From 2e8fd737afe144fe39fbd94c7dfe85a312460efd Mon Sep 17 00:00:00 2001
From: Athou <jeremiepanzer@gmail.com>
Date: Sat, 10 Jan 2026 17:53:05 +0100
Subject: [PATCH] remove complex password requirements (#1916)

---
 .../com/commafeed/CommaFeedApplication.java   |  2 +-
 .../com/commafeed/CommaFeedConfiguration.java |  6 ++---
 .../password/PasswordConstraintValidator.java | 27 +++----------------
 .../java/com/commafeed/TestConstants.java     |  2 +-
 .../com/commafeed/e2e/AuthentificationIT.java |  7 ++---
 5 files changed, 11 insertions(+), 33 deletions(-)

diff --git a/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java b/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
index 9c6331e7..9cecaf31 100644
--- a/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
+++ b/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
@@ -20,7 +20,7 @@ public class CommaFeedApplication {
 	private final CommaFeedConfiguration config;
 
 	public void start(@Observes StartupEvent ev) {
-		PasswordConstraintValidator.setStrict(config.users().strictPasswordPolicy());
+		PasswordConstraintValidator.setMinimumPasswordLength(config.users().minimumPasswordLength());
 
 		feedRefreshEngine.start();
 		taskScheduler.start();
diff --git a/commafeed-server/src/main/java/com/commafeed/CommaFeedConfiguration.java b/commafeed-server/src/main/java/com/commafeed/CommaFeedConfiguration.java
index 214a1943..269f0bd4 100644
--- a/commafeed-server/src/main/java/com/commafeed/CommaFeedConfiguration.java
+++ b/commafeed-server/src/main/java/com/commafeed/CommaFeedConfiguration.java
@@ -326,10 +326,10 @@ public interface CommaFeedConfiguration {
 		boolean allowRegistrations();
 
 		/**
-		 * Whether to enable strict password validation (1 uppercase char, 1 lowercase char, 1 digit, 1 special char).
+		 * Minimum password length for user accounts.
 		 */
-		@WithDefault("true")
-		boolean strictPasswordPolicy();
+		@WithDefault("4")
+		int minimumPasswordLength();
 
 		/**
 		 * Whether to create a demo account the first time the app starts.
diff --git a/commafeed-server/src/main/java/com/commafeed/security/password/PasswordConstraintValidator.java b/commafeed-server/src/main/java/com/commafeed/security/password/PasswordConstraintValidator.java
index 8045d0ed..34e84e2c 100644
--- a/commafeed-server/src/main/java/com/commafeed/security/password/PasswordConstraintValidator.java
+++ b/commafeed-server/src/main/java/com/commafeed/security/password/PasswordConstraintValidator.java
@@ -6,8 +6,6 @@ import jakarta.validation.ConstraintValidator;
 import jakarta.validation.ConstraintValidatorContext;
 
 import org.apache.commons.lang3.StringUtils;
-import org.passay.CharacterRule;
-import org.passay.EnglishCharacterData;
 import org.passay.LengthRule;
 import org.passay.PasswordData;
 import org.passay.PasswordValidator;
@@ -19,7 +17,7 @@ import lombok.Setter;
 public class PasswordConstraintValidator implements ConstraintValidator<ValidPassword, String> {
 
 	@Setter
-	private static boolean strict = true;
+	private static int minimumPasswordLength;
 
 	@Override
 	public void initialize(ValidPassword constraintAnnotation) {
@@ -32,7 +30,7 @@ public class PasswordConstraintValidator implements ConstraintValidator<ValidPas
 			return true;
 		}
 
-		PasswordValidator validator = strict ? buildStrictPasswordValidator() : buildLoosePasswordValidator();
+		PasswordValidator validator = buildPasswordValidator();
 		RuleResult result = validator.validate(new PasswordData(value));
 
 		if (result.isValid()) {
@@ -45,28 +43,11 @@ public class PasswordConstraintValidator implements ConstraintValidator<ValidPas
 		return false;
 	}
 
-	private PasswordValidator buildStrictPasswordValidator() {
+	private PasswordValidator buildPasswordValidator() {
 		return new PasswordValidator(
 				// length
-				new LengthRule(8, 256),
-				// 1 uppercase char
-				new CharacterRule(EnglishCharacterData.UpperCase, 1),
-				// 1 lowercase char
-				new CharacterRule(EnglishCharacterData.LowerCase, 1),
-				// 1 digit
-				new CharacterRule(EnglishCharacterData.Digit, 1),
-				// 1 special char
-				new CharacterRule(EnglishCharacterData.Special, 1),
+				new LengthRule(minimumPasswordLength, 256),
 				// no whitespace
 				new WhitespaceRule());
 	}
-
-	private PasswordValidator buildLoosePasswordValidator() {
-		return new PasswordValidator(
-				// length
-				new LengthRule(6, 256),
-				// no whitespace
-				new WhitespaceRule());
-	}
-
 }
diff --git a/commafeed-server/src/test/java/com/commafeed/TestConstants.java b/commafeed-server/src/test/java/com/commafeed/TestConstants.java
index 27404d19..91a28eeb 100644
--- a/commafeed-server/src/test/java/com/commafeed/TestConstants.java
+++ b/commafeed-server/src/test/java/com/commafeed/TestConstants.java
@@ -2,5 +2,5 @@ package com.commafeed;
 
 public class TestConstants {
 	public static final String ADMIN_USERNAME = "admin";
-	public static final String ADMIN_PASSWORD = "!Admin1234";
+	public static final String ADMIN_PASSWORD = "admin";
 }
diff --git a/commafeed-server/src/test/java/com/commafeed/e2e/AuthentificationIT.java b/commafeed-server/src/test/java/com/commafeed/e2e/AuthentificationIT.java
index b648b280..ecbf67dc 100644
--- a/commafeed-server/src/test/java/com/commafeed/e2e/AuthentificationIT.java
+++ b/commafeed-server/src/test/java/com/commafeed/e2e/AuthentificationIT.java
@@ -53,13 +53,10 @@ class AuthentificationIT {
 		Page page = context.newPage();
 		page.navigate(getLoginPageUrl());
 		page.getByText("Sign up!").click();
-		PlaywrightTestUtils.register(page, "user", "user@domain.com", "pass");
+		PlaywrightTestUtils.register(page, "user", "user@domain.com", "p");
 
 		Locator alert = page.getByRole(AriaRole.ALERT);
-		PlaywrightAssertions.assertThat(alert).containsText("Password must be 8 or more characters in length.");
-		PlaywrightAssertions.assertThat(alert).containsText("Password must contain 1 or more uppercase characters.");
-		PlaywrightAssertions.assertThat(alert).containsText("Password must contain 1 or more digit characters.");
-		PlaywrightAssertions.assertThat(alert).containsText("Password must contain 1 or more special characters.");
+		PlaywrightAssertions.assertThat(alert).containsText("Password must be 4 or more characters in length.");
 	}
 
 	@Test