Automate the Boring Stuff CH 7: password strength test

Question

This exercise comes from Automate the Boring Stuff Ch 7. The assignment is to use regular expressions to test the strength of a password. Password must be >= 8 characters, contain at least one uppercase letter, one lowercase letter, and one number.

Any and all criticisms/suggestions for improving the code are welcome.

# function to test the strength of a password

import re

# pw = password
# function receives user input (password) as argument
def pw_strength_test(pw: str) -> bool:
    is_strong = True # final return value, change to False if test fails
    
    # lowercase, uppercase, and number regexes
    lower_regex = re.compile(r"[a-z]")
    upper_regex = re.compile(r"[A-Z]")
    num_regex = re.compile(r"\d")

    # store matches into lists
    lower_groups = lower_regex.findall(pw)
    upper_groups = upper_regex.findall(pw)
    num_groups = num_regex.findall(pw)

    # def a function to iterate over the regex lists
    # pass list and type into function
    # return number of items of that type
    def count_matches(match_list, match_type):
        count = 0
        try:
            if match_type == str and match_list[0].islower() == True:
                count = len(match_list)
            elif match_type == str and match_list[0].isupper() == True:
                count = len(match_list)
            elif match_type == int:
                count = len(match_list)
        # if no items in list, IndexError will be thrown
        except IndexError:
            print('IndexError thrown. One or more match lists are empty.')

        return count

    # store count into variables
    lower_count = count_matches(lower_groups, str)
    upper_count = count_matches(upper_groups, str)
    num_count = count_matches(num_groups, int)
    
    # if any list contains 0 items, pw test fails
    if lower_count == 0 or upper_count == 0 or num_count == 0:
        is_strong = False
        print("Error: password strength test failed.")
    # if less than 8 characters, pw test fails
    elif (lower_count + upper_count + num_count) < 8:
        is_strong = False
        print("Error: password strength test failed.")
    else:
        print("Password strength test passed.")

    return is_strong

print('Please enter your password.')
pw_strength_test(str(input()))
```

Answer 1

The current implementation is too complex. As soon as you get the results from the three findall() calls, you have essentially everything you need, but the function continues with over a dozen lines of unnecessary stuff. Remember that an empty collection evaluates to false in boolean terms, so if the goal is just to write a function that returns true or false, you could wrap up the logic as simply as this:

return lower_groups and upper_groups and num_groups and len(pw) >= 8

A password checker should not print. A password testing function should be a purely data-oriented function: it should take a password and return data; it should not have other side effects, such as printing. The returned data could be a bool (the simplest implementation) or it could be some other type of object: for example, a (bool, error_message) tuple; or just an error_message or None (the code example below takes the latter approach, reframing the function as a password-error-finder). In any case, you want to keep the in-depth checking logic in an easily-tested, data-oriented function. Leave the printing to a different part of the program.

Collections are often more powerful than separate variables. If you do want the function to provide a helpful error message (the current messages are not helpful, because they do not tell the user specifically what's wrong), you should consider bundling the checks into a collection so that any failed check can be linked to its corresponding message. The code below illustrates one way to do that kind of thing. It also provides a compact illustration of how data-centric thinking can radically simplify code. The function focuses nearly all of its attention on building a convenient data structure. And once we have that data, the rest of the algorithm/logic becomes almost trivial.

import re
from typing import Tuple

def check_password(pw: str) -> Tuple[str]:
    checks = {
        'must be at least 8 characters': r'.{8}',
        'must contain lowercase letter': r'[a-z]',
        'must contain uppercase letter': r'[A-Z]',
        'must contain digit': r'\d',
    }
    return tuple(
        err_msg
        for err_msg, pattern in checks.items()
        if not re.search(pattern, pw)
    )

Answer 2

The original problem description is rather thin. It doesn't require that you print anything, or even indicate why the password was weak. So your print() statements can go away. If you did want to add this feature - indicating why a password failed - then you'd either return an Enum instance (not a printable string), or raise an exception.

You can condense your regular expressions down to one:

import re


PASS_PATTERN = re.compile(
    r'''
    ^            # start of password
    (?=.*?[A-Z]) # lookahead: any characters, then an uppercase letter
    (?=.*?[a-z]) # lookahead: any characters, then a lowercase letter
    (?=.*?[0-9]) # lookahead: any characters, then a digit
    .{8,}        # at least eight characters
    $            # end of password
    ''',
    re.VERBOSE,
)


def is_strong_password(password: str) -> bool:
    return PASS_PATTERN.match(password) is not None