pwd_reducer.js

switch (action.type) {
  // ...
  case 'CHECK_PASSWORD': {
    // the following should probably be configurable settings
    // v v v v v v v v v v
    const minPasswordLength = 8
    const maxPasswordLength = 30
    const pwRegSpecial = /[_:!#$%=+<>-]/
    const pwBadChars = /[^\w:!#$%=+<>-]/
    const pwRegLower = /[a-z]/
    const pwRegUpper = /[A-Z]/
    const pwRegNumber = /[\d]/
    const PWD_ERROR = '1'
    const PWD_VALID = '2'
    // ^ ^ ^ ^ ^ ^ ^ ^ ^ ^

    const pass = action.payload.value
    const username = state.userObj.Username.toLowerCase()
    const pwOk = [
      // 0
      pass.length < minPasswordLength ? PWD_ERROR : PWD_VALID,
      // 1
      pass.length > maxPasswordLength ? PWD_ERROR : PWD_VALID,
      // 2
      !pwRegSpecial.test(pass) || pwBadChars.test(pass) ? PWD_ERROR : PWD_VALID,
      // 3
      !pwRegLower.test(pass) ? PWD_ERROR : PWD_VALID,
      // 4
      !pwRegUpper.test(pass) ? PWD_ERROR : PWD_VALID,
      // 5
      !pwRegNumber.test(pass) ? PWD_ERROR : PWD_VALID,
      // 6
      username.includes(pass.toLowerCase()) ||
      pass.toLowerCase().includes(username)
        ? PWD_ERROR
        : PWD_VALID,
    ]

    let passStatus
    if (pwOk.includes('1')) {
      passStatus = {
        class: 'sl-text-error',
        text: 'Password does not meet requirements',
      }
    } else {
      passStatus = {
        class: 'slds-success',
        text: 'Password meets requirements',
      }
    }

    newObj = state.userObj
    newObj[action.payload.apiName] = action.payload.value
    return Object.assign({}, state, {
      passwordOk: pwOk,
      passwordStatus: passStatus,
      userObj: newObj,
    })
  }

  // ...
  default:
}

I switched all of you <string>.match(<regex>) calls to <regex>.test(<string>) for performance reasons, probably doesn't matter. Also, I optimized all of your regex patterns.

Note in the diff set you missed the : character in the bad characters regex.

I also removed some dead code where you expected pwOk.includes('0'). I am still trying to figure out what is going on there since you explicitly set all of the index to a non-zero value.

And the last comment is that you protect against the password containing the username, but not the username containing the password. Maybe that is ok... I guess.