Bug report: plugins/credential-password rejects WithPasswordMinLength(6)

[sayem314]

Summary

credentialpassword.WithPasswordMinLength(6) fails at plugin initialization with "password min length must be at least 4", even though 6 is above 4. The minimum usable length is hard-capped at 8 because Initialize compares the configured value against defaultMinPasswordLength (8) but the error message hardcodes "at least 4", which is misleading.

Steps to reproduce

1. Configure the credential password plugin with a minimum length below 8:
   credentialpassword.New(credentialpassword.WithPasswordMinLength(6))
2. Initialize Limen with that plugin.
3. Observe startup failure.

Expected behaviour

WithPasswordMinLength(6) should be accepted and enforce a 6-character minimum (values >= some sane floor, e.g. 4 as the error message suggests). The error message should reflect the actual floor.

Actual behaviour

init limen: failed to initialize plugin credential-password: password min length must be at least 4

Root cause in plugin.go Initialize:

if p.config.passwordMinLength < defaultMinPasswordLength { // defaultMinPasswordLength = 8
    return fmt.Errorf("password min length must be at least 4") // hardcoded, not 8
}

So the effective floor is 8 (the constant), not 4 (the message). Self-hosted apps that want a looser policy (e.g. length 6) cannot, even though the option appears to support lowering it.

Affected module

plugins/credential-password

Limen version(s)

plugins/credential-password v0.1.4 - (also confirmed present in v0.2.0: defaultMinPasswordLength = 8, same Initialize check)

Go version

go version go1.26.0 darwin/arm64

OS / environment

macOS, any platform

Additional context

• The config struct exposes no custom password-validation override (only usernameValidationFunc is overridable), so there's no workaround via options.
• Options to consider: make the floor configurable, raise the documented/default constant, or correct the error message to reflect the constant (8). For self-hosted users, exposing a lower floor (>= 4) would be ideal.
• Applies to newly set/changed passwords only.

Checklist

• I have searched existing issues and this is not a duplicate.
• I have confirmed this is not a security vulnerability (which should be reported privately).