Remove password from rego policy descriptions and Makefile

crates/handlers/src/views/register.rs

@@ -204,7 +204,7 @@ pub(crate) async fn post(
         }
 
         let res = policy
-            .evaluate_register(&form.username, &form.password, &form.email)
+            .evaluate_register(&form.username, &form.email)
             .await?;
 
         for violation in res.violations {

crates/policy/src/lib.rs

@@ -204,14 +204,9 @@ impl Policy {
     pub async fn evaluate_register(
         &mut self,
         username: &str,
-        password: &str,
         email: &str,
     ) -> Result<EvaluationResult, EvaluationError> {
-        let input = RegisterInput::Password {
-            username,
-            password,
-            email,
-        };
+        let input = RegisterInput::Password { username, email };
 
         let [res]: [EvaluationResult; 1] = self
             .instance
@@ -404,19 +399,19 @@ mod tests {
         let mut policy = factory.instantiate().await.unwrap();
 
         let res = policy
-            .evaluate_register("hello", "hunter2", "[email protected]")
+            .evaluate_register("hello", "[email protected]")
             .await
             .unwrap();
         assert!(!res.valid());
 
         let res = policy
-            .evaluate_register("hello", "hunter2", "[email protected]")
+            .evaluate_register("hello", "[email protected]")
             .await
             .unwrap();
         assert!(res.valid());
 
         let res = policy
-            .evaluate_register("hello", "hunter2", "[email protected]")
+            .evaluate_register("hello", "[email protected]")
             .await
             .unwrap();
         assert!(!res.valid());

crates/policy/src/model.rs

@@ -65,11 +65,7 @@ impl EvaluationResult {
 #[cfg_attr(feature = "jsonschema", derive(schemars::JsonSchema))]
 pub enum RegisterInput<'a> {
     #[serde(rename = "password")]
-    Password {
-        username: &'a str,
-        password: &'a str,
-        email: &'a str,
-    },
+    Password { username: &'a str, email: &'a str },
 
     #[serde(rename = "upstream-oauth2")]
     UpstreamOAuth2 {

frontend/src/gql/fragment-masking.ts

@@ -20,25 +20,45 @@ export function useFragment<TType>(
   _documentNode: DocumentTypeDecoration<TType, any>,
   fragmentType: FragmentType<DocumentTypeDecoration<TType, any>>
 ): TType;
+// return nullable if `fragmentType` is undefined
+export function useFragment<TType>(
+  _documentNode: DocumentTypeDecoration<TType, any>,
+  fragmentType: FragmentType<DocumentTypeDecoration<TType, any>> | undefined
+): TType | undefined;
 // return nullable if `fragmentType` is nullable
+export function useFragment<TType>(
+  _documentNode: DocumentTypeDecoration<TType, any>,
+  fragmentType: FragmentType<DocumentTypeDecoration<TType, any>> | null
+): TType | null;
+// return nullable if `fragmentType` is nullable or undefined
 export function useFragment<TType>(
   _documentNode: DocumentTypeDecoration<TType, any>,
   fragmentType: FragmentType<DocumentTypeDecoration<TType, any>> | null | undefined
 ): TType | null | undefined;
 // return array of non-nullable if `fragmentType` is array of non-nullable
+export function useFragment<TType>(
+  _documentNode: DocumentTypeDecoration<TType, any>,
+  fragmentType: Array<FragmentType<DocumentTypeDecoration<TType, any>>>
+): Array<TType>;
+// return array of nullable if `fragmentType` is array of nullable
+export function useFragment<TType>(
+  _documentNode: DocumentTypeDecoration<TType, any>,
+  fragmentType: Array<FragmentType<DocumentTypeDecoration<TType, any>>> | null | undefined
+): Array<TType> | null | undefined;
+// return readonly array of non-nullable if `fragmentType` is array of non-nullable
 export function useFragment<TType>(
   _documentNode: DocumentTypeDecoration<TType, any>,
   fragmentType: ReadonlyArray<FragmentType<DocumentTypeDecoration<TType, any>>>
 ): ReadonlyArray<TType>;
-// return array of nullable if `fragmentType` is array of nullable
+// return readonly array of nullable if `fragmentType` is array of nullable
 export function useFragment<TType>(
   _documentNode: DocumentTypeDecoration<TType, any>,
   fragmentType: ReadonlyArray<FragmentType<DocumentTypeDecoration<TType, any>>> | null | undefined
 ): ReadonlyArray<TType> | null | undefined;
 export function useFragment<TType>(
   _documentNode: DocumentTypeDecoration<TType, any>,
-  fragmentType: FragmentType<DocumentTypeDecoration<TType, any>> | ReadonlyArray<FragmentType<DocumentTypeDecoration<TType, any>>> | null | undefined
-): TType | ReadonlyArray<TType> | null | undefined {
+  fragmentType: FragmentType<DocumentTypeDecoration<TType, any>> | Array<FragmentType<DocumentTypeDecoration<TType, any>>> | ReadonlyArray<FragmentType<DocumentTypeDecoration<TType, any>>> | null | undefined
+): TType | Array<TType> | ReadonlyArray<TType> | null | undefined {
   return fragmentType as any;
 }
 

