Repository navigation
KC-1423: fix validation for passwords and passphrase in record creation and updation, and apply domain-specific policies to manual passwords and passphrases - #2453
Merged
sshrushanth-ks merged 5 commits intoOct 30, 2026
Conversation
Select generator policies by record URL and validate generated passwords and passphrases with their respective rules. Apply explicit domain policies to manually entered passwords and passphrases, while leaving manual entries unchecked when no domain policy matches. Cover record add and update flows, including legacy and nested records. Add regression tests for policy selection and manual password validation.
Normalize passphrase words to NFC and accept Unicode letters during manual passphrase validation. Remove the unused NSF field resolver and add regression coverage for domain-policy enforcement in NSF updates.
sshrushanth-ks
requested review from
adeshmukh-ks,
amangalampalli-ks,
pvagare-ks and
sali-ks
October 22, 2026 07:09
sshrushanth-ks
marked this pull request as ready for review
October 22, 2026 07:11
passphrase intent from separators. Keep passphrase rules for generated passphrases and add regression coverage for hyphenated passwords.
sali-ks
approved these changes
Oct 23, 2026
Use matching domain settings for passphrase generation and allow manual entries that satisfy the domain’s password or permitted passphrase rules. Prefer the primary record URL, add a policy override for legacy edits, and revalidate manual passwords on NSF update retries. Add regression coverage for policy selection, URL precedence, overrides, and retry validation.
amangalampalli-ks
approved these changes
Oct 30, 2026
pvagare-ks
approved these changes
Oct 30, 2026
sshrushanth-ks
merged commit Oct 30, 2026
0465a0a
into
passphrase-policy-validation-fix
4 checks passed
sshrushanth-ks
added a commit
that referenced
this pull request
Oct 30, 2026
…on and updation, and apply domain-specific policies to manual passwords and passphrases (#2453) * fix validation for passwords and passphrase in record creation and updation * Apply domain-specific policies to generated and manual passwords Select generator policies by record URL and validate generated passwords and passphrases with their respective rules. Apply explicit domain policies to manually entered passwords and passphrases, while leaving manual entries unchecked when no domain policy matches. Cover record add and update flows, including legacy and nested records. Add regression tests for policy selection and manual password validation. * Handle Unicode passphrases in domain policy validation Normalize passphrase words to NFC and accept Unicode letters during manual passphrase validation. Remove the unused NSF field resolver and add regression coverage for domain-policy enforcement in NSF updates. * Apply domain password rules to manual entries without inferring passphrase intent from separators. Keep passphrase rules for generated passphrases and add regression coverage for hyphenated passwords. * Addressed review comments: Use matching domain settings for passphrase generation and allow manual entries that satisfy the domain’s password or permitted passphrase rules. Prefer the primary record URL, add a policy override for legacy edits, and revalidate manual passwords on NSF update retries. Add regression coverage for policy selection, URL precedence, overrides, and retry validation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Apply password complexity rules to generated passwords, passphrase rules to generated passphrases, and matching domain-specific policies to manually entered passwords and passphrases. Manual entries are not checked against generator defaults when no domain policy matches.
Changes
--forceoverride.