feat: add minimum password entropy requirements (#6090)

* feat: add minimum password entropy requirements

* Fix all the tests

* Fix E2E tests

coderd/userpassword/userpassword.go

@@ -10,6 +10,7 @@ import (
 	"strconv"
 	"strings"
 
+	passwordvalidator "github.com/wagslane/go-password-validator"
 	"golang.org/x/crypto/pbkdf2"
 	"golang.org/x/exp/slices"
 	"golang.org/x/xerrors"
@@ -125,15 +126,14 @@ func hashWithSaltAndIter(password string, salt []byte, iter int) string {
 // Validate checks that the plain text password meets the minimum password requirements.
 // It returns properly formatted errors for detailed form validation on the client.
 func Validate(password string) error {
-	const (
-		minLength = 8
-		maxLength = 64
-	)
-	if len(password) < minLength {
-		return xerrors.Errorf("Password must be at least %d characters.", minLength)
+	// Ensure passwords are secure enough!
+	// See: https://github.com/wagslane/go-password-validator#what-entropy-value-should-i-use
+	err := passwordvalidator.Validate(password, 52)
+	if err != nil {
+		return err
 	}
-	if len(password) > maxLength {
-		return xerrors.Errorf("Password must be no more than %d characters.", maxLength)
+	if len(password) > 64 {
+		return xerrors.Errorf("password must be no more than %d characters", 64)
 	}
 	return nil
 }