fix(auth-ui): org-first resolution everywhere + org password-complexity policy

Extends the resolveOrg org-first/default-org fallback to every remaining org-scoped read so login/SSO/signup/reset use the ORG's IdPs, branding, login settings and password policy instead of the instance/default context - matching the old app's 'organization ?? getDefaultOrg()' invariant on every page.

- SSO IdP-list flows (sso-link/action/management) route through the idp-providers getActiveIdPs choke point, which now resolves the org. - /login loader threads a resolved org into ?organization on direct entry so the whole ceremony inherits it. - All remaining per-screen + service settings/branding reads (login method/password, signup, password reset, mfa/otp/webauthn/session/authorize) resolve org-first. - Re-implement the org password-complexity policy (previously fetched nowhere): a live requirement checklist + client/server validation driven by getPasswordComplexity across signup/reset/change. findUser stays instance-wide (intentional); sso-callback left as-is (WIP-adjacent).

Author: yahyafakhroji

app/components/auth-form/password-requirements.tsx

@@ -0,0 +1,57 @@
+import type { PasswordComplexity } from '@/modules/auth/types';
+import { passwordRules } from '@/resources/schemas/password-complexity';
+import { Form } from '@datum-cloud/datum-ui/form';
+
+export interface PasswordRequirementsProps {
+  /** The org's fetched complexity policy (from the loader). Undefined → default (min length only). */
+  policy?: PasswordComplexity;
+  /** The form field to watch. Defaults to `password`. */
+  fieldName?: string;
+}
+
+/**
+ * Live password-requirement checklist. Reads the entered password reactively (Form.useWatch) and
+ * ticks each requirement off as it is satisfied. The requirement set is POLICY-DRIVEN — derived
+ * from the same `passwordRules(policy)` the Zod validator uses, so what the user sees and what the
+ * form accepts never drift. Must be rendered inside a `<Form.Root>` (adapter context).
+ */
+export function PasswordRequirements({
+  policy,
+  fieldName = 'password',
+}: PasswordRequirementsProps): React.JSX.Element {
+  const value = Form.useWatch<string>(fieldName) ?? '';
+  const rules = passwordRules(policy);
+
+  return (
+    <ul
+      aria-label="Password requirements"
+      // polite: announce a requirement becoming satisfied without interrupting typing.
+      aria-live="polite"
+      className="flex flex-col gap-1 text-sm">
+      {rules.map((rule) => {
+        const met = rule.test(value);
+        return (
+          <li
+            key={rule.id}
+            data-rule={rule.id}
+            data-met={met}
+            className={[
+              'flex items-center gap-2',
+              met ? 'text-foreground' : 'text-muted-foreground',
+            ].join(' ')}>
+            <span
+              aria-hidden="true"
+              className={[
+                'inline-flex size-4 items-center justify-center rounded-full text-xs',
+                met ? 'bg-primary text-primary-foreground' : 'border-muted-foreground/40 border',
+              ].join(' ')}>
+              {met ? '✓' : ''}
+            </span>
+            <span>{rule.requirement}</span>
+            <span className="sr-only">{met ? ' — satisfied' : ' — not yet satisfied'}</span>
+          </li>
+        );
+      })}
+    </ul>
+  );
+}

app/modules/auth/providers/fake/fake-provider.ts

@@ -81,6 +81,13 @@ interface Seed {
   deviceAuths?: DeviceAuthSeed[]; // P6: device authorization requests keyed by userCode
   samlRequests?: SamlRequestSeed[]; // P6: SAML auth requests
   ldapUsers?: LdapUserSeed[]; // P6: LDAP credential fixtures
+
+  /**
+   * The password-complexity policy getPasswordComplexity returns. Configurable so tests can drive
+   * the policy-driven password rules (e.g. requiresSymbol=true). Defaults to min 8 / no required
+   * character classes — the legacy behaviour the forms assumed before the policy was wired in.
+   */
+  passwordComplexity?: PasswordComplexity;
 }
 
 export class FakeAuthProvider implements AuthProvider {
@@ -117,6 +124,7 @@ export class FakeAuthProvider implements AuthProvider {
   private deviceAuthSeeds: DeviceAuthSeed[]; // P6
   private samlRequestSeeds: SamlRequestSeed[]; // P6
   private ldapUserSeeds: LdapUserSeed[]; // P6
+  private passwordComplexity: PasswordComplexity; // configurable complexity policy fixture
   private authorizedDevices = new Set<string>(); // P6: deviceAuthId → authorized
   // Fake-only: per-session outcome scripts for getSession/createCallback (see FakeOutcomeScript).
   private sessionResults = new Map<string, FakeOutcomeScript>();
@@ -151,6 +159,13 @@ export class FakeAuthProvider implements AuthProvider {
     this.deviceAuthSeeds = seed.deviceAuths ?? []; // P6
     this.samlRequestSeeds = seed.samlRequests ?? []; // P6
     this.ldapUserSeeds = seed.ldapUsers ?? []; // P6
+    this.passwordComplexity = seed.passwordComplexity ?? {
+      minLength: 8,
+      requiresUppercase: false,
+      requiresLowercase: false,
+      requiresNumber: false,
+      requiresSymbol: false,
+    };
   }
 
   // ─── settings ────────────────────────────────────────────────────────────────
@@ -186,13 +201,8 @@ export class FakeAuthProvider implements AuthProvider {
   }
 
   async getPasswordComplexity(_orgId?: string): Promise<PasswordComplexity | undefined> {
-    return {
-      minLength: 8,
-      requiresUppercase: false,
-      requiresLowercase: false,
-      requiresNumber: false,
-      requiresSymbol: false,
-    };
+    // Returns the configurable fixture (seed.passwordComplexity), defaulting to min 8 / no classes.
+    return this.passwordComplexity;
   }
 
   // getLegalSupport removed from the port (zero callers) — dropped here too.