shoc-backend/Data.SeaHavenIndustries/Auth/IdentityPasswordPolicy.cs

using Microsoft.AspNetCore.Identity;

namespace Data.SeaHavenIndustries
{
    /// <summary>
    /// The single password rule for every surface that sets a password: at least
    /// six characters with one uppercase letter, one number, and one special
    /// character. Lowercase letters are deliberately not required so the server
    /// accepts exactly what the four-item checklist in the web app marks as met.
    /// </summary>
    public static class IdentityPasswordPolicy
    {
        public const int MinimumLength = 6;

        public static void Apply(PasswordOptions options)
        {
            ArgumentNullException.ThrowIfNull(options);

            options.RequiredLength = MinimumLength;
            options.RequireUppercase = true;
            options.RequireDigit = true;
            options.RequireNonAlphanumeric = true;
            options.RequireLowercase = false;
            options.RequiredUniqueChars = 1;
        }
    }
}