{"record":{"id":"d185419dd2e254f6","repo":"toeverything/AFFiNE","slug":"invalid-password-length","errorCode":"invalid_password_length","errorMessage":"Password must be between ${min} and ${max} characters","messagePattern":"Password must be between (.+?) and (.+?) characters","errorType":"exception","errorClass":"InvalidPasswordLength","httpStatus":400,"severity":"warning","filePath":"packages/backend/server/src/core/utils/validators.ts","lineNumber":19,"sourceCode":"import z from 'zod';\n\nimport { InvalidEmail, InvalidPasswordLength } from '../../base';\n\nexport function assertValidEmail(email: string) {\n  const result = z.string().email().safeParse(email);\n  if (!result.success) {\n    throw new InvalidEmail({ email });\n  }\n}\n\nexport function assertValidPassword(\n  password: string,\n  { min, max }: { min: number; max: number }\n) {\n  const result = z.string().min(min).max(max).safeParse(password);\n\n  if (!result.success) {\n    throw new InvalidPasswordLength({ min, max });\n  }\n}\n\nexport const validators = {\n  assertValidEmail,\n  assertValidPassword,\n};\n","sourceCodeStart":1,"sourceCodeEnd":27,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/26c515e050211269e911f7d9cfe162a26c83ed98/packages/backend/server/src/core/utils/validators.ts#L1-L27","documentation":"Thrown by assertValidPassword() when the password's length falls outside the configured [min, max] bounds, as checked by zod's string().min(min).max(max). Bounds are passed in by the caller (typically from config), so the acceptable range depends on the deployment's password policy.","triggerScenarios":"assertValidPassword(value, { min, max }) is called with a password shorter than min or longer than max characters.","commonSituations":"Password below the configured minimum length; extremely long password exceeding the max (DoS guard); client-side length indicator missing or out of sync with server policy.","solutions":["Enforce the same min/max length on the client UI and show a live counter.","Ensure the min/max values passed to assertValidPassword match the displayed policy.","Trim only unintentional whitespace if your policy treats leading/trailing spaces as accidental."],"exampleFix":"// before\nassertValidPassword(pw, { min: 8, max: 256 });\n\n// after — keep client UI in sync with the same bounds\n<input type=\"password\" minlength={8} maxlength={256} />","handlingStrategy":"validation","validationCode":"if (password.length < MIN || password.length > MAX) { showLengthError(MIN, MAX); return; }","typeGuard":"function isPasswordWithinBounds(password: string, min: number, max: number): boolean {\n  return password.length >= min && password.length <= max;\n}","tryCatchPattern":"try {\n  assertValidPassword(password, { min, max });\n} catch (e) {\n  if (e?.code === 'invalid_password_length') { showLengthHint(); return; }\n  throw e;\n}","preventionTips":["Mirror the server's min/max in the client UI with a live counter.","Pass the same bounds to assertValidPassword that you display.","Validate length before submitting the form."],"tags":["validation","password","zod","auth"],"backgroundTag":null,"analyzedSha":"26c515e050211269e911f7d9cfe162a26c83ed98","analyzedAt":"2026-08-12T13:15:16.447Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}