# `PasswordPolicy`

The rules a password must meet (NIST SP 800-63B): the fewest characters, from 8 (15 where a password is the only factor), the most, at least 64, and whether a new password is checked against a list of breached ones. No composition rules and no expiry, as NIST says.

[Security](types.md#security); not ordered; since Jadpo 0.1.0.

## Make one

Build one from its fields, `PasswordPolicy { min_length: ...  max_length: ...  check_breached: ... }`.

Its parts keep these rules; a value that breaks one fails with the rule's name:

- `min_not_above_max`: `min_length <= max_length`

## Fields

| Field | Type |
|---|---|
| `min_length` | `Int` |
| `max_length` | `Int` |
| `check_breached` | `Bool` |

## Text, JSON and storage

It has no single text form, so `text.from` and `text.parse` don't take it. JSON sends an object of its parts.

| JSON |
|---|
| `{"min_length":15,"max_length":64,"check_breached":true}` |
| `{"min_length":8,"max_length":256,"check_breached":false}` |

It is stored in 3 columns, each named for the field, `_` and its suffix. This is `{"min_length":8,"max_length":256,"check_breached":false}`:

| Column | Type | Holds |
|---|---|---|
| `<field>_min_length` | `smallint` | `8` |
| `<field>_max_length` | `smallint` | `256` |
| `<field>_check_breached` | `boolean` | `FALSE` |

## Shown to people

`text.format(value, locale:)` shows it to people in their locale.

With `locale: Locale.en_gb`:

| Value | Shown |
|---|---|
| `{"min_length":"15","max_length":"64","check_breached":true}` | `15–64` |
| `{"min_length":"8","max_length":"256","check_breached":false}` | `8–256` |

## Operations

It has the contract's own operations: `text.format`, `json.read`, `json.write` and `==`. It isn't ordered, so `<` and sorting don't take it. [Every standard type meets one contract](../topics/every-standard-type-meets-one-contract.md) says how they work.