How can I implement joi-password-complexity in Joi validation? - node.js

Question

I want to enforce password complexity by using the joi-password-complexity package when users register.
https://github.com/kamronbatman/joi-password-complexity
I tried but I got the following error:
(node:14872) UnhandledPromiseRejectionWarning: AssertionError
[ERR_ASSERTION]: Invalid schema content:
(password.$_root.alternatives)
This is the code I'm using:
const mongoose = require("mongoose");
const Joi = require("joi");
const passwordComplexity = require("joi-password-complexity");
const complexityOptions = {
min: 5,
max: 250,
lowerCase: 1,
upperCase: 1,
numeric: 1,
symbol: 1,
requirementCount: 2,
};
const userSchema = new mongoose.Schema({
name: {
type: String,
minlenght: 1,
maxlength: 55,
required: true
},
email: {
type: String,
minlength: 5,
maxlength: 255,
unique: true,
required: true
},
password: {
type: String,
minlength: 5,
maxlength: 1024,
required: true
}
})
const User = mongoose.model("User", userSchema);
function validateUser(user) {
const schema = {
name: Joi.string().min(1).max(55).required(),
email: Joi.string().min(5).max(255).required().email(),
password: passwordComplexity(complexityOptions) // This is not working
}
return Joi.validate(user, schema);
}
exports.User = User;
exports.validate = validateUser;
I also tried to follow this example: https://forum.codewithmosh.com/d/215-joi-password-complexity-problem but it seems outdated since the "new" keyword will throw another error (not a constructor).
Any help is appreciated!

Answer 1

Couldn't reproduce your exact error, but I had the thing working this way:
#hapi/joi: ^17.1.0 (latest at the time of the writing, also works with 16.1.8)
joi-password-complexity: ^4.0.0 (latest as well)
Code:
function validateUser(user) {
// no change here
const schema = Joi.object({
name: Joi.string().min(1).max(55).required(),
email: Joi.string().min(5).max(255).required().email(),
password: passwordComplexity(complexityOptions)
});
// note that we call schema.validate instead of Joi.validate
// (which doesn't seem to exist anymore)
return schema.validate(user);
}

Answer 2

Here is how i solved the issue:
if You are using joi#14.3.1 or older then install joi-password-complexity#2.0.1 then try this code:
User.js model
const mongoose = require("mongoose");
const Joi = require("joi");
const PasswordComplexity = require("joi-password-complexity");
const userSchema = new mongoose.Schema({
name: {
type: String,
required: true,
trim: true
},
email: { type: String, required: true, unique: true },
password: { type: String, required: true }
});
const User = mongoose.model("User", userSchema);
function validateUser(user) {
const schema = {
name: Joi.string()
.min(3)
.max(50)
.required(),
email: Joi.string()
.email()
.max(255)
.required(),
password: new PasswordComplexity({
min: 8,
max: 25,
lowerCase: 1,
upperCase: 1,
numeric: 1,
symbol: 1,
requirementCount: 4
});
};
return Joi.validate(user, schema);
}
module.exports.validate = validateUser;
module.exports.User = User;
This will validate password complexity but for making password REQUIRED you have to validate it in your route...
Users.js route
const _ = require("lodash");
const express = require("express");
const { User, validate } = require("../models/user");
const router = express.Router();
//POST
router.post("/", async (req, res) => {
const { error } = validate(req.body);
if (error) return res.status(400).send(error.details[0].message);
//
if (!req.body.password) return res.status(400).send("Password is required..");
let user = await User.findOne({ email: req.body.email });
if (user) return res.status(400).send("User already registered..");
user = new User(_.pick(req.body, ["name", "email", "password"]));
await user.save();
res.send(_.pick(user, ["_id", "name", "email"]));
});
module.exports = router;

Answer 3

I had to add .default to import the function that returns the Joi object. Using Joi 17.3.0 and joi-password-complexity 5.0.1, this is what worked for me:
const passwordComplexity = require('joi-password-complexity').default;
const schema = Joi.object({
email: Joi.string().min(5).max(255).required().email(),
password: passwordComplexity().required(),
});

Answer 4

Since the passwordComplexity() returns a Joi object, you can write required in a fluent way. Thus, you don't have to write extra validation in the router.
function validateUser(user) {
// no change here
const schema = Joi.object({
name: Joi.string().min(1).max(55).required(),
email: Joi.string().min(5).max(255).required().email(),
password: passwordComplexity(complexityOptions).required()
});
// note that we call schema.validate instead of Joi.validate
// (which doesn't seem to exist anymore)
return schema.validate(user);
}

Answer 5

Versions used of Joi and JPC:
├── ...
├── joi#17.2.1
├── joi-password-complexity#4.2.1
The validation function must be updated to fit with the new updated version of JOI. joi.validate() is no longer supported in Joi v16+
const Joi = require("joi");
const passwordComplexity = require("joi-password-complexity");
function validateUser(user) {
const schema = Joi.object({
name: Joi.string().min(5).max(50).required(),
email: Joi.string().min(5).max(255).required().email(),
password: passwordComplexity(complexityOptions),
});
return schema.validate(user); // NOT >> Joi.validate(user, schema); !!!!!
}
and the complexityOptions can be something like:
const complexityOptions = {
min: 5,
max: 1024,
lowerCase: 1,
upperCase: 1,
numeric: 1,
symbol: 1,
requirementCount: 4,
};

Answer 6

Another way is Regex
const joi = require("joi");
const strongPasswordRegex = /^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!#$%^&*-]).{8,}$/;
const stringPassswordError = new Error("Password must be strong. At least one upper case alphabet. At least one lower case alphabet. At least one digit. At least one special character. Minimum eight in length")
const schema = joi.object().keys({
username: joi.string().required().min(4).max(15),
password: joi.string().regex(strongPasswordRegex).error(stringPassswordError).required()
});
const notValid = schema.validate({ username: "MHamzaRajput", password: "Admin#admin123" }).error;
if (notValid) {
console.log(notValid.message);
} else {
console.log("payload validated successfully");
}