fix(auth): password min length 6 + show/hide toggle on password inputs

artifacts/api-server/src/routes/auth.ts

@@ -293,7 +293,7 @@ router.get("/auth/password-redirect", async (req, res): Promise<void> => {
 
 const ChangePasswordSchema = z.object({
   currentPassword: z.string().min(1),
-  newPassword: z.string().min(8),
+  newPassword: z.string().min(6),
 });
 
 router.post("/auth/me/password", passwordRateLimit, async (req, res): Promise<void> => {

artifacts/api-server/src/routes/users.ts

@@ -25,7 +25,7 @@ const UserUpdateSchema = z.object({
 });
 
 const SetPasswordSchema = z.object({
-  password: z.string().min(8),
+  password: z.string().min(6),
 });
 
 router.patch("/users/:id/password", requireAdmin, passwordRateLimit, async (req, res): Promise<void> => {

artifacts/toolrate/src/components/password-input.tsx

@@ -0,0 +1,25 @@
+import { useState } from "react";
+import { Eye, EyeOff } from "lucide-react";
+import { Input } from "@/components/ui/input";
+import { cn } from "@/lib/utils";
+
+export function PasswordInput({
+  className,
+  ...props
+}: Omit<React.ComponentProps<"input">, "type">) {
+  const [visible, setVisible] = useState(false);
+  return (
+    <div className={cn("relative", className)}>
+      <Input type={visible ? "text" : "password"} className="pr-9" {...props} />
+      <button
+        type="button"
+        onClick={() => setVisible((v) => !v)}
+        className="absolute right-0 top-0 flex h-9 w-9 items-center justify-center text-muted-foreground hover:text-foreground"
+        aria-label={visible ? "Hide password" : "Show password"}
+        tabIndex={-1}
+      >
+        {visible ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
+      </button>
+    </div>
+  );
+}

artifacts/toolrate/src/components/user-menu.tsx

@@ -15,8 +15,8 @@ import {
   DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogFooter } from "@/components/ui/dialog";
-import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import { PasswordInput } from "@/components/password-input";
 import { useToast } from "@/hooks/use-toast";
 import { useChangeMyPassword, useGetPasswordRedirect, getGetPasswordRedirectQueryKey } from "@workspace/api-client-react";
 import { useQueryClient } from "@tanstack/react-query";
@@ -182,8 +182,7 @@ export function UserMenu() {
           <div className="space-y-4 py-2">
             <div className="space-y-2">
               <Label>{t("auth.currentPassword")}</Label>
-              <Input
+              <PasswordInput
-                type="password"
                 value={currentPassword}
                 onChange={(e) => setCurrentPassword(e.target.value)}
                 data-testid="input-current-password"
@@ -191,18 +190,16 @@ export function UserMenu() {
             </div>
             <div className="space-y-2">
               <Label>{t("auth.newPassword")}</Label>
-              <Input
+              <PasswordInput
-                type="password"
                 value={newPassword}
                 onChange={(e) => setNewPassword(e.target.value)}
-                placeholder="min. 8 characters"
+                placeholder="min. 6 characters"
                 data-testid="input-new-password"
               />
             </div>
             <div className="space-y-2">
               <Label>{t("auth.confirmPassword")}</Label>
-              <Input
+              <PasswordInput
-                type="password"
                 value={confirmPassword}
                 onChange={(e) => setConfirmPassword(e.target.value)}
                 data-testid="input-confirm-password"
@@ -219,7 +216,7 @@ export function UserMenu() {
                   toast({ title: t("auth.pwMismatch"), variant: "destructive" });
                   return;
                 }
-                if (newPassword.length < 8) {
+                if (newPassword.length < 6) {
                   toast({ title: t("auth.pwTooShort"), variant: "destructive" });
                   return;
                 }

artifacts/toolrate/src/pages/admin.tsx

@@ -17,6 +17,7 @@ import { useAuth } from "@/hooks/use-auth";
 import { Layout } from "@/components/layout";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
+import { PasswordInput } from "@/components/password-input";
 import { Label } from "@/components/ui/label";
 import { Badge } from "@/components/ui/badge";
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
@@ -115,8 +116,8 @@ export default function Admin() {
 
