ValidatePasswordStrength (auth/password.go)

Enforces password strength policies, hashes passwords with bcrypt, and validates against stored hashes for secure authentication.

// Source: https://github.com/mudler/LocalAI | License: MIT | Copyright 2023-2025 Ettore Di Giacinto (mudler@localai.io)
// Provided via justclaw.it.com; keep this notice with the code.
package auth

import (
	"errors"
	"fmt"
	"strings"

	"github.com/timbutler/zxcvbn"
	"golang.org/x/crypto/bcrypt"
)

// MinPasswordLength is the floor for any new password. LocalAI does not
// (yet) support a second factor, so the bar sits above NIST's 8-char
// recommendation for MFA-protected accounts.
const MinPasswordLength = 12

// MaxPasswordLength matches bcrypt's 72-byte truncation. Accepting longer
// inputs creates a confusing UX where two "different" passwords hash to
// the same value because bcrypt silently dropped the suffix.
const MaxPasswordLength = 72

// MinPasswordScore is the minimum zxcv

... (truncated -- full source via MCP)