policies/Makefile

@@ -7,7 +7,6 @@ INPUTS := \
 	client_registration.rego \
 	register.rego \
 	authorization_grant.rego \
-	password.rego \
 	email.rego
 
 ifeq ($(DOCKER), 1)
@@ -27,7 +26,6 @@ policy.wasm: $(INPUTS)
 		-e "client_registration/violation" \
 		-e "register/violation" \
 		-e "authorization_grant/violation" \
-		-e "password/violation" \
 		-e "email/violation" \
 		$^
 	tar xzf bundle.tar.gz /policy.wasm

policies/register.rego

@@ -4,7 +4,6 @@
 package register
 
 import data.email as email_policy
-import data.password as password_policy
 
 import future.keywords.in
 
@@ -34,14 +33,6 @@ violation[{"msg": "unknown registration method"}] {
 	not input.registration_method in ["password", "upstream-oauth2"]
 }
 
-violation[object.union({"field": "password"}, v)] {
-	# Check if the registration method is password
-	input.registration_method == "password"
-
-	# Get the violation object from the password policy
-	some v in password_policy.violation
-}
-
 # Check that we supplied an email for password registration
 violation[{"field": "email", "msg": "email required for password-based registration"}] {
 	input.registration_method == "password"

policies/register_test.rego

@@ -3,7 +3,6 @@ package register
 mock_registration := {
 	"registration_method": "password",
 	"username": "hello",
-	"password": "Hunter2",
 	"email": "[email protected]",
 }
 
@@ -51,39 +50,3 @@ test_long_username {
 test_invalid_username {
 	not allow with input as {"username": "hello world", "registration_method": "upstream-oauth2"}
 }
-
-test_password_require_number {
-	allow with input as mock_registration
-		with data.passwords.require_number as true
-
-	not allow with input as mock_registration
-		with input.password as "hunter"
-		with data.passwords.require_number as true
-}
-
-test_password_require_lowercase {
-	allow with input as mock_registration
-		with data.passwords.require_lowercase as true
-
-	not allow with input as mock_registration
-		with input.password as "HUNTER2"
-		with data.passwords.require_lowercase as true
-}
-
-test_password_require_uppercase {
-	allow with input as mock_registration
-		with data.passwords.require_uppercase as true
-
-	not allow with input as mock_registration
-		with input.password as "hunter2"
-		with data.passwords.require_uppercase as true
-}
-
-test_password_min_length {
-	allow with input as mock_registration
-		with data.passwords.min_length as 6
-
-	not allow with input as mock_registration
-		with input.password as "short"
-		with data.passwords.min_length as 6
-}

policies/schema/register_input.json

@@ -7,7 +7,6 @@
       "type": "object",
       "required": [
         "email",
-        "password",
         "registration_method",
         "username"
       ],
@@ -21,9 +20,6 @@
         "username": {
           "type": "string"
         },
-        "password": {
-          "type": "string"
-        },
         "email": {
           "type": "string"
         }