WEB-628: Standardize password validation using environment-driven min length and regex configuration (#3234)

YousufFFFF · web-flow · commit 7a9c25ef7454 · 2026-02-27T11:39:51.000-06:00
WEB-628: Sanitize minPasswordLength to positive integer
diff --git a/src/app/core/utils/passwords-utility.ts b/src/app/core/utils/passwords-utility.ts
@@ -16,11 +16,11 @@ import { environment } from '../../../environments/environment';
   providedIn: 'root'
 })
 export class PasswordsUtility {
-  minPasswordLength: number = environment.minPasswordLength || 12;
-  public static PASSWORD_REGEX =
-    '^(?!.*(.)\\1)(?!.*\\s)(?=.*\\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[^\\w\\s]).{' +
-    (environment.minPasswordLength || 12) +
-    ',50}$';
+  minPasswordLength: number = environment.minPasswordLength;
+  private static readonly DEFAULT_PASSWORD_REGEX =
+    '^(?!.*(.)\\1)(?!.*\\s)(?=.*\\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[^\\w\\s]).{8,50}$';
+
+  public static PASSWORD_REGEX = environment.passwordRegex || PasswordsUtility.DEFAULT_PASSWORD_REGEX;
 
   public getPasswordValidators(): ValidatorFn[] {
     return [
diff --git a/src/app/login/login-form/login-form.component.html b/src/app/login/login-form/login-form.component.html
@@ -57,7 +57,19 @@
         @if (loginForm.controls.password.hasError('required')) {
           <mat-error>
             {{ 'labels.inputs.Password' | translate }}
-            <strong>{{ 'labels.commons.pass is required' | translate }}</strong>
+            <strong>
+              {{ 'labels.commons.pass is required' | translate: { min: minPasswordLength } }}
+            </strong>
+          </mat-error>
+        } @else if (loginForm.controls.password.hasError('minlength')) {
+          <mat-error>
+            {{
+              'Password is required'
+                | translate
+                  : {
+                      min: loginForm.controls.password.errors?.minlength?.requiredLength
+                    }
+            }}
           </mat-error>
         }
       </mat-form-field>
diff --git a/src/app/login/login-form/login-form.component.ts b/src/app/login/login-form/login-form.component.ts
@@ -43,6 +43,7 @@ import { environment } from '../../../environments/environment';
 export class LoginFormComponent implements OnInit {
   private formBuilder = inject(FormBuilder);
   private authenticationService = inject(AuthenticationService);
+  minPasswordLength = environment.minPasswordLength;
 
   /** Login form group. */
   loginForm: FormGroup;
@@ -126,7 +127,7 @@ export class LoginFormComponent implements OnInit {
         '',
         [
           Validators.required,
-          Validators.minLength(8)
+          Validators.minLength(environment.minPasswordLength)
         ]
       ],
       remember: false
@@ -144,9 +145,12 @@ export class LoginFormComponent implements OnInit {
     const control = this.loginForm.get(controlName);
     if (control?.hasError('required')) {
       return 'This field is required';
-    } else if (control?.hasError('minlength')) {
-      return `Minimum length is ${control.errors?.minlength.requiredLength}`;
     }
+    if (control?.hasError('minlength')) {
+      const requiredLength = control.errors?.['minlength']?.requiredLength;
+      return `Minimum length is ${requiredLength}`;
+    }
+
     return '';
   }
 }
diff --git a/src/assets/env.js b/src/assets/env.js
@@ -112,6 +112,9 @@
   window['env']['externalNationalIdSystemApiKey'] = '';
   window['env']['externalNationalIdRegex'] = '';
 
+  // Password Configuration
+  window['env']['minPasswordLength'] = 8;
+
   // OIDC Plugin Environment variables
   window['env']['oidcServerEnabled'] = false;
   window['env']['oidcBaseUrl'] = '';
diff --git a/src/assets/env.template.js b/src/assets/env.template.js
@@ -91,6 +91,9 @@
   // Min Password length
   window['env']['minPasswordLength'] = '$MIFOS_MIN_PASSWORD_LENGTH';
 
+  // Password Regex
+  window['env']['minPasswordLength'] = '$MIFOS_MIN_PASSWORD_LENGTH';
+
   // Enable or Disable HTTP Cache
   window['env']['httpCacheEnabled'] = '$MIFOS_HTTP_CACHE_ENABLED';
 
diff --git a/src/assets/translations/cs-CS.json b/src/assets/translations/cs-CS.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "Výše úpravy poplatku za odkoupení musí být nižší nebo rovna",
     "Email not valid": "Email není platný",
     "Filling Details": "Kliknutím začněte vyplňovat podrobnosti. * pole označení jsou nezbytná. Pro více podrobností klikněte na:",
-    "Password is required": "Je vyžadováno heslo",
+    "Password is required": "Je vyžadováno heslo (minimální délka {{min}} znaků)",
     "Searched query resulted more than 200 records": "Výsledkem hledaného dotazu bylo více než 200 záznamů, přičemž prvních 200 záznamů bylo zobrazeno.",
     "Username is required": "Uživatelské jméno je povinné",
     "Username or password incorrect.": "Nesprávné uživatelské jméno nebo heslo",
diff --git a/src/assets/translations/de-DE.json b/src/assets/translations/de-DE.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "Der Anpassungsbetrag der Ankaufsgebühr muss niedriger oder gleich sein als",
     "Email not valid": "E-Mail ungültig",
     "Filling Details": "Klicken Sie hier, um mit dem Ausfüllen der Details zu beginnen. * Markierungsfelder sind erforderlich. Für weitere Details klicken Sie:",
-    "Password is required": "Passwort wird benötigt",
+    "Password is required": "Passwort wird benötigt (Mindestlänge {{min}} Zeichen)",
     "Searched query resulted more than 200 records": "Die Suchanfrage ergab mehr als 200 Datensätze, wobei die ersten 200 Datensätze angezeigt wurden.",
     "Username is required": "Benutzername wird benötigt",
     "Username or password incorrect.": "Benutzername oder Passwort falsch",
diff --git a/src/assets/translations/en-US.json b/src/assets/translations/en-US.json
@@ -907,7 +907,7 @@
       "is": "is",
       "Is": "is",
       "is required": "is required",
-      "pass is required": "is required(min length 12)",
+      "pass is required": "is required (min length {{min}})",
       "least one uppercase": "least one uppercase",
       "lowercase and special character": "lowercase and special character",
       "must be": "must be",
diff --git a/src/assets/translations/es-CL.json b/src/assets/translations/es-CL.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "El importe del ajuste de la cuota de readquisición debe ser igual o inferior a",
     "Email not valid": "Correo electrónico no válido",
     "Filling Details": "Haga clic para comenzar a completar los detalles. * Los campos de marca son necesarios. Para más detalles haga clic en:",
-    "Password is required": "se requiere contraseña",
+    "Password is required": "se requiere contraseña (longitud mínima {{min}})",
     "Searched query resulted more than 200 records": "La consulta buscada resultó en más de 200 registros, mostrando los primeros 200 registros.",
     "Username is required": "Se requiere nombre de usuario",
     "Username or password incorrect.": "Usuario o contraseña incorrectos",
diff --git a/src/assets/translations/es-MX.json b/src/assets/translations/es-MX.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "El importe del ajuste de la cuota de readquisición debe ser igual o inferior a",
     "Email not valid": "Correo electrónico no válido",
     "Filling Details": "Haga clic para comenzar a completar los detalles. * Los campos de marca son necesarios. Para más detalles haga clic en:",
-    "Password is required": "se requiere contraseña",
+    "Password is required": "se requiere contraseña (longitud mínima {{min}})",
     "Searched query resulted more than 200 records": "La consulta buscada resultó en más de 200 registros, mostrando los primeros 200 registros.",
     "Username is required": "Se requiere nombre de usuario",
     "Username or password incorrect.": "Usuario o contraseña incorrectos",
diff --git a/src/assets/translations/fr-FR.json b/src/assets/translations/fr-FR.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "Le montant de l'ajustement de la commission de rachat doit être inférieur ou égal à",
     "Email not valid": "E-mail non valide",
     "Filling Details": "Cliquez pour commencer à remplir les détails. * Les champs de marque sont nécessaires. Pour plus de détails, cliquez sur :",
-    "Password is required": "Mot de passe requis",
+    "Password is required": "Mot de passe requis (longueur minimale {{min}})",
     "Searched query resulted more than 200 records": "La requête recherchée a donné lieu à plus de 200 enregistrements, affichant les 200 premiers enregistrements.",
     "Username is required": "Nom d'utilisateur est nécessaire",
     "Username or password incorrect.": "Nom d'utilisateur ou mot de passe incorrect",
diff --git a/src/assets/translations/it-IT.json b/src/assets/translations/it-IT.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "L'importo della Buy Down Fee Adjustment deve essere inferiore o uguale a",
     "Email not valid": "E-mail non valida",
     "Filling Details": "Fare clic per iniziare a compilare i dettagli. *I campi contrassegnati sono obbligatori. Per maggiori dettagli clicca:",
-    "Password is required": "E 'richiesta la password",
+    "Password is required": "E 'richiesta la password (lunghezza minima {{min}})",
