toeverything/AFFiNE · warning · InvalidPasswordLength

invalid_password_length

invalid_password_length

Error message

Password must be between ${min} and ${max} characters

What it means

Thrown by assertValidPassword() when the password's length falls outside the configured [min, max] bounds, as checked by zod's string().min(min).max(max). Bounds are passed in by the caller (typically from config), so the acceptable range depends on the deployment's password policy.

Source

Thrown at packages/backend/server/src/core/utils/validators.ts:19

import z from 'zod';

import { InvalidEmail, InvalidPasswordLength } from '../../base';

export function assertValidEmail(email: string) {
  const result = z.string().email().safeParse(email);
  if (!result.success) {
    throw new InvalidEmail({ email });
  }
}

export function assertValidPassword(
  password: string,
  { min, max }: { min: number; max: number }
) {
  const result = z.string().min(min).max(max).safeParse(password);

  if (!result.success) {
    throw new InvalidPasswordLength({ min, max });
  }
}

export const validators = {
  assertValidEmail,
  assertValidPassword,
};

View on GitHub (pinned to 26c515e050)

Solutions

1. Enforce the same min/max length on the client UI and show a live counter.
2. Ensure the min/max values passed to assertValidPassword match the displayed policy.
3. Trim only unintentional whitespace if your policy treats leading/trailing spaces as accidental.

Example fix

// before
assertValidPassword(pw, { min: 8, max: 256 });

// after — keep client UI in sync with the same bounds
<input type="password" minlength={8} maxlength={256} />

if (password.length < MIN || password.length > MAX) { showLengthError(MIN, MAX); return; }

function isPasswordWithinBounds(password: string, min: number, max: number): boolean {
  return password.length >= min && password.length <= max;
}

try {
  assertValidPassword(password, { min, max });
} catch (e) {
  if (e?.code === 'invalid_password_length') { showLengthHint(); return; }
  throw e;
}

When it happens

Trigger: assertValidPassword(value, { min, max }) is called with a password shorter than min or longer than max characters.

Common situations: Password below the configured minimum length; extremely long password exceeding the max (DoS guard); client-side length indicator missing or out of sync with server policy.

Related errors

• invalid_email
• Invalid config for module [${module}] with key [${key}] Valu
• invalid_email_token
• link_expired
• invalid_email_token

AI-assisted analysis of toeverything/AFFiNE@26c515e050 (2026-08-12). Data as JSON: /api/errors/d185419dd2e254f6. Report an issue: GitHub.