From 997166bb617ff3ce1ec92c03f23b4436166733c1 Mon Sep 17 00:00:00 2001
From: Mir Bhatia <m.bhatia@openproject.com>
Date: Thu, 30 Apr 2026 15:07:47 +0200
Subject: [PATCH] Update to use constant instead of magic numbers

---
 app/models/setting.rb                                         | 4 +++-
 .../settings/authentication_settings/_passwords.html.erb      | 2 +-
 config/constants/settings/definition.rb                       | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/models/setting.rb b/app/models/setting.rb
index cf055f2651b..9da3acc74cb 100644
--- a/app/models/setting.rb
+++ b/app/models/setting.rb
@@ -35,6 +35,8 @@ class Setting < ApplicationRecord
   extend Aliases
   extend MailSettings
 
+  PASSWORD_MAX_LENGTH = 128
+
   ENCODINGS = %w(US-ASCII
                  windows-1250
                  windows-1251
@@ -95,7 +97,7 @@ class Setting < ApplicationRecord
             numericality: {
               only_integer: true,
               greater_than_or_equal_to: 1,
-              less_than_or_equal_to: 128,
+              less_than_or_equal_to: PASSWORD_MAX_LENGTH,
               if: ->(setting) { setting.name == "password_min_length" }
             }
 
diff --git a/app/views/admin/settings/authentication_settings/_passwords.html.erb b/app/views/admin/settings/authentication_settings/_passwords.html.erb
index 7eb0bcb0f6d..df8a0b98db4 100644
--- a/app/views/admin/settings/authentication_settings/_passwords.html.erb
+++ b/app/views/admin/settings/authentication_settings/_passwords.html.erb
@@ -53,7 +53,7 @@ See COPYRIGHT and LICENSE files for more details.
                       type: :number,
                       size: 6,
                       min: 1,
-                      max: 128,
+                      max: Setting::PASSWORD_MAX_LENGTH,
                       input_width: :small
 
       form.check_box_group(name: :password_active_rules,
diff --git a/config/constants/settings/definition.rb b/config/constants/settings/definition.rb
index c782a93c41c..a4fdd36b047 100644
--- a/config/constants/settings/definition.rb
+++ b/config/constants/settings/definition.rb
@@ -829,7 +829,7 @@ module Settings
       password_min_length: {
         default: 10,
         format: :integer,
-        allowed: (1..128)
+        allowed: -> { 1..Setting::PASSWORD_MAX_LENGTH }
       },
       # TODO: turn into array of ints
       # Requires a migration to be written