     "Searched query resulted more than 200 records": "La query cercata ha prodotto più di 200 record, mostrando i primi 200 record.",
     "Username is required": "è richiesto il nome utente",
     "Username or password incorrect.": "Nome utente o password errati",
diff --git a/src/assets/translations/ko-KO.json b/src/assets/translations/ko-KO.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "바이 다운 수수료 조정 금액은 다음보다 낮거나 같아야 합니다.",
     "Email not valid": "이메일이 유효하지 않습니다",
     "Filling Details": "세부정보 작성을 시작하려면 클릭하세요. * 표시 필드가 필요합니다. 자세한 내용을 보려면 다음을 클릭하세요.",
-    "Password is required": "비밀번호가 필요합니다",
+    "Password is required": "비밀번호가 필요합니다 (최소 길이 {{min}})",
     "Searched query resulted more than 200 records": "검색된 쿼리로 200개 이상의 레코드가 검색되었으며 처음 200개 레코드가 표시되었습니다.",
     "Username is required": "사용자 이름이 필요합니다",
     "Username or password incorrect.": "사용자 이름 또는 비밀번호가 잘못되었습니다.",
diff --git a/src/assets/translations/lt-LT.json b/src/assets/translations/lt-LT.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "Išpirkimo mokesčio koregavimo suma turi būti mažesnė arba lygi",
     "Email not valid": "El. pašto adresas negalioja",
     "Filling Details": "Spustelėkite norėdami pradėti pildyti išsamią informaciją. * žymėjimo laukai yra būtini. Norėdami gauti daugiau informacijos, spustelėkite:",
-    "Password is required": "reikalingas slaptazodis",
+    "Password is required": "reikalingas slaptazodis (minimali trukmė {{min}})",
     "Searched query resulted more than 200 records": "Atlikus paiešką buvo gauta daugiau nei 200 įrašų, o pirmieji 200 įrašų.",
     "Username is required": "Reikalingas vartotojo vardas",
     "Username or password incorrect.": "Neteisingas vartotojo vardas arba slaptažodis",
diff --git a/src/assets/translations/lv-LV.json b/src/assets/translations/lv-LV.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "Izpirkšanas maksas korekcijas summai jābūt mazākai vai vienādai ar",
     "Email not valid": "E-pasts nav derīgs",
     "Filling Details": "Noklikšķiniet, lai sāktu aizpildīt informāciju. * ir nepieciešami atzīmju lauki. Lai iegūtu sīkāku informāciju, noklikšķiniet:",
-    "Password is required": "nepieciešama parole",
+    "Password is required": "nepieciešama parole (minimālais garums {{min}})",
     "Searched query resulted more than 200 records": "Meklētais vaicājums radīja vairāk nekā 200 ierakstus, parādot pirmos 200 ierakstus.",
     "Username is required": "Nepieciešams lietotājvārds",
     "Username or password incorrect.": "Lietotājvārds vai parole ir nepareiza",
diff --git a/src/assets/translations/ne-NE.json b/src/assets/translations/ne-NE.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "खरिद शुल्क समायोजन रकम निम्न भन्दा कम वा बराबर हुनुपर्छ:",
     "Email not valid": "इमेल मान्य छैन",
     "Filling Details": "विवरणहरू भर्न सुरु गर्न क्लिक गर्नुहोस्। * मार्क क्षेत्रहरू आवश्यक छन्। थप विवरणहरूको लागि क्लिक गर्नुहोस्:",
-    "Password is required": "पासवर्ड आवश्यक छ",
+    "Password is required": "पासवर्ड आवश्यक छ (न्यूनतम लम्बाइ {{min}})",
     "Searched query resulted more than 200 records": "खोजी गरिएको क्वेरीको परिणाम 200 भन्दा बढी रेकर्डहरू, पहिलो 200 रेकर्डहरू देखाउँदै।",
     "Username is required": "प्रयोगकर्ता नाम आवश्यक छ",
     "Username or password incorrect.": "प्रयोगकर्ता नाम वा पासवर्ड गलत",
diff --git a/src/assets/translations/pt-PT.json b/src/assets/translations/pt-PT.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "O montante do ajustamento da comissão de compra deve ser inferior ou igual a",
     "Email not valid": "E-mail não válido",
     "Filling Details": "Clique para começar a preencher os dados. * os campos de marcação são necessários. Para mais detalhes clique:",
-    "Password is required": "Senha requerida",
+    "Password is required": "Senha requerida (comprimento mínimo {{min}})",
     "Searched query resulted more than 200 records": "A consulta pesquisada resultou em mais de 200 registros, mostrando os primeiros 200 registros.",
     "Username is required": "Nome de usuário é requerido",
     "Username or password incorrect.": "Nome de usuário ou senha incorretos",
diff --git a/src/assets/translations/sw-SW.json b/src/assets/translations/sw-SW.json
@@ -16,7 +16,7 @@
     "Buy Down Fee Adjustment amount must be lower or equal to": "Kiasi cha Marekebisho ya Ada ya Kununua Chini lazima kiwe cha chini au sawa na",
     "Email not valid": "Barua pepe si halali",
     "Filling Details": "Bofya ili kuanza kujaza maelezo. * maeneo ya alama ni muhimu. Kwa maelezo zaidi bofya:",
-    "Password is required": "Nenosiri linahitajika",
+    "Password is required": "Nenosiri linahitajika (urefu wa chini {{min}})",
     "Searched query resulted more than 200 records": "Hoja iliyotafutwa ilisababisha zaidi ya rekodi 200, kuonyesha rekodi 200 za kwanza.",
     "Username is required": "Jina la mtumiaji linahitajika",
     "Username or password incorrect.": "Jina la mtumiaji au nenosiri sio sahihi",
diff --git a/src/environments/environment.prod.ts b/src/environments/environment.prod.ts
@@ -14,6 +14,9 @@ const loadedEnv = window['env'] || {};
 const base = loadedEnv['fineractApiUrl'];
 const provider = loadedEnv['apiProvider'];
 
