toThrow("passwordRequirements");
+    await expect(actAsync()).rejects.toThrow();
+  });
+
+  it("should accept passwords without complexity requirements", async () => {
+    const db = createDb();
+    await createOnboardingStepAsync(db, "user");
+    const caller = userRouter.createCaller({
+      db,
+      deviceType: undefined,
+      session: null,
+    });
+
+    await caller.initUser({
+      username: "test",
+      password: "abc123DEF",
+      confirmPassword: "abc123DEF",
+    });
+
+    const user = await db.query.users.findFirst({
+      columns: {
+        id: true,
+      },
+    });
+
+    expect(user).toBeDefined();
+  });
+
+  it("should accept passwords with special characters like LoveHomarr<3", async () => {
+    const db = createDb();
+    await createOnboardingStepAsync(db, "user");
+    const caller = userRouter.createCaller({
+      db,
+      deviceType: undefined,
+      session: null,
+    });
+
+    await caller.initUser({
+      username: "test",
+      password: "LoveHomarr<3",
+      confirmPassword: "LoveHomarr<3",
+    });
+
+    const user = await db.query.users.findFirst({
+      columns: {
+        id: true,
+      },
+    });
+
+    expect(user).toBeDefined();
   });
 });
 

packages/forms-collection/src/index.tsx

@@ -5,3 +5,5 @@ export * from "./icon-picker/icon-picker";
 export * from "./new-app/icon-matcher";
 
 export * from "./upload-media/upload-media";
+
+export * from "./user-create/user-create-password-fields";

packages/forms-collection/src/user-create/user-create-password-fields.tsx

@@ -0,0 +1,33 @@
+"use client";
+
+import { PasswordInput, Stack } from "@mantine/core";
+import type { PasswordInputProps } from "@mantine/core";
+
+import { useScopedI18n } from "@homarr/translation/client";
+import { CustomPasswordInput } from "@homarr/ui";
+
+interface UserCreatePasswordFieldsProps {
+  passwordInputProps: PasswordInputProps;
+  confirmPasswordInputProps: PasswordInputProps;
+  variant?: PasswordInputProps["variant"];
+}
+
+export const UserCreatePasswordFields = ({
+  passwordInputProps,
+  confirmPasswordInputProps,
+  variant,
+}: UserCreatePasswordFieldsProps) => {
+  const t = useScopedI18n("user.field");
+
+  return (
+    <Stack gap="md">
+      <CustomPasswordInput
+        withPasswordRequirements
+        label={t("password.label")}
+        variant={variant}
+        {...passwordInputProps}
+      />
+      <PasswordInput label={t("passwordConfirm.label")} variant={variant} {...confirmPasswordInputProps} />
+    </Stack>
+  );
+};

packages/translation/src/lang/ca.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Contrasenya",
-        "requirement": {
+        "suggestion": {
           "length": "Inclou com a mínim 8 caràcters",
           "lowercase": "Inclou minúscules",
           "uppercase": "Inclou majúscules",

packages/translation/src/lang/cn.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "密码",
-        "requirement": {
+        "suggestion": {
           "length": "至少包含 8 个字符",
           "lowercase": "包含小写字母",
           "uppercase": "包含大写字母",

packages/translation/src/lang/cr.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "crwdns26:0crwdne26:0",
-        "requirement": {
+        "suggestion": {
           "length": "crwdns28:0crwdne28:0",
           "lowercase": "crwdns30:0crwdne30:0",
           "uppercase": "crwdns32:0crwdne32:0",

packages/translation/src/lang/cs.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Heslo",
-        "requirement": {
+        "suggestion": {
           "length": "Obsahuje alespoň 8 znaků",
           "lowercase": "Obsahuje malé písmeno",
           "uppercase": "Obsahuje velké písmeno",

packages/translation/src/lang/da.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Adgangskode",
-        "requirement": {
+        "suggestion": {
           "length": "Inkluderer mindst 8 tegn",
           "lowercase": "Inkluderer små bogstaver",
           "uppercase": "Inkluderer store bogstaver",

packages/translation/src/lang/de-CH.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Passwort",
-        "requirement": {
+        "suggestion": {
           "length": "Enthält mindestens 8 Zeichen",
           "lowercase": "Enthält Kleinbuchstaben",
           "uppercase": "Enthält Großbuchstaben",

