type

PasswordPolicy

type PasswordPolicy struct {
	// MinLength is the minimum password length in Unicode code points. Zero
	// defaults to 8.
	MinLength int
	// MaxBytes is the maximum UTF-8 encoded password length. Zero defaults to 72,
	// bcrypt's safe input limit.
	MaxBytes int
	// BcryptCost controls bcrypt work. Zero uses bcrypt.DefaultCost. Increasing
	// it transparently upgrades older hashes after a successful login. Values
	// above 16 are rejected because they can make startup and login impractical.
	BcryptCost int
	// Validate adds application-specific password rules. Return a user-safe error
	// explaining how the candidate must change.
	Validate func(password string) error
}

Built-in local password validation and hashing policy.

Source core/config.go:326

@param MinLength: Minimum Unicode code-point length; zero defaults to 8.
@param MaxBytes: Maximum UTF-8 byte length; zero defaults to bcrypt’s safe 72-byte limit.
@param BcryptCost: bcrypt work factor; zero uses bcrypt.DefaultCost and values above 16 are rejected.
@param Validate: Adds an application-specific rule and should return a user-safe correction message.

Ridu deliberately uses length-based defaults rather than mandatory character classes. The custom validator runs only in trusted Go code and is never serialized.