+const parsedMinLength = Number(loadedEnv.minPasswordLength);
+const resolvedMinPasswordLength = Number.isInteger(parsedMinLength) && parsedMinLength > 0 ? parsedMinLength : 8;
+
 export const environment = {
   production: true,
   version: env.mifos_x.version,
@@ -94,7 +97,10 @@ export const environment = {
   mifosRemittanceApiHeader: loadedEnv['mifosRemittanceApiClientHeader'] || '',
   mifosRemittanceApiKey: loadedEnv['mifosRemittanceApiClientKey'] || '',
 
-  minPasswordLength: loadedEnv['minPasswordLength'] || 12,
+  minPasswordLength: resolvedMinPasswordLength,
+  passwordRegex:
+    loadedEnv.passwordRegex ||
+    `^(?!.*(.)\\1)(?!.*\\s)(?=.*\\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[^\\w\\s]).{${resolvedMinPasswordLength},50}$`,
 
   /** External National ID System integration */
   enableExternalNationalIdSystem:
diff --git a/src/environments/environment.ts b/src/environments/environment.ts
@@ -17,6 +17,9 @@ import env from './.env';
 // The `window.env` object is loaded in the `index.html` file
 const loadedEnv = window.env || {};
 
+const parsedMinLength = Number(loadedEnv.minPasswordLength);
+const resolvedMinPasswordLength = Number.isInteger(parsedMinLength) && parsedMinLength > 0 ? parsedMinLength : 8;
+
 export const environment = {
   production: false,
   version: env.mifos_x.version,
@@ -108,7 +111,10 @@ export const environment = {
   externalNationalIdSystemApiKey: loadedEnv.externalNationalIdSystemApiKey || '',
   externalNationalIdRegex: loadedEnv.externalNationalIdRegex || '',
 
-  minPasswordLength: loadedEnv.minPasswordLength || 12,
+  minPasswordLength: resolvedMinPasswordLength,
+  passwordRegex:
+    loadedEnv.passwordRegex ||
+    `^(?!.*(.)\\1)(?!.*\\s)(?=.*\\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[^\\w\\s]).{${resolvedMinPasswordLength},50}$`,
 
   /**
    * Hide client data information (mask client names with *)

Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,7 @@ import { environment } from '../../../environments/environment';`
`43`	`43`	`export class LoginFormComponent implements OnInit {`
`44`	`44`	`private formBuilder = inject(FormBuilder);`
`45`	`45`	`private authenticationService = inject(AuthenticationService);`
	`46`	`+ minPasswordLength = environment.minPasswordLength;`
`46`	`47`
`47`	`48`	`/** Login form group. */`
`48`	`49`	`loginForm: FormGroup;`
`@@ -126,7 +127,7 @@ export class LoginFormComponent implements OnInit {`
`126`	`127`	`'',`
`127`	`128`	`[`
`128`	`129`	`Validators.required,`
`129`		`- Validators.minLength(8)`
	`130`	`+ Validators.minLength(environment.minPasswordLength)`
`130`	`131`	`]`
`131`	`132`	`],`
`132`	`133`	`remember: false`
`@@ -144,9 +145,12 @@ export class LoginFormComponent implements OnInit {`
`144`	`145`	`const control = this.loginForm.get(controlName);`
`145`	`146`	`if (control?.hasError('required')) {`
`146`	`147`	`return 'This field is required';`
`147`		`- } else if (control?.hasError('minlength')) {`
`148`		- return `Minimum length is ${control.errors?.minlength.requiredLength}`;
`149`	`148`	`}`
	`149`	`+ if (control?.hasError('minlength')) {`
	`150`	`+ const requiredLength = control.errors?.['minlength']?.requiredLength;`
	`151`	+ return `Minimum length is ${requiredLength}`;
	`152`	`+ }`
	`153`	`+`
`150`	`154`	`return '';`
`151`	`155`	`}`
`152`	`156`	`}`