Split out Password(Hash) to 'password-types'

[Vlix]

Basically just doing #20

[cdepillabout]

I think that all is required here is to just bump the patch version, so this could probably just be 2.0.0.2?

[Vlix]

I'm not sure either, but depending on a different library feels more than just "a patch" to me. If you'd be running everything locally and just downloaded the new patched version of password-instances, you'd probably not expect everything to break, just because you don't have a certain package downloaded, right? (I wouldn't, at least)

[cdepillabout]

I saw your comment here: #38 (comment)

I've been thinking about this for a few days, and I think according to the PVP we'd be fine to just bump the patch version or minor version, but maybe we should go ahead and just bump everything to 3.0.0.0? Splitting off password-types is a pretty significant change (in some ways?), and we've also had a bunch of big changes/additions in the 2.X series. I don't think it would be that crazy to just bump all password-types, password-instances, and password to 3.0.

If you have a family of libraries, sometimes it is easier when they all keep the same major version.

Although I don't really feel strongly about any of this, so I basically support whatever you want to do with the version.

[Vlix]

The comment in #38 was about the documentation and defaultPasswordPolicy update. I'd like to update the package before moving it over to 3.0.0.0 with this password-types split.
Just so the newest version of v2 has good recommendations in the Data.Password.Validate module.

Though the idea of just bumping all libraries to 3.0.0.0 is nice and easy, the whole point of the split was that the packages would be more loosely connected, right?

1. I don't see why the password-types library shouldn't start at 1.0.0.0, and 2) the password-instances library is more of an addition to password-types, so I wouldn't expect it to be in line with password.

I've checked the PVP too, and I think you're right, though. 2.0.0.2 should be enough.

[cdepillabout]

I've been using Servant for a long time, and at some point they were releasing all the related libraries with the same major version. It was easy to see what versions needed to be used with each other. I was thinking that the same could apply here.

Although a good argument against this is that they were using the PVP, and the versions naturally drifted apart, and now some of them are on different major versions. So it is not helpful anymore. I could imagine us getting into this same situation, so maybe it doesn't make any sense to make the initial release with everything on the same major version.

Like I said above, I don't feel strongly about the versions, and I'm completely fine with starting password-types at 1.0.0.0 as well.

[Vlix]

Set everything up so that:

• password-types: 1.0.0.0
• password-instances: 2.0.0.2
• password: 3.0.0.0

[cdepillabout]

I think this all looks good, thanks for putting it together!

Sorry for taking so long to get to this review.

When you merge this in, please feel free to make a release to Hackage, and please add me as a maintainer to the password-types package. Otherwise, I could make a release and add you as a maintainer.

[Vlix]

We're all busy with our own things, don't worry! It's already great you take the time to review this 👍
I'll see if I have the time to make the last changes to this PR today, otherwise that'll be next week or the week after, probably.
This is a big enough change to take the time to do right, IMHO.

[Vlix]

Ok, if I didn't screw anything up, this should be the final tweaks... right? 😆

• I've changed the module of password-types to Data.Password.Types, just because it makes more sense. (cf. http-types)
• Salt has been moved to password-types
• Documentation tweaks/additions
• bumped cryptonite constraint

[cdepillabout]

I think this looks really good!

[Vlix]

I just realised, if the password-instances version only gets a PATCH bump, it might cause users to think it doesn't actually do much, though if used in combination with password-2.*, that would mean you'd have two different datatypes of Password, one in password-types, which has instances in password-instances-2.0.0.3, and one in password-2.1.1.0 which has instances in password-instances-2.0.0.2.

So based on that, I updated the version of password-instances to 3.0.0.0. Do you have any opinion about this? @cdepillabout

[cdepillabout]

I updated the version of password-instances to 3.0.0.0. Do you have any opinion about this?

Yeah, that sounds good to me. Thanks for considering this!

[Vlix]

I want to wait with releasing 3.0.0.0 to take the opportunity to also include the Argon2 bugfix of #42 , so I opt to keep this open until that is sorted.