Check breached passwords in PHP before hashing

<?php

declare(strict_types=1);

/** Returns how often $password appears in breach data. Never log $password. */
function breachedPasswordCount(#[SensitiveParameter] string $password): int
{
    for ($attempt = 0; $attempt < 3; $attempt++) {
        $retryAfter = 1;
        $ch = curl_init('https://api.finowl.co/v1/breaches/password');
        curl_setopt_array($ch, [
            CURLOPT_POST => true,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT => 5,
            CURLOPT_HTTPHEADER => [
                'Authorization: Bearer ' . getenv('FINOWL_API_KEY'),
                'Content-Type: application/json',
            ],
            CURLOPT_POSTFIELDS => json_encode(['password' => $password], JSON_THROW_ON_ERROR),
            CURLOPT_HEADERFUNCTION => function ($ch, string $header) use (&$retryAfter): int {
                if (stripos($header, 'Retry-After:') === 0) {
                    $retryAfter = max(1, (int) trim(substr($header, 12)));
                }
                return strlen($header);
            },
        ]);
        $body = curl_exec($ch);
        if ($body === false) {
            throw new RuntimeException('Password check network error: ' . curl_error($ch));
        }
        $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
        $data = json_decode($body, true) ?? [];
        $code = $data['error']['code'] ?? 'unknown_error';

        switch (true) {
            case $status === 200:
                return $data['breached'] ? (int) $data['count'] : 0;
            case $status === 400:
                throw new InvalidArgumentException("Password failed validation: {$code}");
            case $status === 401:
                throw new RuntimeException('Unauthorized: check FINOWL_API_KEY');
            case $status === 429 && $code === 'rate_limited':
                sleep($retryAfter);
                break;
            default:
                throw new RuntimeException("Password check failed: {$status} {$code}");
        }
    }
    throw new RuntimeException('Password check still rate limited');
}

$count = breachedPasswordCount((string) getenv('CANDIDATE_PASSWORD'));
echo $count > 0
    ? 'Seen ' . number_format($count) . ' times in breach data. Choose another password.' . PHP_EOL
    : 'Not found in breach data.' . PHP_EOL;