resolveChangeCredentialPolicy()

resolveChangeCredentialPolicy resolves the rules a change-credential form should enforce for a given credential: an explicit override wins outright, otherwise the attribute's own regex from the user type schema (GET /users/me/meta) applies. Returns an empty policy (no rules) when neither is set, since the SDK never layers its own character-class or length rules on top of the organization's policy.

Signature

resolveChangeCredentialPolicy(
  userSchema: Record<string, AttributeSchema> | null | undefined,
  attribute: string,
  override?: PasswordPolicy,
): PasswordPolicy

Parameters

Parameter	Type	Required	Description
userSchema	Record<string, AttributeSchema> | null | undefined	✅	The user type schema resolved by the provider, keyed by attribute.
attribute	string	✅	The credential attribute this form manages, e.g. 'password' or 'pin'.
override	PasswordPolicy	❌	An explicit policy supplied by the caller, which wins outright.

Returns

PasswordPolicy: the policy to hand to evaluatePasswordPolicy() or evaluateChangePasswordForm().

Usage

import { evaluatePasswordPolicy, resolveChangeCredentialPolicy } from '@thunderid/browser'

const policy = resolveChangeCredentialPolicy(userSchema, 'pin', undefined)
const results = evaluatePasswordPolicy(candidate, policy)

Related

• evaluatePasswordPolicy(): Apply the resolved policy to a single value
• evaluateChangePasswordForm(): Apply it to a full new-value + confirmation form
• supportsCredential(): Check the same schema for whether the credential exists at all