Implement password policy with hook

[JolienTrog]

Ref #4401

[Al2Klimov]

Fix your code style as told by the failing Github actions.

[Al2Klimov]

Please push without -f for now. This eases it for me to keep track of your changes.

[Al2Klimov]

During setup, the wizard prompts me for a username and password "to configure your first administrative account". This should enforce the chosen password policy.

[lippserd]

💡

@lippserd What do you think about this:

ChangePasswordForm already has the old and new password. So PasswordPolicy can take both.

It would cost us nothing, but admins could implement #5417 by themselves. They could also use e.g Levenshtein distance and/or A.I to prevent the "smartest" users from using passwords similar to their current ones.

That's a good idea! @JolienTrog Could you please adjust the implementation so that the validation function accepts both $newPassword and $oldPassword, where the latter may be null?

[Al2Klimov]

What does this code even do?

[JolienTrog]

Sorry I forgot to delete this part.

[lippserd]

It is indeed necessary to do something with the element for the old password, as your introduced validator expects the old password element to be named old_password, which may not be the case. This shows that it also makes sense to introduce test cases for an actual form that implements password elements, a policy, and the validator.

[lippserd]

In addition to the changes requested, please revert anything related to 81e6859. This does not look like a necessary change.

[lippserd]

Please annotate Any and Common as code.

[lippserd]

Suggested change

	* This class connects with the PasswordPolicy interface to use it as hook
	* Base class for hookable password policies

[lippserd]

Suggested change

	* Registers Hook as Password Policy
	* Register password policy

[lippserd]

PasswordPolicy could be a protected const, e.g., HOOK_NAME.

[lippserd]

Suggested change

	* Returns all registered password policies sorted by
	* Return all registered password policies sorted by name

[lippserd]

Please rename to passwordPolicy, as everywhere else in the code.

[lippserd]

Please rename to passwordPolicy, as everywhere else in the code.

[lippserd]

Suggested change

	public function testMethodValidatePasswordAlwaysReturnAnEmptyArray(): void
	public function testValidatePasswordValid(): void

[lippserd]

This test is not very useful.

Suggested change

	public function testValidatePasswordWithManyCharacters(): void
	{
	$longPassword = str_repeat('a', 1000);
	$this->assertCount(3, $this->instance->validate($longPassword, 'null'));
	}

[lippserd]

You use the Translation trait only but never call $this->translate() on any of the strings.

[lippserd]

PHPDoc missing.