# `PasswordPolicy`

The rules a password must meet: how short, how long, and whether to check breached lists.

Use it in sign-in settings. It follows NIST's guidance, so there are no rules about capitals or symbols, and passwords don't expire.

## Shape

| Field | Type | Required? |
|---|---|---|
| `min_length` | `Int` | Yes |
| `max_length` | `Int` | Yes |
| `check_breached` | `Bool` | Yes |

Its parts keep these rules, and a value that breaks one fails with the rule's name:

- `min_not_above_max`: min_length <= max_length

## Example

```jadpo
PasswordPolicy { min_length: 15 max_length: 64 check_breached: true }
```

## Good to know

- The fewest is at least 8, and the most is at least 64.
- `==` tells you whether two are the same. `<` and `list.sort_by` don't take it, so sort by one of its parts instead.

## In JSON

An object of its parts, in a request, a response or `json.write`:

```json
{"min_length":15,"max_length":64,"check_breached":true}
{"min_length":8,"max_length":256,"check_breached":false}
```

## Details

<details>
<summary>Text form, storage, how it is shown, and operations</summary>

`PasswordPolicy` is in the group Security, and has been in Jadpo since 0.1.0.

### Text form

It has no single text form, so `text.from` and `text.parse` don't take it.

### How it is stored

It is stored in 3 columns, each named for the field, `_` and its suffix. This is `{"min_length":8,"max_length":256,"check_breached":false}`:

| Column | Type | Holds |
|---|---|---|
| `<field>_min_length` | `smallint` | `8` |
| `<field>_max_length` | `smallint` | `256` |
| `<field>_check_breached` | `boolean` | `FALSE` |

### How it is shown to people

`text.format(value, locale:)` shows it to people in their locale.

With `locale: Locale.en_gb`:

| Value | Shown |
|---|---|
| `{"min_length":"15","max_length":"64","check_breached":true}` | `15–64` |
| `{"min_length":"8","max_length":"256","check_breached":false}` | `8–256` |

### Operations

It also takes `text.format`, `json.read`, `json.write` and `==`. [How every standard type behaves](/docs/every-standard-type-meets-one-contract.md) says how they work.

</details>