code: Add new safe API for constructing a code

.github/workflows/push.yml

@@ -234,6 +234,9 @@ jobs:
           toolchain: nightly
       - name: Check semver
         uses: obi1kenobi/cargo-semver-checks-action@v2
+        with:
+          feature-group: default-features
+          features: "all"
       - name: Extract Changelog
         uses: release-flow/keep-a-changelog-action@v3
         with:

CHANGELOG.md

@@ -9,8 +9,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- \[lib\]\[deprecated\] `magic_wormhole::transfer::send_*` and `request_file` methods to take an `OfferSend` and `OfferReceive` instead of using separate methods for files and folders. Use `transfer::send()` and `transfer::receive()` for the new methods.
-- \[lib\]\[breaking\] struct `transfer::ReceiveRequest` became an enum to prepare for transfer v2
+- \[all\]\[\breaking\] Code words with a secret password section shorter than 4 bytes are no longer accepted. This only breaks completely invalid uses of the code.
+- \[all\] Code words with a weak password section or a non-integer nameplate will throw an error in the long. This error can be upgraded to a hard error by enabling the "entropy" feature. This feature will become the default in the next major release.
+- \[lib\] Implemented FromStr for `Code` and `Nameplate`
+- \[lib\] Added new checked type for the `Password` section of a wormhole code
+- \[lib\] Added new `entropy` feature. When enabled, the entropy of the passed password will be checked on creation. This will change the signature of `MailboxConnection::create_with_password` to require the password to be passed via the new `Password` wrapper type.
+- \[lib\]\[deprecated\] Deprecated the `Code` and `Nameplate` `From<impl Into<String>>` implementations and `new()` methods. They are unchecked and will print a warning for now. These will be removed in the next breaking release.
 
 ## [0.7.1] - 2024-07-25
 

Cargo.toml

@@ -61,6 +61,7 @@ url = "2.2.2"
 tracing = "0.1"
 tracing-subscriber = "0.3"
 test-log = "0.2"
+zxcvbn = "3.1.0"
 
 [package]
 name = "magic-wormhole"
@@ -102,6 +103,7 @@ thiserror = { workspace = true }
 futures = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 percent-encoding = { workspace = true }
+zxcvbn = { workspace = true, optional = true }
 
 tracing = { workspace = true, features = ["log", "log-always"] }
 
@@ -147,6 +149,8 @@ eyre = { workspace = true }
 
 [features]
 
+# Check the entropy of custom codes. Will fail for any weak passwords.
+entropy = ["zxcvbn"]
 transfer = ["transit", "dep:tar", "dep:rmp-serde"]
 transit = [
     "dep:noise-rust-crypto",

cli/Cargo.toml

@@ -27,7 +27,7 @@ async-std = { workspace = true, features = ["attributes", "unstable"] }
 rand = { workspace = true }
 
 # CLI specific dependencies
-magic-wormhole = { path = "..", version = "0.7", features = ["all"] }
+magic-wormhole = { path = "..", version = "0.7", features = ["all", "entropy"] }
 clap = { workspace = true, features = ["cargo", "derive", "help"] }
 clap_complete = { workspace = true }
 env_logger = { workspace = true }