Lucky valdator to make sure a password isn't in the Have I Been Pwned database

not_pwned_validation.cr

require "http/client"
require "openssl"

module NotPwnedValidation
  def validate_not_in_hibp
    password.value.try do |value|
      hash = get_sha1_hash(value).upcase
      first_five = hash[0...5]
      response = HTTP::Client.get("https://api.pwnedpasswords.com/range/" + first_five)
      hashes = response.body.split("\r\n")
          .map(&.split(':'))
          .to_h

      exists = hashes.has_key?(hash[5..-1])

      if exists
        password.add_error("has been pwned. Please choose another.")
      end
    end
  end

  private def get_sha1_hash(password)
    digest = OpenSSL::Digest.new("SHA1")
    digest.update(password)
    hash = digest.to_s
    digest.reset
    hash
  end
end