superadmin: check complexity password server side

spec/models/super_admin_spec.rb

@@ -61,4 +61,43 @@ describe SuperAdmin, type: :model do
       expect { subject }.to change { super_admin.reload.otp_secret }.to(nil)
     end
   end
+
+  describe '#password_complexity' do
+    # This password list is sorted by password complexity, according to zxcvbn (used for complexity evaluation)
+    # 0 - too guessable: risky password. (guesses < 10^3)
+    # 1 - very guessable: protection from throttled online attacks. (guesses < 10^6)
+    # 2 - somewhat guessable: protection from unthrottled online attacks. (guesses < 10^8)
+    # 3 - safely unguessable: moderate protection from offline slow-hash scenario. (guesses < 10^10)
+    # 4 - very unguessable: strong protection from offline slow-hash scenario. (guesses >= 10^10)
+    passwords = ['pass', '12pass23', 'démarches ', 'démarches-simple', '{My-$3cure-p4ssWord}']
+    min_complexity = PASSWORD_COMPLEXITY_FOR_ADMIN
+
+    let(:email) { 'mail@beta.gouv.fr' }
+    let(:super_admin) { build(:super_admin, email: email, password: password) }
+
+    subject do
+      super_admin.save
+      super_admin.errors.full_messages
+    end
+
+    context 'when password is too short' do
+      let(:password) { 's' * (PASSWORD_MIN_LENGTH - 1) }
+
+      it { expect(subject).to eq(["Le mot de passe est trop court"]) }
+    end
+
+    context 'when password is too simple' do
+      passwords[0..(min_complexity - 1)].each do |password|
+        let(:password) { password }
+
+        it { expect(subject).to eq(["Le mot de passe n’est pas assez complexe"]) }
+      end
+    end
+
+    context 'when password is acceptable' do
+      let(:password) { passwords[min_complexity] }
+
+      it { expect(subject).to eq([]) }
+    end
+  end
 end