Resolved merge conflicts

.env

@@ -98,7 +98,7 @@ _APP_VCS_GITHUB_CLIENT_SECRET=
 _APP_VCS_GITHUB_WEBHOOK_SECRET=
 _APP_MIGRATIONS_FIREBASE_CLIENT_ID=
 _APP_MIGRATIONS_FIREBASE_CLIENT_SECRET=
-_APP_ASSISTANT_OPENAI_API_KEY=
+_APP_ASSISTANT_OPENAI_API_KEY=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
 _APP_MESSAGE_SMS_TEST_DSN=
 _APP_MESSAGE_EMAIL_TEST_DSN=
 _APP_MESSAGE_PUSH_TEST_DSN=

app/config/errors.php

@@ -200,6 +200,11 @@ return [
         'description' => 'The password you are trying to use contains references to your name, email, phone or userID. For your security, please choose a different password and try again.',
         'code' => 400,
     ],
+    Exception::USER_PASSWORD_AI => [
+        'name' => Exception::USER_PASSWORD_AI,
+        'description' => 'AI does not like security of the password you are trying to use. For your security, please choose a different password and try again.',
+        'code' => 400,
+    ],
     Exception::USER_SESSION_NOT_FOUND => [
         'name' => Exception::USER_SESSION_NOT_FOUND,
         'description' => 'The current user session could not be found.',

app/controllers/api/account.php

@@ -4,6 +4,7 @@ use Ahc\Jwt\JWT;
 use Appwrite\Auth\Auth;
 use Appwrite\Auth\OAuth2\Exception as OAuth2Exception;
 use Appwrite\Auth\Validator\Password;
+use Appwrite\Auth\Validator\PasswordAi;
 use Appwrite\Auth\Validator\Phone;
 use Appwrite\Detector\Detector;
 use Appwrite\Event\Event;
@@ -119,6 +120,13 @@ App::post('/v1/account')
             }
         }
 
+        if ($project->getAttribute('auths', [])['passwordAi'] ?? false) {
+            $passwordAiValidator = new PasswordAi();
+            if (!$passwordAiValidator->isValid($password)) {
+                throw new Exception(Exception::USER_PASSWORD_AI);
+            }
+        }
+
         $passwordHistory = $project->getAttribute('auths', [])['passwordHistory'] ?? 0;
         $password = Auth::passwordHash($password, Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS);
         try {
@@ -2008,7 +2016,7 @@ App::patch('/v1/account/password')
     ->label('sdk.response.model', Response::MODEL_USER)
     ->label('sdk.offline.model', '/account')
     ->label('sdk.offline.key', 'current')
-    ->param('password', '', fn ($project, $passwordsDictionary) => new PasswordDictionary($passwordsDictionary, $project->getAttribute('auths', [])['passwordDictionary'] ?? false), 'New user password. Must be at least 8 chars.', false, ['project', 'passwordsDictionary'])
+    ->param('password', '', fn ($project, $passwordsDictionary10k) => new PasswordDictionary($passwordsDictionary10k, $project->getAttribute('auths', [])['passwordDictionary'] ?? false), 'New user password. Must be at least 8 chars.', false, ['project', 'passwordsDictionary10k'])
     ->param('oldPassword', '', new Password(), 'Current user password. Must be at least 8 chars.', true)
     ->inject('requestTimestamp')
     ->inject('response')

app/controllers/api/projects.php

@@ -85,7 +85,7 @@ App::post('/v1/projects')
         }
 
         $auth = Config::getParam('auth', []);
-        $auths = ['limit' => 0, 'maxSessions' => APP_LIMIT_USER_SESSIONS_DEFAULT, 'passwordHistory' => 0, 'passwordDictionary' => false, 'passwordDictionaryLength' => '10k', 'duration' => Auth::TOKEN_EXPIRATION_LOGIN_LONG, 'personalDataCheck' => false];
+        $auths = ['limit' => 0, 'maxSessions' => APP_LIMIT_USER_SESSIONS_DEFAULT, 'passwordHistory' => 0, 'passwordAi' => false, 'sessionRefresh' => false, 'passwordDictionary' => false, 'passwordDictionaryLength' => '10k', 'duration' => Auth::TOKEN_EXPIRATION_LOGIN_LONG, 'personalDataCheck' => false];
         foreach ($auth as $index => $method) {
             $auths[$method['key'] ?? ''] = true;
         }
@@ -822,6 +822,37 @@ App::patch('/v1/projects/:projectId/auth/password-dictionary')
         $response->dynamic($project, Response::MODEL_PROJECT);
     });
 
+App::patch('/v1/projects/:projectId/auth/password-ai')
+    ->desc('Update authentication password ai status.')
+    ->groups(['api', 'projects'])
+    ->label('scope', 'projects.write')
+    ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN])
+    ->label('sdk.namespace', 'projects')
+    ->label('sdk.method', 'updateAuthPasswordAi')
+    ->label('sdk.response.code', Response::STATUS_CODE_OK)
+    ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
+    ->label('sdk.response.model', Response::MODEL_PROJECT)
+    ->param('projectId', '', new UID(), 'Project unique ID.')
+    ->param('enabled', false, new Boolean(false), 'Set whether or not to enable checking user\'s password against AI opinion. Default is false.')
+    ->inject('response')
+    ->inject('dbForConsole')
+    ->action(function (string $projectId, bool $enabled, Response $response, Database $dbForConsole) {
+
+        $project = $dbForConsole->getDocument('projects', $projectId);
+
+        if ($project->isEmpty()) {
+            throw new Exception(Exception::PROJECT_NOT_FOUND);
+        }
+
+        $auths = $project->getAttribute('auths', []);
+        $auths['passwordAi'] = $enabled;
+
+        $dbForConsole->updateDocument('projects', $project->getId(), $project
+            ->setAttribute('auths', $auths));
+
+        $response->dynamic($project, Response::MODEL_PROJECT);
+    });
+
 App::patch('/v1/projects/:projectId/auth/personal-data')
     ->desc('Enable or disable checking user passwords for similarity with their personal data.')
     ->groups(['api', 'projects'])

app/controllers/api/users.php

@@ -162,7 +162,7 @@ App::post('/v1/users')
     ->param('userId', '', new CustomId(), 'User ID. Choose a custom ID or generate a random ID with `ID.unique()`. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char. Max length is 36 chars.')
     ->param('email', null, new Email(), 'User email.', true)
     ->param('phone', null, new Phone(), 'Phone number. Format this number with a leading \'+\' and a country code, e.g., +16175551212.', true)
-    ->param('password', '', fn ($project, $passwordsDictionary) => new PasswordDictionary($passwordsDictionary, $project->getAttribute('auths', [])['passwordDictionary'] ?? false), 'Plain text user password. Must be at least 8 chars.', true, ['project', 'passwordsDictionary'])
+    ->param('password', '', fn ($project, $passwordsDictionary10k) => new PasswordDictionary($passwordsDictionary10k, $project->getAttribute('auths', [])['passwordDictionary'] ?? false), 'Plain text user password. Must be at least 8 chars.', true, ['project', 'passwordsDictionary10k'])
     ->param('name', '', new Text(128), 'User name. Max length: 128 chars.', true)
     ->inject('response')
     ->inject('project')
@@ -1069,7 +1069,7 @@ App::patch('/v1/users/:userId/password')
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_USER)
     ->param('userId', '', new UID(), 'User ID.')
-    ->param('password', '', fn ($project, $passwordsDictionary) => new PasswordDictionary($passwordsDictionary, $project->getAttribute('auths', [])['passwordDictionary'] ?? false), 'New user password. Must be at least 8 chars.', false, ['project', 'passwordsDictionary'])
+    ->param('password', '', fn ($project, $passwordsDictionary10k) => new PasswordDictionary($passwordsDictionary10k, $project->getAttribute('auths', [])['passwordDictionary'] ?? false), 'New user password. Must be at least 8 chars.', false, ['project', 'passwordsDictionary10k'])
     ->inject('response')
     ->inject('project')
     ->inject('dbForProject')

src/Appwrite/Auth/Validator/PasswordAi.php

@@ -0,0 +1,110 @@
+<?php
+
+namespace Appwrite\Auth\Validator;
+
+/**
+ * Password.
+ *
+ * Validates user password string
+ */
+class PasswordAi extends Password
+{
+    public function __construct()
+    {
+    }
+
+    /**
+     * Get Description.
+     *
+     * Returns validator description
+     *
+     * @return string
+     */
+    public function getDescription(): string
+    {
+        return 'Password must be at least 8 characters and must be approved by AI.';
+    }
+
+    /**
+     * Is valid.
+     *
+     * @param mixed $value
+     *
+     * @return bool
+     */
+    public function isValid($value): bool
+    {
+        if (!parent::isValid($value)) {
+            return false;
+        }
+
+        $prompt = 'My password is "' . $value . '". Check my password and tell me if it could include day, year, month, date, name, surname, animal name, location, city, animal breed, or state in any shape or form. Answer "Yes" if it does, and "no" if it doesnt. Only answer with 1 word.';
+
+        $answer = '';
+
+        $ch = curl_init('http://appwrite-assistant:3003/');
+        $responseHeaders = [];
+        $query = json_encode(['prompt' => $prompt]);
+        $headers = ['accept: text/event-stream'];
+        $handleEvent = function ($ch, $data) use ($answer) {
+            $answer .= $data;
+            return \strlen($data);
+        };
+
+        curl_setopt($ch, CURLOPT_WRITEFUNCTION, $handleEvent);
+
+        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
+        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
+        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
+        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 0);
+        curl_setopt($ch, CURLOPT_TIMEOUT, 9000);
+        curl_setopt($ch, CURLOPT_HEADERFUNCTION, function ($curl, $header) use (&$responseHeaders) {
+            $len = strlen($header);
+            $header = explode(':', $header, 2);
+
+            if (count($header) < 2) { // ignore invalid headers
+                return $len;
+            }
+
+            $responseHeaders[strtolower(trim($header[0]))] = trim($header[1]);
+
+            return $len;
+        });
+
+        curl_setopt($ch, CURLOPT_POSTFIELDS, $query);
+
+        curl_exec($ch);
+
+        curl_close($ch);
+
+        if($answer !== 'Yes') {
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Is array
+     *
+     * Function will return true if object is array.
+     *
+     * @return bool
+     */
+    public function isArray(): bool
+    {
+        return false;
+    }
+
+    /**
+     * Get Type
+     *
+     * Returns validator type.
+     *
+     * @return string
+     */
+    public function getType(): string
+    {
+        return self::TYPE_STRING;
+    }
+}

src/Appwrite/Extend/Exception.php

@@ -74,6 +74,7 @@ class Exception extends \Exception
     public const USER_NOT_FOUND                    = 'user_not_found';
     public const USER_PASSWORD_RECENTLY_USED       = 'password_recently_used';
     public const USER_PASSWORD_PERSONAL_DATA       = 'password_personal_data';
+    public const USER_PASSWORD_AI                  = 'password_ai';
     public const USER_EMAIL_ALREADY_EXISTS         = 'user_email_already_exists';
     public const USER_PASSWORD_MISMATCH            = 'user_password_mismatch';
     public const USER_SESSION_NOT_FOUND            = 'user_session_not_found';

src/Appwrite/Utopia/Response/Model/Project.php

@@ -132,6 +132,24 @@ class Project extends Model
                 'default' => false,
                 'example' => true,
             ])
+            ->addRule('authPasswordDictionaryLength', [
+                'type' => self::TYPE_BOOLEAN,
+                'description' => 'How many most commonly used password to check against. Possible values are: 10k, 100k, 1m, 10m',
+                'default' => '10k',
+                'example' => '1m',
+            ])
+                ->addRule('authPasswordAi', [
+                    'type' => self::TYPE_BOOLEAN,
+                    'description' => 'Whether or not to check user\'s password against against AI opinion',
+                    'default' => false,
+                    'example' => true,
+                ])
+                ->addRule('authSessionRefresh', [
+                    'type' => self::TYPE_BOOLEAN,
+                    'description' => 'Whether or not sessions are automatically extended to session duration on every request',
+                    'default' => false,
+                    'example' => true,
+                ])
             ->addRule('authPersonalDataCheck', [
                 'type' => self::TYPE_BOOLEAN,
                 'description' => 'Whether or not to check the user password for similarity with their personal data.',
@@ -320,6 +338,10 @@ class Project extends Model
         $document->setAttribute('authSessionsLimit', $authValues['maxSessions'] ?? APP_LIMIT_USER_SESSIONS_DEFAULT);
         $document->setAttribute('authPasswordHistory', $authValues['passwordHistory'] ?? 0);
         $document->setAttribute('authPasswordDictionary', $authValues['passwordDictionary'] ?? false);
+        $document->setAttribute('authPasswordDictionaryLength', $authValues['passwordDictionaryLength'] ?? false);
+        $document->setAttribute('authPasswordAi', $authValues['passwordAi'] ?? false);
+        $document->setAttribute('authSessionRefresh', $authValues['sessionRefresh'] ?? false);
+        // TODO: Khushboo add here
         $document->setAttribute('authPersonalDataCheck', $authValues['personalDataCheck'] ?? false);
 
         foreach ($auth as $index => $method) {