credentials.go RawHistoryFolder

1package user
2
3import "errors"
4
5// Credentials is an immutable value object for user credentials
6type Credentials struct {
7	userPassword string
8	rootPassword string
9}
10
11// NewCredentials creates new credentials with validation
12// rootPassword can be empty (root account will be locked, user uses sudo)
13func NewCredentials(userPassword, rootPassword string) (*Credentials, error) {
14	// Validate user password (required)
15	if err := ValidatePassword(userPassword); err != nil {
16		return nil, err
17	}
18
19	// Root password is optional - empty means root account locked
20	if rootPassword != "" {
21		if err := ValidatePassword(rootPassword); err != nil {
22			return nil, err
23		}
24		// Business rule: if root password set, it must differ from user password
25		if userPassword == rootPassword {
26			return nil, errors.New("user and root passwords must differ")
27		}
28	}
29
30	return &Credentials{
31		userPassword: userPassword,
32		rootPassword: rootPassword,
33	}, nil
34}
35
36// HasPassword returns true if password is set
37func (c *Credentials) HasPassword() bool {
38	return c.userPassword != "" && c.rootPassword != ""
39}
40
41// String returns a redacted representation
42func (c *Credentials) String() string {
43	return "Credentials(set=true)"
44}
45
46// ValidatePassword validates password strength
47func ValidatePassword(password string) error {
48	if password == "" {
49		return errors.New("password cannot be empty")
50	}
51
52	// Minimum 4 characters
53	if len(password) < 4 {
54		return errors.New("password must be at least 4 characters")
55	}
56
57	// Maximum 128 characters (reasonable limit)
58	if len(password) > 128 {
59		return errors.New("password cannot exceed 128 characters")
60	}
61
62	return nil
63}