hyb-oa/server/src/utils/passwordPolicy.js

const zxcvbn = require("zxcvbn");

function validatePassword(password) {
  const errors = [];

  if (typeof password !== "string" || password.length < 12) {
    errors.push("密码长度必须 ≥ 12");
  }
  if (!/[a-z]/.test(password)) {
    errors.push("密码必须包含小写字母");
  }
  if (!/[A-Z]/.test(password)) {
    errors.push("密码必须包含大写字母");
  }
  if (!/[0-9]/.test(password)) {
    errors.push("密码必须包含数字");
  }

  const weakCheckEnabled = process.env.WEAK_PASSWORD_CHECK_ENABLED !== "false";
  const weakMinScore = Number(process.env.WEAK_PASSWORD_MIN_SCORE ?? 2);

  if (weakCheckEnabled && typeof password === "string" && password.length >= 1) {
    const score = zxcvbn(password).score ?? 0;
    if (score < weakMinScore) {
      errors.push("密码过于常见/弱");
    }
  }

  return errors;
}

module.exports = { validatePassword };