password_check

Helpers for application-owned compromised-password screening. Load the corpus once at startup; no password is sent to a remote service.

Values

blocklist

</>

pub fn blocklist(
  passwords: List(String),
) -> fn(String) -> Result(Nil, service.Error)

Build a checker for a local breach corpus or application-specific blocklist. Store only SHA-256 digests in the lookup closure, and compare using the same NFC normalization as password hashing. The list is case-sensitive and not trimmed. This supplements the built-in common-password check.

let identity = auth.with_password_check(identity, password_check.blocklist(corpus))