user/edit/password: check haveibeenpwned.com

[alxndrsn]

TODO

• check it's displayed correctly wrt strength meter
• link to relevant issue
• fix CI

---

Closes #

What has been done to verify that this works as intended?

• tested manually
• ci
• new tests

Why is this the best possible solution? Were any other approaches considered?

• request to haveibeenpwned.com API could be done server-side, but it introduces some issues with
• include a timeout in the fetch() call?
• manually cache layer could be removed; maybe haveibeenpwned.com API already offers HTTP caching which would be adequate?

How does this change impact users? Describe intentional behavior changes from code updates. What are the regression risks?

• help users choose better passwords
• might make changing password slower or more frustrating, especially if haveibeenpwned API is slow or down

Does this change require updates to user documentation? If so, please file an issue here and include the link below.

I don't think so.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 46fe608

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR