/**
 * What a password has to be, and the part of that a browser can decide alone.
 *
 * Pure, with nothing under it, because the settings screen judges both rules
 * before it asks the server anything and that screen is a client component.
 * `lib/auth.ts` reads `PASSWORD_MIN` for its `minPasswordLength`, exactly as it
 * reads `USERNAME_MIN` from `lib/username.ts`, so the figure the hint shows and
 * the figure the server enforces are one number rather than two that drift.
 *
 * **Six, and this is a placeholder rather than a policy.** The comment lived in
 * `lib/auth.ts` until the number moved here; it is worth keeping whole. The
 * client has never said what a password here should be worth. The value was
 * eight, which was a guess, and it is six so that the development logins can be
 * `admin1` and its neighbours. Whoever sets the real number should know what
 * they are trading: everybody types this on a shared terminal on a factory
 * floor, several times a day, and a rule that makes the password hard to type
 * is a rule that gets written on a sticky note next to the screen.
 *
 * The settings screen prints this number to all 193 of them, which is the first
 * time anybody outside the code has been shown it.
 */

export const PASSWORD_MIN = 6

export type PasswordProblem = "too_short" | "mismatch"

/**
 * Length before match, and the order is the whole point of writing it once.
 *
 * Somebody who types a four-character password into both boxes has made one
 * mistake, not two, and being told the two do not match would send them to fix
 * the field that is already correct.
 */
export function checkNewPassword(
  password: string,
  again: string,
): PasswordProblem | null {
  if (password.length < PASSWORD_MIN) return "too_short"
  if (password !== again) return "mismatch"
  return null
}