ruvnet/ruflo · error · PasswordHashError

INVALID_MIN_LENGTH

INVALID_MIN_LENGTH

Error message

Minimum password length must be at least 8 characters

What it means

The second constructor-time check in PasswordHasher: minLength < 8 throws PasswordHashError INVALID_MIN_LENGTH. This is the policy floor for passwords the hasher will accept (the validate() method enforces it per password); configuring it lower would let weak passwords through the module's own guarantees.

Source

Thrown at v3/@claude-flow/security/src/password-hasher.ts:121

      rounds: config.rounds ?? 12,
      minLength: config.minLength ?? 8,
      maxLength: config.maxLength ?? 128,
      requireUppercase: config.requireUppercase ?? true,
      requireLowercase: config.requireLowercase ?? true,
      requireDigit: config.requireDigit ?? true,
      requireSpecial: config.requireSpecial ?? false,
    };

    // Validate configuration
    if (this.config.rounds < 10 || this.config.rounds > 20) {
      throw new PasswordHashError(
        'Bcrypt rounds must be between 10 and 20 for security and performance balance',
        'INVALID_ROUNDS'
      );
    }

    if (this.config.minLength < 8) {
      throw new PasswordHashError(
        'Minimum password length must be at least 8 characters',
        'INVALID_MIN_LENGTH'
      );
    }
  }

  /**
   * Validates password against configured requirements.
   *
   * @param password - The password to validate
   * @returns Validation result with errors if any
   */
  validate(password: string): PasswordValidationResult {
    const errors: string[] = [];

    if (!password) {
      errors.push('Password is required');
      return { isValid: false, errors };

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Set minLength >= 8 (8 is the default), or omit the field
2. If a legacy 6-char policy exists, raise the policy — don't lower the hasher
3. Validate merged config objects once at startup so the throw carries full context

Example fix

// before
new PasswordHasher({ minLength: 6 });

// after
new PasswordHasher({ minLength: 8 });

if (cfg.minLength !== undefined && cfg.minLength < 8) {
  throw new Error(`minLength must be >= 8, got ${cfg.minLength} — raise the policy instead`);
}
new PasswordHasher(cfg);

function isPasswordHashError(e: unknown, code?: string): boolean {
  return e instanceof Error && e.name === 'PasswordHashError'
    && (code === undefined || (e as { code?: string }).code === code);
}

try {
  return new PasswordHasher(cfg);
} catch (e) {
  if (isPasswordHashError(e, 'INVALID_MIN_LENGTH')) {
    return new PasswordHasher({ ...cfg, minLength: 8 });
  }
  throw e;
}

When it happens

Trigger: new PasswordHasher({ minLength: 6 }) to satisfy a legacy 6-char policy; config reuse from a system whose minimum predates modern guidance; a zero/undefined value coercing low during config merges.

Common situations: Migrating from an old auth system with a 6-char minimum; product requirements clashing with the floor; env-driven config not validated before use.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• INVALID_PASSWORD_LENGTH
• INVALID_API_KEY_LENGTH
• INVALID_SECRET_LENGTH
• INVALID_ROUNDS
• Invalid completion type

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/9ed2957c6ed8f74b. Report an issue: GitHub.