packages/translation/src/lang/de.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Passwort",
-        "requirement": {
+        "suggestion": {
           "length": "Enthält mindestens 8 Zeichen",
           "lowercase": "Enthält Kleinbuchstaben",
           "uppercase": "Enthält Großbuchstaben",

packages/translation/src/lang/el.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Κωδικός",
-        "requirement": {
+        "suggestion": {
           "length": "",
           "lowercase": "Περιλαμβάνει πεζό γράμμα",
           "uppercase": "Περιλαμβάνει κεφαλαίο γράμμα",

packages/translation/src/lang/en-gb.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Password",
-        "requirement": {
+        "suggestion": {
           "length": "Includes a minimum of 8 characters",
           "lowercase": "Includes a lower-case letter",
           "uppercase": "Includes an upper-case letter",

packages/translation/src/lang/en.json

@@ -132,8 +132,9 @@
       },
       "password": {
         "label": "Password",
-        "requirement": {
-          "length": "Includes at least 8 characters",
+        "suggestionsTitle": "Password suggestions",
+        "suggestion": {
+          "length": "At least 8 characters",
           "lowercase": "Includes lowercase letter",
           "uppercase": "Includes uppercase letter",
           "number": "Includes number",

packages/translation/src/lang/es.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Contraseña",
-        "requirement": {
+        "suggestion": {
           "length": "Incluye al menos 8 caracteres",
           "lowercase": "Incluye al menos una letra minúscula",
           "uppercase": "Incluye al menos una letra mayúscula",

packages/translation/src/lang/et.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "",
-        "requirement": {
+        "suggestion": {
           "length": "",
           "lowercase": "",
           "uppercase": "",

packages/translation/src/lang/fr.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Mot de passe",
-        "requirement": {
+        "suggestion": {
           "length": "Contient au moins 8 caractères",
           "lowercase": "Inclut une lettre minuscule",
           "uppercase": "Inclut une lettre majuscule",

packages/translation/src/lang/he.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "סיסמה",
-        "requirement": {
+        "suggestion": {
           "length": "כולל לפחות 8 תווים",
           "lowercase": "אפשר אותיות קטנות",
           "uppercase": "אפשר אותיות גדולות",

packages/translation/src/lang/hr.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Lozinka",
-        "requirement": {
+        "suggestion": {
           "length": "",
           "lowercase": "Uključuje mala slova",
           "uppercase": "Uključuje veliko slovo",

packages/translation/src/lang/hu.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Jelszó",
-        "requirement": {
+        "suggestion": {
           "length": "Tartalmazzon legalább 8 karaktert",
           "lowercase": "Tartalmazzon kisbetűt",
           "uppercase": "Tartalmazzon nagybetűt",

packages/translation/src/lang/it.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Password",
-        "requirement": {
+        "suggestion": {
           "length": "Include almeno 8 caratteri",
           "lowercase": "Include lettera minuscola",
           "uppercase": "Include lettera maiuscola",

packages/translation/src/lang/ja.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "パスワード",
-        "requirement": {
+        "suggestion": {
           "length": "少なくとも 8 文字以上を含む",
           "lowercase": "小文字を含む",
           "uppercase": "大文字を含む",

packages/translation/src/lang/ko.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "비밀번호",
-        "requirement": {
+        "suggestion": {
           "length": "",
           "lowercase": "소문자 포함",
           "uppercase": "대문자 포함",

packages/translation/src/lang/lt.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Slaptažodis",
-        "requirement": {
+        "suggestion": {
           "length": "",
           "lowercase": "",
           "uppercase": "",

packages/translation/src/lang/lv.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Parole",
-        "requirement": {
+        "suggestion": {
           "length": "",
           "lowercase": "Ietver mazo burtu",
           "uppercase": "Ietver lielo burtu",

packages/translation/src/lang/nl.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Wachtwoord",
-        "requirement": {
+        "suggestion": {
           "length": "Bevat ten minste 8 tekens",
           "lowercase": "Inclusief kleine letter",
           "uppercase": "Inclusief hoofdletter",

packages/translation/src/lang/no.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Passord",
-        "requirement": {
+        "suggestion": {
           "length": "Inkluderer minst 8 tegn",
           "lowercase": "Inkluderer liten bokstav",
           "uppercase": "Inkluderer stor bokstav",

