Constraint: NotCompromisedPassword (HIBP, optional)

[cursor]

Goal

Evaluate and optionally implement a Symfony NotCompromisedPassword equivalent via the Have I Been Pwned API (k-anonymity, SHA-1 prefix).

Reference

• Symfony: Symfony\Component\Validator\Constraints\NotCompromisedPassword.

Dependency constraints

• No new modules in go.mod — use net/http, crypto/sha1, encoding/hex, context, and timeouts from stdlib.

Important

• This is a network constraint: flaky tests, rate limits, network error policy (strictness as in Symfony). Clearly document in the API that validation is not purely local.

Scope

• HTTP client with timeout, "skip on error" option if present in the reference; tests with httptest.

Complexity

3 / 5.

---

Migrated from Linear: IGO-44
Priority: Medium
Estimate: 3 points