$ show apple/password-manager-resources
This repository is a curated collection of website-specific 'quirks' (hard-coded behaviors) for password managers, maintained by Apple. It contains structured JSON datasets including password rules (to generate compatible passwords), shared credential relationships (domains that share login backends), change-password URLs, 2FA appending sites, and web browser extension distribution information. The repo also includes reference implementations: a Password Rules language parser (JavaScript) and a regex-to-Password-Rules converter, along with validation and formatting scripts. While primarily a data curation project, the tools are reusable components for any password manager implementation. The data is validated against JSON schemas and linted in CI, ensuring high quality. The repository is actively maintained with frequent contributions from the community.
The LLM identified 2 files worth highlighting for reuse:
A self-contained JavaScript parser for the Password Rules language (used by Apple's password autofill). It tokenizes rule strings, validates syntax, and canonicalizes character classes (e.g., merging overlapping ranges into named classes like 'upper', 'digit', 'special'). The parser is well-structured, handles edge cases (hyphen/bracket positioning, escaped characters), and can be reused by any password manager to interpret password rules from the quirks data. It demonstrates non-obvious skill in character class bit-set manipulation and canonicalization logic.
A utility that converts regular expression patterns (commonly used by websites to define password policies) into the Password Rules format. It handles positive lookaheads for required character types, character classes for allowed characters, and quantifiers for length constraints. The converter is isolated, well-tested (with a companion test file), and can be extracted and used by password managers to automatically generate rules from regex patterns found on websites. It demonstrates careful handling of hyphen/bracket normalization and implicit allowed character deduction.