Added check that password is not an email address

frontend/src/components/signup/UserInfoStep.tsx

@@ -45,6 +45,7 @@ type Errors = {
   number?: string;
   specialChar?: string;
   repeatedChar?: string;
+  isEmail?: string;
   isBeachedPassword?: string;
 };
 

frontend/src/components/utilities/checks/PasswordCheck.ts

@@ -1,3 +1,4 @@
+import isEmail from "validator/lib/isEmail";
 import { checkIsPasswordBreached } from "./checkIsPasswordBreached";
 
 /* eslint-disable no-param-reassign */
@@ -11,6 +12,7 @@ interface PasswordCheckProps {
   setPasswordErrorNumber: (value: boolean) => void;
   setPasswordErrorSpecialChar: (value: boolean) => void;
   setPasswordErrorRepeatedChar: (value: boolean) => void;
+  setPasswordErrorIsEmail: (value: boolean) => void;
   setPasswordErrorIsBreachedPassword: (value: boolean) => void;
 }
 
@@ -26,6 +28,7 @@ const passwordCheck = async ({
   setPasswordErrorNumber,
   setPasswordErrorSpecialChar,
   setPasswordErrorRepeatedChar,
+  setPasswordErrorIsEmail,
   setPasswordErrorIsBreachedPassword,
   errorCheck
 }: PasswordCheckProps) => {
@@ -93,6 +96,14 @@ const passwordCheck = async ({
     setPasswordErrorRepeatedChar(false);
   }
 
+  // isEmail
+  if (isEmail(password)) {
+    setPasswordErrorIsEmail(true);
+    errorCheck = true;
+  } else {
+    setPasswordErrorIsEmail(false);
+  }
+
   // breachedPassword
   if (await checkIsPasswordBreached(password)) {
     setPasswordErrorIsBreachedPassword(true);

frontend/src/components/utilities/checks/checkPassword.ts

@@ -1,3 +1,4 @@
+import isEmail from "validator/lib/isEmail";
 import { checkIsPasswordBreached } from "./checkIsPasswordBreached";
 
 type Errors = {
@@ -8,6 +9,7 @@ type Errors = {
   number?: string;
   specialChar?: string;
   repeatedChar?: string;
+  isEmail?: string;
   isBreachedPassword?: string;
 };
 
@@ -25,6 +27,7 @@ interface CheckPasswordParams {
  * - Contains at least 1 number (0-9)
  * - Contains at least 1 special character
  * - Does not contain 3 repeat, consecutive characters
+ * - Is not an email address
  * - Is not in a database of breached passwords
  *
  * The function returns whether or not the password [password]
@@ -64,7 +67,7 @@ const checkPassword = async ({ password, setErrors }: CheckPasswordParams): Prom
 
   // number
   if (!/[0-9]/.test(password)) {
-    errors.number = "at least 1 number (0-9)";
+    errors.number = "at least 1 number";
   }
 
   // specialChar
@@ -76,7 +79,7 @@ const checkPassword = async ({ password, setErrors }: CheckPasswordParams): Prom
     )
   ) {
     errors.specialChar =
-      'at least 1 special character from !@#$%^&*(),.?":{}|<> or many languages including Korean, Devanagari, Cyrillic, Turkish and emojis.';
+      "at least 1 special character (emojis and many langauge scripts supported)";
   }
 
   // repeatedChar
@@ -87,7 +90,12 @@ const checkPassword = async ({ password, setErrors }: CheckPasswordParams): Prom
       password
     )
   ) {
-    errors.repeatedChar = "At most 2 repeated, consecutive characters";
+    errors.repeatedChar = "at most 2 repeated, consecutive characters";
+  }
+
+  // isEmail
+  if (isEmail(password)) {
+    errors.isEmail = "The password cannot be an email address";
   }
 
