feat: add minimum password length and password requirements config

internal/start/start.go

@@ -506,6 +506,8 @@ EOF
 			fmt.Sprintf("GOTRUE_SMS_TEMPLATE=%v", utils.Config.Auth.Sms.Template),
 			"GOTRUE_SMS_TEST_OTP=" + testOTP.String(),
 
+			fmt.Sprintf("GOTRUE_PASSWORD_MIN_LENGTH=%v", utils.Config.Auth.MinimumPasswordLength),
+			fmt.Sprintf("GOTRUE_PASSWORD_REQUIRED_CHARACTERS=%v", utils.Config.Auth.PasswordRequirements),
 			fmt.Sprintf("GOTRUE_SECURITY_REFRESH_TOKEN_ROTATION_ENABLED=%v", utils.Config.Auth.EnableRefreshTokenRotation),
 			fmt.Sprintf("GOTRUE_SECURITY_REFRESH_TOKEN_REUSE_INTERVAL=%v", utils.Config.Auth.RefreshTokenReuseInterval),
 			fmt.Sprintf("GOTRUE_SECURITY_MANUAL_LINKING_ENABLED=%v", utils.Config.Auth.EnableManualLinking),

pkg/config/auth.go

@@ -18,6 +18,8 @@ type (
 		SiteUrl                    string   `toml:"site_url"`
 		AdditionalRedirectUrls     []string `toml:"additional_redirect_urls"`
 		JwtExpiry                  uint     `toml:"jwt_expiry"`
+		MinimumPasswordLength      uint     `toml:"minimum_password_length"`
+		PasswordRequirements       string   `toml:"password_requirements"`
 		EnableRefreshTokenRotation bool     `toml:"enable_refresh_token_rotation"`
 		RefreshTokenReuseInterval  uint     `toml:"refresh_token_reuse_interval"`
 		EnableManualLinking        bool     `toml:"enable_manual_linking"`

pkg/config/templates/config.toml

@@ -98,6 +98,13 @@ additional_redirect_urls = ["https://127.0.0.1:3000"]
 # How long tokens are valid for, in seconds. Defaults to 3600 (1 hour), maximum 604,800 (1 week).
 jwt_expiry = 3600
 # If disabled, the refresh token will never expire.
+minimum_password_length = 6
+# Passwords shorter than this value will be rejected as weak. Minimum 6, recommended 8 or more.
+password_requirements = ""
+# Passwords that do not have at least one of each will be rejected as weak.
+# Letters and digits: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789
+# Lowercase, uppercase letters and digits: abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789
+# Lowercase, uppercase letters, digits and symbols: abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789:!@#$%^&*()_+-=[]{};'\\\\:\"|<>?,./`~
 enable_refresh_token_rotation = true
 # Allows refresh tokens to be reused after expiry, up to the specified interval in seconds.
 # Requires enable_refresh_token_rotation = true.