packages/translation/src/lang/pl.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Hasło",
-        "requirement": {
+        "suggestion": {
           "length": "Zawiera co najmniej 8 znaków",
           "lowercase": "Zawiera małą literę",
           "uppercase": "Zawiera wielką literę",

packages/translation/src/lang/pt-br.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Senha",
-        "requirement": {
+        "suggestion": {
           "length": "Inclua pelo menos 8 caracteres",
           "lowercase": "Inclui letras minúsculas",
           "uppercase": "Inclui letras maiúsculas",

packages/translation/src/lang/pt.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "",
-        "requirement": {
+        "suggestion": {
           "length": "",
           "lowercase": "",
           "uppercase": "",

packages/translation/src/lang/ro.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Parola",
-        "requirement": {
+        "suggestion": {
           "length": "",
           "lowercase": "Să includă litere mici",
           "uppercase": "Să includă litere mari",

packages/translation/src/lang/ru.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Пароль",
-        "requirement": {
+        "suggestion": {
           "length": "Содержит не менее 8 символов",
           "lowercase": "Содержит строчную букву",
           "uppercase": "Содержит заглавную букву",

packages/translation/src/lang/sk.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Heslo",
-        "requirement": {
+        "suggestion": {
           "length": "Obsahuje aspoň 8 znakov",
           "lowercase": "Zahŕňa malé písmeno",
           "uppercase": "Zahŕňa veľké písmená",

packages/translation/src/lang/sl.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Geslo",
-        "requirement": {
+        "suggestion": {
           "length": "",
           "lowercase": "Vključuje male črke",
           "uppercase": "Vključuje velike tiskane črke",

packages/translation/src/lang/sv.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Lösenord",
-        "requirement": {
+        "suggestion": {
           "length": "Använd minst 8 tecken",
           "lowercase": "Använd liten bokstav",
           "uppercase": "Använd stor bokstav",

packages/translation/src/lang/tr.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Şifre",
-        "requirement": {
+        "suggestion": {
           "length": "En az 8 karakter içermeli",
           "lowercase": "Küçük harf içermeli",
           "uppercase": "Büyük harf içermeli",

packages/translation/src/lang/uk.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Пароль",
-        "requirement": {
+        "suggestion": {
           "length": "Включає принаймні 8 символів",
           "lowercase": "Включає малу літеру",
           "uppercase": "Включає велику літеру",

packages/translation/src/lang/vi.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "Mật khẩu",
-        "requirement": {
+        "suggestion": {
           "length": "Bao gồm ít nhất 8 kí tự",
           "lowercase": "Bao gồm chữ thường",
           "uppercase": "Bao gồm chữ in hoa",

packages/translation/src/lang/zh.json

@@ -132,7 +132,7 @@
       },
       "password": {
         "label": "密碼",
-        "requirement": {
+        "suggestion": {
           "length": "至少包含 8 個字符",
           "lowercase": "包含小寫字母",
           "uppercase": "包含大寫字母",

packages/ui/src/components/password-input/password-input.tsx

@@ -20,15 +20,15 @@ export const CustomPasswordInput = ({ withPasswordRequirements, ...props }: Cust
 };
 
 const WithPasswordRequirements = (props: PasswordInputProps) => {
-  const [value, setValue] = useState("");
+  const [password, setPassword] = useState("");
 
   const onChange = (event: ChangeEvent<HTMLInputElement>) => {
-    setValue(event.currentTarget.value);
+    setPassword(event.currentTarget.value);
     props.onChange?.(event);
   };
 
   return (
-    <PasswordRequirementsPopover password={value}>
+    <PasswordRequirementsPopover password={password}>
       <PasswordInput {...props} onChange={onChange} />
     </PasswordRequirementsPopover>
   );

packages/ui/src/components/password-input/password-requirement.tsx

@@ -1,14 +1,19 @@
 import { rem, Text } from "@mantine/core";
-import { IconCheck, IconX } from "@tabler/icons-react";
+import { IconCheck, IconPoint } from "@tabler/icons-react";
+
+const getRequirementDisplay = (meets: boolean) =>
+  ({
+    true: { color: "teal", Icon: IconCheck },
+    false: { color: "dimmed", Icon: IconPoint },
+  })[String(meets) as "true" | "false"];
 
