cadrumo.core.credentials module

Canonical profile-password policy and independent strength guidance.

Profile-password validity is an exact-sequence capability contract: accepted passwords contain 8 through 256 Unicode scalar values and encode to at most 1,024 strict UTF-8 bytes. The assessment never normalises, rewrites, retains, or returns the submitted password. Its result contains only a finite refusal reason and numeric measurements that are safe for prospective-password guidance.

Strength is deliberately advisory. Character-class variety can improve the display band for a shorter passphrase, but no composition rule affects profile password validity.

PROFILE_PASSWORD_MIN_SCALARS: Final[int]

Minimum Unicode scalar count for a profile password.

PROFILE_PASSWORD_MAX_SCALARS: Final[int]

Maximum Unicode scalar count for a profile password.

PROFILE_PASSWORD_MAX_UTF8_BYTES: Final[int]

Maximum strict UTF-8 byte count for a profile password.

LENGTH_ALONE_IS_STRONG: Final[int]

Length at which a passphrase is advised as strong without composition.

LENGTH_FAIR_FLOOR: Final[int]

Length at which a passphrase is at least advised as fair.

class ProfilePasswordRefusalReason(*values)[source]

Bases: StrEnum

Finite, secret-free reasons a prospective profile password is refused.

CONTAINS_SURROGATE
TOO_FEW_SCALARS
TOO_MANY_SCALARS
TOO_MANY_UTF8_BYTES
class PassphraseStrength(*values)[source]

Bases: StrEnum

Advisory display band that never determines password validity.

WEAK
FAIR
STRONG
class ProfilePasswordAssessment(reason, scalar_count, utf8_byte_count, strength)[source]

Bases: object

Secret-free assessment of a prospective profile password.

utf8_byte_count is unavailable only when a surrogate prevents strict UTF-8 encoding. No field retains or derives a reproducible fingerprint of the candidate.

Parameters:
reason: ProfilePasswordRefusalReason | None
scalar_count: int
utf8_byte_count: int | None
strength: PassphraseStrength
property accepted: bool

Return whether the candidate satisfies the profile-password contract.

assess_passphrase_strength(candidate)[source]

Return advisory strength without applying a validity threshold.

Return type:

PassphraseStrength

Parameters:

candidate (str)

assess_profile_password(candidate)[source]

Assess candidate exactly without retaining or rewriting it.

Return type:

ProfilePasswordAssessment

Parameters:

candidate (str)