rules:
  - id: auth.flow.password-min-length
    languages:
      - javascript
      - typescript
    severity: WARNING
    message: |
      A password validation schema is enforcing a minimum length of less
      than 8 characters. NIST SP 800-63B recommends ≥ 8 characters for
      user-chosen passwords (with NO mandatory complexity rules: length
      is the dominant strength factor). OWASP ASVS V2.1.1 requires ≥ 12
      for high-assurance applications.

      Common LLM-generated mistake: `password: z.string().min(6)` because
      "6 looks reasonable". It isn't. Bump the floor to 8 minimum, 12
      preferred.
    pattern-either:
      - patterns:
          # `$Z.string()` covers z./Joi./yup.; the 2-arg form catches the
          # common `.min(6, 'too short')` custom-message style.
          - pattern-either:
              - pattern: '$Z.string().min($N)'
              - pattern: '$Z.string().min($N, ...)'
          - metavariable-comparison:
              metavariable: $N
              comparison: $N < 8
          - pattern-inside: |
              { ..., password: ..., ... }
      - patterns:
          - pattern-regex: \b(?:password|pwd)\s*\.\s*length\s*[<≤]=?\s*[1-7]\b
    metadata:
      oauthlint-rule-id: AUTH-FLOW-005
      oauthlint-doc-url: https://oauthlint.dev/rules/flow-password-min-length
      category: security
      cwe: CWE-521
      owasp: API2:2023
      llm-prevalence: MEDIUM
      technology:
        - zod
        - joi
        - yup
      references:
        - https://pages.nist.gov/800-63-3/sp800-63b.html
        - https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html