[Bug?]: dbAuth handler resePasword does not validate password format as signup does

[irg1008]

What's not working?

dbAuth handler resePasword does not validate password format as signup does

Basically on signUp handler we can set a custom password validation like for exmaple:

...
    passwordValidation: (password) => {
      validate(password, 'password', {
        length: { minimum: 8 },
        format: {
          pattern: /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/,
          message:
            'Password must contain at least 1 uppercase letter, 1 lowercase letter, and 1 number',
        },
      })

      return true
    },
...

But then in the "resetPassword" handler the password is set to the database as it comes from the client, be that a simple number....

We should be able to validate the password somehow, maybe using the same passwordValidation as sign up since that makes sense

How do we reproduce the bug?

No response

What's your environment? (If it applies)

No response

Are you interested in working on this?

• I'm interested in working on this

[dac09]

Hello @irg1008 thanks for raising this, and I can confirm that you cannot currenly customise the validation function on the server side for reset password.

@cannikin I looked through the dbAuth handler, and it would be relatively straightforward (I think!) to call the options - (this.options.signup as SignupFlowOptions).passwordValidation in the forgot password flow too.

If you have time, do you think you could look at this one please?

[irg1008]

I think I can do this no problem

[irg1008]

Okay I just created de PR. Check it out if you find the time. Could this mean breaking changes since could affect some users bussiness logic?

[Josh-Walker-GM]

This was closed by #10734 or is there more work to be done on this?