 export function PasswordRequirement({ meets, label }: { meets: boolean; label: string }) {
+  const display = getRequirementDisplay(meets);
+  const Icon = display.Icon;
+
   return (
-    <Text c={meets ? "teal" : "red"} display="flex" style={{ alignItems: "center" }} size="sm">
-      {meets ? (
-        <IconCheck style={{ width: rem(14), height: rem(14) }} />
-      ) : (
-        <IconX style={{ width: rem(14), height: rem(14) }} />
-      )}
+    <Text c={display.color} display="flex" style={{ alignItems: "center" }} size="sm">
+      <Icon style={{ width: rem(14), height: rem(14) }} />
       <Text span ml={10}>
         {label}
       </Text>

packages/ui/src/components/password-input/password-requirements-popover.tsx

@@ -1,16 +1,24 @@
 import type { PropsWithChildren } from "react";
 import { useState } from "react";
-import { Popover, Progress } from "@mantine/core";
+import { Popover, Progress, Text } from "@mantine/core";
 
 import { useScopedI18n } from "@homarr/translation/client";
 import { passwordRequirements } from "@homarr/validation/user";
 
 import { PasswordRequirement } from "./password-requirement";
 
+const strengthColorMap = [
+  { min: 100, color: "teal" },
+  { min: 51, color: "yellow" },
+  { min: 0, color: "dimmed" },
+] as const;
+
 export const PasswordRequirementsPopover = ({ password, children }: PropsWithChildren<{ password: string }>) => {
+  const tPassword = useScopedI18n("user.field.password");
   const requirements = useRequirements();
   const strength = useStrength(password);
   const [popoverOpened, setPopoverOpened] = useState(false);
+  const strengthColor = strengthColorMap.find(({ min }) => strength >= min)?.color ?? "dimmed";
   const checks = (
     <>
       {requirements.map((requirement) => (
@@ -19,8 +27,6 @@ export const PasswordRequirementsPopover = ({ password, children }: PropsWithChi
     </>
   );
 
-  const color = strength === 100 ? "teal" : strength > 50 ? "yellow" : "red";
-
   return (
     <Popover opened={popoverOpened} position="bottom" width="target" transitionProps={{ transition: "pop" }}>
       <Popover.Target>
@@ -29,7 +35,10 @@ export const PasswordRequirementsPopover = ({ password, children }: PropsWithChi
         </div>
       </Popover.Target>
       <Popover.Dropdown>
-        <Progress color={color} value={strength} size={5} mb="xs" />
+        <Progress color={strengthColor} value={strength} size={5} mb="xs" />
+        <Text size="sm" c="dimmed" mb="xs">
+          {tPassword("suggestionsTitle")}
+        </Text>
         {checks}
       </Popover.Dropdown>
     </Popover>
@@ -37,7 +46,7 @@ export const PasswordRequirementsPopover = ({ password, children }: PropsWithChi
 };
 
 const useRequirements = () => {
-  const t = useScopedI18n("user.field.password.requirement");
+  const t = useScopedI18n("user.field.password.suggestion");
 
   return passwordRequirements.map(({ check, value }) => ({ check, label: t(value) }));
 };

packages/validation/src/user.ts

@@ -19,24 +19,10 @@ export const passwordRequirements = [
   { check: regexCheck(/[$&+,:;=?@#|'<>.^*()%!\-~`"_/\\[\]{}]/), value: "special" },
 ] satisfies {
   check: (value: string) => boolean;
-  value: keyof TranslationObject["user"]["field"]["password"]["requirement"];
+  value: keyof TranslationObject["user"]["field"]["password"]["suggestion"];
 }[];
 
-export const userPasswordSchema = z
-  .string()
-  .min(8)
-  .max(255)
-  .refine(
-    (value) => {
-      return passwordRequirements.every((requirement) => requirement.check(value));
-    },
-    {
-      params: createCustomErrorParams({
-        key: "passwordRequirements",
-        params: {},
-      }),
-    },
-  );
+export const userPasswordSchema = z.string().min(8).max(255);
 
 const addConfirmPasswordRefinement = <
   TSchema extends z.ZodObject<{ password: z.core.$ZodString; confirmPassword: z.core.$ZodString }, z.core.$strip>,