bytebase/bytebase · warning

password must contains at least 1 number

Error message

password must contains at least 1 number

What it means

ValidatePassword checks restriction.RequireNumber: when enabled, the password must match the regex [0-9]+. This error means RequireNumber is on in workspace password restrictions but the submitted password contains no digit at all.

Source

Thrown at backend/common/password.go:18

//nolint:revive
package common

import (
	"regexp"

	"github.com/pkg/errors"

	storepb "github.com/bytebase/bytebase/backend/generated-go/store"
)

// ValidatePassword validates a password against the workspace password restrictions.
func ValidatePassword(password string, restriction *storepb.WorkspaceProfileSetting_PasswordRestriction) error {
	if len(password) < int(restriction.GetMinLength()) {
		return errors.Errorf("password length should no less than %v characters", restriction.GetMinLength())
	}
	if restriction.GetRequireNumber() && !regexp.MustCompile("[0-9]+").MatchString(password) {
		return errors.Errorf("password must contains at least 1 number")
	}
	if restriction.GetRequireLetter() && !regexp.MustCompile("[a-zA-Z]+").MatchString(password) {
		return errors.Errorf("password must contains at least 1 lower case letter")
	}
	if restriction.GetRequireUppercaseLetter() && !regexp.MustCompile("[A-Z]+").MatchString(password) {
		return errors.Errorf("password must contains at least 1 upper case letter")
	}
	if restriction.GetRequireSpecialCharacter() && !regexp.MustCompile(`[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]+`).MatchString(password) {
		return errors.Errorf("password must contains at least 1 special character")
	}
	return nil
}

View on GitHub (pinned to 1870550677)

Solutions

  1. Include at least one digit (0-9) in the password.
  2. Read the workspace password restriction settings first and generate/validate passwords that satisfy RequireNumber before calling the API.
  3. If the digit requirement is unwanted, have an admin disable RequireNumber in workspace settings.

Example fix

// before
password := "abcdefghij" // no digit
// after
password := "abcdefghj1" // contains a digit
Defensive patterns

Strategy: validation

Validate before calling

func hasDigit(s string) bool {
  return regexp.MustCompile("[0-9]+").MatchString(s)
}

Try / catch

if err := common.ValidatePassword(pwd, restriction); err != nil {
  return status.Errorf(codes.InvalidArgument, "password rejected: %s", err.Error())
}

Prevention

When it happens

Trigger: Password reset or creation (via ResetUserPassword / validatePasswordWithRestriction) submits a password with zero digits while WorkspaceProfileSetting_PasswordRestriction.RequireNumber is true.

Common situations: Admin enables "must contain number" and users' dictionary-style passwords fail; automated scripts generating passwords without digits; users enabling password managers that generate letters-only passwords is rare but policy config is often forgotten.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/5ac5a16c54ddf1b2. Report an issue: GitHub.