yeah, that’s what I was thinking but it occurs to me that :password is an argument to those actions and not actually an attribute as we never want to store the plaintext password.

@adw632 has it right.

The other options are to override the register_with_password action and add your own validations, but probable the best way is to add a custom validation in the global validations block.

For example:

validations do
  validate string_length(:password. min: 20) do
    where action_is(:register_with_password)
  end
end

Probably some options for password validation would be useful. Password validation policies can be quite varied and often specified by corporate numskulls.

Examples of constraints can include password length, character complexity, dictionary word checks, blacklists, not “similar” to the previous one (or “recent” ones).

I think some escape hatch for specifying a validator would be good to provide full flexibility.

There may be some opportunity to avoid the specific racing/inconsistency problem above of “at least 8” and then “at least 20”, possibly by coalescing/overriding validations of the same type.