[D8] Random Passcode Generate Widget

Hi moinak_dutta,

Automated Review

[Best practice issues identified by pareview.sh]

Manual Review

Individual user account

[Yes: Follows] the guidelines for individual user accounts.

No duplication

[Yes: Does not cause] module duplication and/or fragmentation.

Master Branch

[Yes: Follows] the guidelines for master branch.

Licensing

[Yes: Follows] the licensing requirements.

3rd party assets/code

[Yes: Follows] the guidelines for 3rd party assets/code.

README.txt/README.md

[No: Does not follow] the guidelines for in-project documentation and/or the README Template.

Code long/complex enough for review

[No: Does not follow] the guidelines for project length and complexity.

Secure code

[ No: List of security issues identified.]

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

This review uses the Project Application Review Template.

Hi ,

Please check the errors for this project in https://pareview.sh/node/2296

Thanks

Fixed the git clone URL in the issue summary for non-maintainer users.

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Fixed the git clone URL in the issue summary for non-maintainer users.

I'm a robot and this is an automated message from Project Applications Scraper.

The JS files in both versions contain copy-pasted docblocks from the examples module:

/**                                                                                
 * @file                                                                           
 * Javascript for Field Example.                                                   
 */                                                                                
                                                                                   
/**                                                                                
 * Provides a farbtastic colorpicker for the fancier widget.                       
 */

The module doesn't seem to support having more than one passcode field in a form; you can add more than one but:

* The setting for how many digits the field should contain only gets added to the page once, so the first(?) field's configuration will apply to all instances.
* The JS behaviour for the button targets classes (.passcode_generate_btn and .passcode_random_number) which will be the same for all instances of the field on the form. So clicking the button will update all copies of the field with the same value.

There's no fallback for non-JS; as far as I can see without JS passcode fields will mysteriously do nothing very much.

It's not entirely clear what the purpose of these passcodes might be, but if they're being used for anything security-related there are a couple of considerations:

* Why restrict the possible lengths to 3-10 chars? (presumably because of how the pseudo-random codes are being generated in JS as Math.random will only generate so many digits / characters)
* Why make all the alpha characters uppercase as this reduces entropy? (again presumably because of the implementation?)
* Math.random "does not provide cryptographically secure random numbers. Do not use them for anything related to security". Per that documentation, perhaps it would be better to use "the Web Crypto API instead, and more precisely the window.crypto.getRandomValues() method."? Note that's still just a way of generating numbers though; generating "good" passcodes would need more work.

The way the codes are generated might be fine for some use-cases, but it might be worth making it clear somewhere that they're relatively low entropy codes (because of their length and composition).

Hello moinak_dutta,
Nice module, I am sure it will be useful. I tested the module with Drupal best practices and everything looks good. I added a passcode field and tested all the generated codes. It looks good.

There are two issues in pareview, see details: https://pareview.sh/pareview/https-git.drupal.org-project-passcode_field...

Review of the 8.x-1.x branch (commit 1be2676):

• Your README.txt does not follow best practices (headings need to be uppercase).
• No automated test cases were found, did you consider writing PHPUnit tests? This is not a requirement but encouraged for professional software development.

This automated report was generated with PAReview.sh, your friendly project application review script.

If you are still working on this application, you should fix all known problems and set the status to Needs review. (See also the project application workflow.)
Please don't change status of this application if you aren't sure you have time to dedicate to this application, or it will be closed again as won't fix.

I am closing this application due to lack of activity.