   // breachedPassword

frontend/src/pages/password-reset.tsx

@@ -35,6 +35,7 @@ export default function PasswordReset() {
   const [passwordErrorNumber, setPasswordErrorNumber] = useState(false);
   const [passwordErrorSpecialChar, setPasswordErrorSpecialChar] = useState(false);
   const [passwordErrorRepeatedChar, setPasswordErrorRepeatedChar] = useState(false);
+  const [passwordErrorIsEmail, setPasswordErrorIsEmail] = useState(false);
   const [passwordErrorIsBreachedPassword, setPasswordErrorIsBreachedPassword] = useState(false);
 
   const router = useRouter();
@@ -79,6 +80,7 @@ export default function PasswordReset() {
       setPasswordErrorNumber,
       setPasswordErrorSpecialChar,
       setPasswordErrorRepeatedChar,
+      setPasswordErrorIsEmail,
       setPasswordErrorIsBreachedPassword,
       errorCheck: false
     });
@@ -240,6 +242,7 @@ export default function PasswordReset() {
               setPasswordErrorNumber,
               setPasswordErrorSpecialChar,
               setPasswordErrorRepeatedChar,
+              setPasswordErrorIsEmail,
               setPasswordErrorIsBreachedPassword,
               errorCheck: false
             });
@@ -255,6 +258,7 @@ export default function PasswordReset() {
             passwordErrorNumber &&
             passwordErrorSpecialChar &&
             passwordErrorRepeatedChar &&
+            passwordErrorIsEmail &&
             passwordErrorIsBreachedPassword
           }
           autoComplete="new-password"
@@ -268,6 +272,7 @@ export default function PasswordReset() {
       passwordErrorNumber ||
       passwordErrorSpecialChar ||
       passwordErrorRepeatedChar ||
+      passwordErrorIsEmail ||
       passwordErrorIsBreachedPassword ? (
         <div className="mx-2 mt-3 mb-2 flex w-full max-w-md flex-col items-start rounded-md bg-white/5 px-2 py-2">
           <div className="mb-1 text-sm text-gray-400">Password should contain:</div>
@@ -335,7 +340,7 @@ export default function PasswordReset() {
                   passwordErrorSpecialChar ? "text-gray-400" : "text-gray-600"
                 } text-sm`}
               >
-                at least 1 special character
+                at least 1 special character (emojis and many langauge scripts supported)
               </div>
             </div>
             <div className="ml-1 flex flex-row items-center justify-start">
@@ -349,7 +354,19 @@ export default function PasswordReset() {
                   passwordErrorRepeatedChar ? "text-gray-400" : "text-gray-600"
                 } text-sm`}
               >
-                at most 2 repeated characters
+                at most 2 repeated, consecutive characters
+              </div>
+            </div>
+            <div className="ml-1 flex flex-row items-center justify-start">
+              {passwordErrorIsEmail ? (
+                <FontAwesomeIcon icon={faX} className="text-md mr-2.5 text-red" />
+              ) : (
+                <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
+              )}
+              <div
+                className={`${passwordErrorIsEmail ? "text-gray-400" : "text-gray-600"} text-sm`}
+              >
+                The password cannot be an email address.
               </div>
             </div>
             <div className="ml-1 flex flex-row items-center justify-start">
@@ -363,8 +380,8 @@ export default function PasswordReset() {
                   passwordErrorIsBreachedPassword ? "text-gray-400" : "text-gray-600"
                 } text-sm`}
               >
-                The password you provided is in a list of passwords commonly used on other websites.
-                Please try again with a stronger password.
+                The new password is in a list of passwords commonly used on other websites. Please
+                try again with a stronger password.
               </div>
             </div>
           </div>

frontend/src/pages/signupinvite.tsx

@@ -35,6 +35,7 @@ type Errors = {
   number?: string;
   specialChar?: string;
   repeatedChar?: string;
+  isEmail?: string;
   breachedPassword?: string;
 };
 

frontend/src/views/Settings/PersonalSettingsPage/ChangePasswordSection/ChangePasswordSection.tsx

@@ -20,6 +20,7 @@ type Errors = {
   number?: string;
   specialChar?: string;
   repeatedChar?: string;
+  isEmail?: string;
   isBreachedPassword?: string;
 };
 

frontend/src/views/Signup/components/UserInfoSSOStep/UserInfoSSOStep.tsx

@@ -40,6 +40,7 @@ type Errors = {
   number?: string;
   specialChar?: string;
   repeatedChar?: string;
+  isEmail?: string;
   isBeachedPassword?: string;
 };