From 49fc8dd5af302ccc0267d78ac84e20e21859c852 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20G=C3=B6pel?= <andre@andregoepel.de>
Date: Sat, 4 Jul 2026 21:57:34 +0800
Subject: [PATCH] fix: enforce 12-char minimum for admin password on Setup page
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Setup page advertised and client-validated a 6-character minimum,
while AndreGoepel.Marten.Identity already enforces RequiredLength = 12
server-side. The form passed local validation only to be rejected by
UserManager.CreateAsync.

Surface the real policy: inject IOptions<IdentityOptions>, drive the
RadzenLengthValidator from Password.RequiredLength (reflecting any
integrator override), and raise the InputModel floor to 12 — mirroring
the pattern used by the identity Blazor pages (ResetPassword, etc.).

Closes #56
---
 .../Components/Pages/Setup.razor                          | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/AndreGoepel.AppFoundation/Components/Pages/Setup.razor b/src/AndreGoepel.AppFoundation/Components/Pages/Setup.razor
index 536a2c6..be739c6 100644
--- a/src/AndreGoepel.AppFoundation/Components/Pages/Setup.razor
+++ b/src/AndreGoepel.AppFoundation/Components/Pages/Setup.razor
@@ -8,6 +8,7 @@
 @using AndreGoepel.AppFoundation
 @using Microsoft.AspNetCore.Identity
 @using Microsoft.AspNetCore.WebUtilities
+@using Microsoft.Extensions.Options
 @using global::Marten
 
 @inject IQuerySession QuerySession
@@ -20,6 +21,7 @@
 @inject NavigationManager NavigationManager
 @inject NotificationService NotificationService
 @inject LoginTokenProtector LoginTokens
+@inject IOptions<IdentityOptions> IdentityOptions
 
 <PageTitle>Initial Setup – nerdventures.blog</PageTitle>
 
@@ -49,7 +51,7 @@
                                 Name="Password"
                                 Style="width:100%" />
                 <RadzenRequiredValidator Component="Password" Text="Password is required" />
-                <RadzenLengthValidator Component="Password" Min="6" Text="At least 6 characters" />
+                <RadzenLengthValidator Component="Password" Min="@MinPasswordLength" Text="@($"At least {MinPasswordLength} characters")" />
             </RadzenStack>
         </RadzenStack>
 
@@ -85,6 +87,8 @@
     private InputModel Input { get; set; } = new();
     private bool isProcessing;
 
+    private int MinPasswordLength => IdentityOptions.Value.Password.RequiredLength;
+
     protected override async Task OnInitializedAsync()
     {
         if (await SetupCompletion.IsCompleteAsync(QuerySession))
@@ -199,7 +203,7 @@
         public string Email { get; set; } = "";
 
         [Required(ErrorMessage = "Password is required")]
-        [StringLength(100, MinimumLength = 6, ErrorMessage = "The {0} must be at least {2} and at max {1} characters long.")]
+        [StringLength(100, MinimumLength = 12, ErrorMessage = "The {0} must be at least {2} and at max {1} characters long.")]
         [DataType(DataType.Password)]
         public string Password { get; set; } = "";