Check passwords against breach data in Ruby

require "io/console"
require "json"
require "net/http"

PASSWORD_ENDPOINT = URI("https://api.finowl.co/v1/breaches/password")

# Returns how many times the password appears in breach data (0 when never seen).
def password_breach_count(password, attempts: 3)
  attempts.times do
    response = Net::HTTP.start(PASSWORD_ENDPOINT.host, PASSWORD_ENDPOINT.port, use_ssl: true,
                               open_timeout: 5, read_timeout: 10) do |http|
      request = Net::HTTP::Post.new(PASSWORD_ENDPOINT)
      request["Authorization"] = "Bearer #{ENV.fetch("FINOWL_API_KEY")}"
      request["Content-Type"] = "application/json"
      request.body = JSON.generate(password: password)
      http.request(request)
    end

    case response
    when Net::HTTPSuccess
      return JSON.parse(response.body).fetch("count")
    when Net::HTTPBadRequest
      # Never echo the password itself in errors or logs.
      raise ArgumentError, "Password is empty or longer than 4096 characters"
    when Net::HTTPUnauthorized
      raise "FINOWL_API_KEY is missing or invalid"
    when Net::HTTPTooManyRequests
      code = JSON.parse(response.body).dig("error", "code")
      raise "Finowl credits are used up" if code == "quota_exceeded"

      sleep [response["Retry-After"].to_i, 1].max
    else
      raise "Finowl returned HTTP #{response.code}; not retrying"
    end
  end
  raise "Still rate limited after #{attempts} attempts"
end

print "Choose a password: "
password = $stdin.noecho(&:gets).to_s.chomp
puts

count = password_breach_count(password)
if count.positive?
  puts "That password has been seen #{count} times in breach data. Pick another."
else
  puts "Not found in known breach data."
end