Implement password policy with hook

[JolienTrog]

Ref #4401

[Al2Klimov]

Fix your code style as told by the failing Github actions.

[Al2Klimov]

Please push without -f for now. This eases it for me to keep track of your changes.

[Al2Klimov]

During setup, the wizard prompts me for a username and password "to configure your first administrative account". This should enforce the chosen password policy.

[Al2Klimov]

Not done yet:

• #5419 (comment)
• #5419 (review)

Also, regarding #5419 (review): Situations where you push -f anyway, such as #5419 (comment), are good opportunities to squash at least commits which address only reviews and/or GitHub action failures.

[Al2Klimov]

So if $instance instanceof PasswordPolicyHook is false, will $this->passwordPolicy stay empty? What about the other methods in this class relying on that property being set?

[Al2Klimov]

Given PHP has no multiple inheritance, I wanted to preventively avoid unnecessary base classes and instructed you to make an interface.

See how tables have turned: #5442 (comment) 🙈

[lippserd]

This comment from Alex doesn't read like an instruction, so here's the explanation:

We use arbitrary strings such as PasswordPolicy to register and load hooks, which makes it difficult to actually find hook usages. I would suggest making PasswordPolicyHook an abstract class that also provides the methods all() and register() so that the string PasswordPolicy only appears in the hook itself. Please then also adjust the documentation.

[lippserd]

I think I would also do the following to make it clean:

• Rename PasswordPolicyHook to PasswordPolicy (and move it to the Authentication namespace).
• Use the PasswordPolicy interface everywhere in the code where typing is required. This is better than using the hook as a type, since the hook is used to load the functionality.
• Have the new abstract PasswordPolicyHook implement PasswordPolicy.

[lippserd]

Please use Throwable;.

[lippserd]

I would adjust the log message so that it includes the topic, e.g., 'The configured password policy could not be loaded: %s', $e

[lippserd]

I want this information to be displayed permanently, so Notification should be avoided. If styling is required, there is a form element called Note that can be used instead. You can search for 'note' in the Icinga web codebase to find examples of how it is used. addDescription() can also be used. The message could then be changed to something like this: There was a problem loading the configured password policy. Please contact your administrator.

[lippserd]

License header missing.

[lippserd]

Please add newlines after headings and speak of Icinga Web not Icinga Web 2.

[lippserd]

Space after ! missing.

[lippserd]

I would rename the class to PasswordPolicyValidator.

[lippserd]

validate() is sufficient.

[lippserd]

I think I would also do the following to make it clean:

• Rename PasswordPolicyHook to PasswordPolicy (and move it to the Authentication namespace).
• Use the PasswordPolicy interface everywhere in the code where typing is required. This is better than using the hook as a type, since the hook is used to load the functionality.
• Have the new abstract PasswordPolicyHook implement PasswordPolicy.

[lippserd]

Do we really need those variables? The signature of assert*() is $expected, $actual, so having the following is perfectly fine:

$this->assertSame(
    expected,
    actual
);

And if you really need such variables, please use $expected and $actual.