John O'Keefe
df556d8208
Release / build-and-push (push) Successful in 3m4s
GET /api/auth/password-rules (public, pre-auth) exposes the ACTIVE complexity config from the settings registry; password_validation.ts now fetches it and generates the checklist rows per active rule — inactive requirements no longer linger as fake tasks, and the min length mirrors the admin's setting instead of a hardcoded 8. Surfaces: register, setup, admin create-user (Users page), profile password change (self + admin variants, now gated on checklist pass; misleading minlength=6 dropped — the server was always the enforcer). Verified live: flip min_length=12 / number+special off via the settings API → endpoint + register/profile/admin checklists re-render row-for-row; enforcement follows (short rejected, rule-valid accepted without digits/specials); restore defaults → checklists return.