{"record":{"id":"40efdd84e06748b6","repo":"puppetlabs/puppet","slug":"password-minimum-age-must-be-provided-as-a-number","errorCode":null,"errorMessage":"Password minimum age must be provided as a number.","messagePattern":"Password minimum age must be provided as a number\\.","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/type/user.rb","lineNumber":297,"sourceCode":"\n      sensitive true\n    end\n\n    newproperty(:password_min_age, :required_features => :manages_password_age) do\n      desc \"The minimum number of days a password must be used before it may be changed.\"\n\n      munge do |value|\n        case value\n        when String\n          Integer(value)\n        else\n          value\n        end\n      end\n\n      validate do |value|\n        if value.to_s !~ /^-?\\d+$/\n          raise ArgumentError, _(\"Password minimum age must be provided as a number.\")\n        end\n      end\n    end\n\n    newproperty(:password_max_age, :required_features => :manages_password_age) do\n      desc \"The maximum number of days a password may be used before it must be changed.\"\n\n      munge do |value|\n        case value\n        when String\n          Integer(value)\n        else\n          value\n        end\n      end\n\n      validate do |value|\n        if value.to_s !~ /^-?\\d+$/","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/type/user.rb#L279-L315","documentation":"The user type's `password_min_age` property (days before a password may be changed; maps to chage -m) validates that the value's string form matches /^-?\\d+$/ (lib/puppet/type/user.rb:297); strings are munged via Integer(). Words, decimals, or empty strings raise ArgumentError.","triggerScenarios":"`password_min_age => '7 days'`; `=> 0.5`; `=> ''`; arrays. Negative values pass validation (regex allows a minus) and are passed through to chage, which may then fail.","commonSituations":"Unit confusion ('7 days' vs 7); float data from external HR systems; empty Hiera keys resolving to '' instead of undef.","solutions":["Pass an integer or integer string, e.g. password_min_age => 7","Cast/clean the upstream data (Integer($min_age)) before assigning","Leave the parameter unset rather than '' when there is no policy"],"exampleFix":"# before\nuser { 'alice':\n  ensure           => present,\n  password_min_age => '7 days',\n}\n\n# after\nuser { 'alice':\n  ensure           => present,\n  password_min_age => 7,\n}","handlingStrategy":"validation","validationCode":"if $password_min_age != undef and \"$password_min_age\" !~ /^-?\\d+$/ {\n  fail('password_min_age must be an integer (days)')\n}","typeGuard":"def valid_age?(v)\n  v.is_a?(Integer) || (v.is_a?(String) && v =~ /\\A-?\\d+\\z/)\nend","tryCatchPattern":"begin\n  Puppet::Type.type(:user).new(name: 'a', password_min_age: '7 days')\nrescue ArgumentError => e\n  raise unless e.message.include?('minimum age')\n  # Integer()-cast the days value and rebuild\nend","preventionTips":["Type policy parameters as Integer in Puppet signatures","Normalize '' to undef in lookup layers","Remember units are whole days for chage-backed properties"],"tags":["puppet","user","password-policy","invalid-value"],"backgroundTag":"invalid-number-format","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}