password validation example

@EqualsAndHashCode(includes = ['username', 'email'])
@ToString(includes = ['id', 'username', 'email'], includePackage = false)
class User implements Serializable {
    private static final long serialVersionUID = 1
    static final IntRange PASSWORD_SIZE = 8..32
    static final IntRange USERNAME_SIZE = 4..32

    String username
    String email
    String password

    Boolean enabled = true
    Boolean accountExpired = false
    Boolean accountLocked = false
    Boolean passwordExpired = true // expire for new users to enforce change password on login

    Set<Role> getAuthorities() {
        (UserRole.findAllByUser(this) as List<UserRole>)*.role as Set<Role>
    }

    Set<Role> getRoles() { // just an alias
        authorities
    }

    static constraints = {
        username nullable: false, blank: false, unique: true, size: USERNAME_SIZE
        email nullable: false, blank: false, unique: true, email: true
        password nullable: false, blank: false, password: true, validator: passwordValidator
    }

    static mapping = {
        password column: '`password`'
    }

    private static final passwordValidator = { String passwd, User user, Errors errors ->
        if (passwd == null) {
            errors.rejectValue('password', 'null password')
            return false
        }
        if (passwd == user.username) {
            errors.rejectValue('password', 'same as username')
        }
        if (passwd == user.email) {
            errors.rejectValue('password', 'same as email')
        }
        if (!(passwd.size() in PASSWORD_SIZE)) {
            errors.rejectValue('password', 'bad size')
        }
        if (!(passwd ==~ /[\w.,!@#$%^&*<>?\-+\[\]{}:;~]+/)) {
            errors.rejectValue('password', 'has illegal characters')
        }
        if (!(passwd =~ /[a-z]/)) {
            errors.rejectValue('password', 'no alphabetical lowercase')
        }
        if (!(passwd =~ /[A-Z]/)) {
            errors.rejectValue('password', 'no alphabetical uppercase')
        }
        if (!(passwd =~ /\d/)) {
            errors.rejectValue('password', 'no digit')
        }
        if (!(passwd =~ /[.,!@#$%^&*<>?\-+\[\]{}:;~]/)) {
            errors.rejectValue('password', 'no special character')
        }
        def passwdLowTrimmed = passwd.trim().toLowerCase()
        if (BadPassword.where { lower(passwordText) == passwdLowTrimmed }.count()) {
            errors.rejectValue('password', 'known bad password')
        }
        return !errors.hasErrors()
    }

}