   const handleSetUserPassword = () => {
     if (!editUser || !editPassword) return;
-    if (editPassword.length < 8) {
+    if (editPassword.length < 6) {
-      toast({ title: "Password too short", description: "Minimum 8 characters.", variant: "destructive" });
+      toast({ title: "Password too short", description: "Minimum 6 characters.", variant: "destructive" });
       return;
     }
     setUserPassword.mutate(
@@ -367,7 +368,7 @@ export default function Admin() {
             </div>
             <div className="space-y-2">
               <Label>Password</Label>
-              <Input type="password" value={newPassword} onChange={(e) => setNewPassword(e.target.value)} placeholder="min. 6 characters" />
+              <PasswordInput value={newPassword} onChange={(e) => setNewPassword(e.target.value)} placeholder="min. 6 characters" />
             </div>
             <div className="space-y-2">
               <Label>Email (Optional)</Label>
@@ -448,11 +449,10 @@ export default function Admin() {
             {editUser?.authProvider !== "oidc" ? (
               <div className="space-y-2 border-t pt-4">
                 <Label>Set Password</Label>
-                <Input
+                <PasswordInput
-                  type="password"
                   value={editPassword}
                   onChange={(e) => setEditPassword(e.target.value)}
-                  placeholder="min. 8 characters"
+                  placeholder="min. 6 characters"
                   data-testid="input-set-password"
                 />
                 <p className="text-xs text-muted-foreground">Resets the user's password immediately.</p>

artifacts/toolrate/src/pages/login.tsx

@@ -5,6 +5,7 @@ import { useQueryClient } from "@tanstack/react-query";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import { PasswordInput } from "@/components/password-input";
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
 import { ThemeToggle } from "@/components/theme-toggle";
 import { Wrench, AlertCircle } from "lucide-react";
@@ -76,9 +77,8 @@ export default function Login() {
               </div>
               <div className="space-y-2">
                 <Label htmlFor="password">{t("auth.password")}</Label>
-                <Input
+                <PasswordInput
                   id="password"
-                  type="password"
                   value={password}
                   onChange={(e) => setPassword(e.target.value)}
                   required

lib/api-client-react/src/generated/api.schemas.ts

@@ -123,12 +123,12 @@ export interface UserRoleUpdate {
 export interface ChangePasswordInput {
   /** @minLength 1 */
   currentPassword: string;
-  /** @minLength 8 */
+  /** @minLength 6 */
   newPassword: string;
 }
 
 export interface SetPasswordInput {
-  /** @minLength 8 */
+  /** @minLength 6 */
   password: string;
 }
 

lib/api-spec/openapi.yaml

@@ -1013,7 +1013,7 @@ components:
           minLength: 1
         newPassword:
           type: string
-          minLength: 8
+          minLength: 6
 
     SetPasswordInput:
       type: object
@@ -1021,7 +1021,7 @@ components:
       properties:
         password:
           type: string
-          minLength: 8
+          minLength: 6
 
     PasswordRedirect:
       type: object

lib/api-zod/src/generated/api.ts

@@ -484,7 +484,7 @@ export const GetMeResponse = zod.object({
  * @summary Change own password (local users only)
  */
 
-export const changeMyPasswordBodyNewPasswordMin = 8;
+export const changeMyPasswordBodyNewPasswordMin = 6;
 
 
 
@@ -626,7 +626,7 @@ export const SetUserPasswordParams = zod.object({
   "id": zod.coerce.number()
 })
 
-export const setUserPasswordBodyPasswordMin = 8;
+export const setUserPasswordBodyPasswordMin = 6;
 
 
 

lib/api-zod/src/generated/types/changePasswordInput.ts

@@ -9,6 +9,6 @@
 export interface ChangePasswordInput {
   /** @minLength 1 */
   currentPassword: string;
-  /** @minLength 8 */
+  /** @minLength 6 */
   newPassword: string;
 }

lib/api-zod/src/generated/types/setPasswordInput.ts

@@ -7,6 +7,6 @@
  */
 
 export interface SetPasswordInput {
-  /** @minLength 8 */
+  /** @minLength 6 */
   password: string;
 }