Password pattern in UserCreate only enforces length

[igorbenav]

Problem

UserCreate.password (backend/src/modules/user/schemas.py:71) uses pattern=r"^.{8,}|[0-9]+|[A-Z]+|[a-z]+|[^a-zA-Z0-9]+$", with a description promising "a number, uppercase letter, lowercase letter, and special character". The | makes the pattern a list of alternatives, so a password passes when it matches any one of them. Checked with pydantic: abcdefgh, aaaaaaaaaaaa and eight spaces are all accepted. Only min_length=8 does anything.

Context

crudauth now has a password policy (benavlabs/crudauth#22) that applies to register, set-password, change-password and reset in one place, which also covers the flows that bypass this schema.

Proposal

• Once the crudauth integration (feat: wire boilerplate to crudauth follow-ups #292) lands, move the rule to crudauth:

  CRUDAuth(
      ...,
      password_policy=PasswordPolicy(
          min_length=8,
          require_uppercase=True,
          require_lowercase=True,
          require_digit=True,
          require_special=True,
      ),
  )

• Drop the pattern and the description's claims from UserCreate.

• Until then, replace the pattern with a check that enforces each class, or stop promising them in the description.

Acceptance criteria

• A password missing any required character class is rejected on signup, and on reset and change once crudauth handles them.
• Tests for each character class.

[igorbenav]

Closed by #299