fix: move hyphen to end of password validation regex character class (#102)

* fix: move hyphen to end of password validation regex character class

The hyphen character was positioned between * and + in the regex
character class [#?!@$%^&*-+], causing it to be interpreted as a
range operator (ASCII 42-43) instead of a literal hyphen (ASCII 45).

This caused passwords containing hyphens to fail validation while
passwords with asterisks passed.

Moving the hyphen to the end of the character class [#?!@$%^&*+-]
ensures it is treated as a literal character.

Regression introduced in 757e964.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* chore: add regresion test

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: smarcet <smarcet@gmail.com>

Author: 3 people

config/auth.php

@@ -102,9 +102,9 @@
     'password_reset_lifetime' => env('AUTH_PASSWORD_RESET_LIFETIME', 1800),
     'password_min_length' => env('AUTH_PASSWORD_MIN_LENGTH', 8),
     'password_max_length' => env('AUTH_PASSWORD_MAX_LENGTH', 30),
-    'password_allowed_special_characters' => env('AUTH_PASSWORD_ALLOWED_SPECIAL_CHARACTERS', '[A-Za-z0-9#?!@$%^&*-+]'),
-    'password_shape_pattern' => env('AUTH_PASSWORD_SHAPE_PATTERN', '^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*-+])[A-Za-z0-9#?!@$%^&*-+]+$'),
-    'password_shape_warning' => env('AUTH_PASSWORD_SHAPE_WARNING', 'Password must include at least one uppercase letter, one lowercase letter, one number, and one special character (#?!@$%^&*-+).'),
+    'password_allowed_special_characters' => env('AUTH_PASSWORD_ALLOWED_SPECIAL_CHARACTERS', '[A-Za-z0-9#?!@$%^&*+-]'),
+    'password_shape_pattern' => env('AUTH_PASSWORD_SHAPE_PATTERN', '^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*+\-])[A-Za-z0-9#?!@$%^&*+\-]+$'),
+    'password_shape_warning' => env('AUTH_PASSWORD_SHAPE_WARNING', 'Password must include at least one uppercase letter, one lowercase letter, one number, and one special character (#?!@$%^&*+-).'),
     'verification_email_lifetime' => env("AUTH_VERIFICATION_EMAIL_LIFETIME", 600),
     'allows_native_auth' => env('AUTH_ALLOWS_NATIVE_AUTH', 1),
     'allows_native_on_config' => env('AUTH_ALLOWS_NATIVE_AUTH_CONFIG', 1),

tests/UserPasswordShapeRegressionTest.php

@@ -0,0 +1,85 @@
+<?php namespace Tests;
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+use App\Jobs\AddUserAction;
+use Auth\User;
+use Illuminate\Support\Facades\Config;
+use Illuminate\Support\Facades\Queue;
+use models\exceptions\ValidationException;
+
+class UserPasswordShapeRegressionTest extends TestCase
+{
+    private function setPasswordPolicyForTest(): void
+    {
+        // Keep these aligned with your real config defaults (or just read them from config)
+        Config::set('auth.password_min_length', 8);
+        Config::set('auth.password_max_length', 128);
+        Config::set('auth.password_shape_warning', 'Password does not meet complexity requirements.');
+
+        // IMPORTANT: hyphen is escaped (or move it to end of the class)
+        Config::set(
+            'auth.password_shape_pattern',
+            '^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*+\-])[A-Za-z0-9#?!@$%^&*+\-]+$'
+        );
+    }
+
+    public static function validPasswordsProvider(): array
+    {
+        return [
+            // has uppercase, lowercase, digit, and "-" special char
+            ['Abcdef1-'],
+            ['Zz9-aaaaa'],
+            ['Aaaaaa1-+'], // multiple specials still ok (if + is allowed)
+        ];
+    }
+
+    /**
+     * @dataProvider validPasswordsProvider
+     */
+    public function test_set_password_allows_hyphen(string $plainPassword): void
+    {
+        $this->setPasswordPolicyForTest();
+
+        // Prevent actually queueing anything (setPassword dispatches AddUserAction)
+        Queue::fake();
+
+        $user = new User();
+        $user->setEmail('test@example.org');
+
+        $user->setPassword($plainPassword);
+
+        $this->assertTrue($user->hasPasswordSet());
+        $this->assertNotEmpty($user->getPassword());
+
+    }
+
+    public function test_password_missing_special_character_is_rejected(): void
+    {
+        $this->setPasswordPolicyForTest();
+        Queue::fake();
+
+        $user = new User();
+        $user->setEmail('test@example.org');
+
+        $this->expectException(ValidationException::class);
+        $user->setPassword('Abcdef12'); // no special char
+    }
+
+    public function test_password_with_hyphen_matches_current_regex(): void
+    {
+        $this->setPasswordPolicyForTest();
+
+        $pattern = Config::get('auth.password_shape_pattern');
+        $this->assertSame(1, preg_match("/$pattern/", 'Abcdef1-'));
+    }
+}