fix: align password policy to 8-72 printable ASCII on register (WealthLedger/backend#60) (#109)

src/modules/auth/presentation/auth.dto.ts

@@ -1,8 +1,9 @@
 import { ApiProperty } from '@nestjs/swagger';
 import { Transform } from 'class-transformer';
 import {
+  IsNotEmpty,
   IsString,
-  MinLength,
+  Matches,
   Validate,
   ValidatorConstraint,
 } from 'class-validator';
@@ -13,8 +14,10 @@ const FIRST_CHARACTER_INDEX = 0;
 const MAX_EMAIL_LENGTH = 254;
 const ASCII_SPACE = 32;
 const ASCII_DELETE = 127;
-const MIN_PASSWORD_LENGTH = 12;
+// bcrypt reads at most 72 bytes; printable ASCII keeps characters == bytes.
+const MIN_PASSWORD_LENGTH = 8;
 const MAX_PASSWORD_BYTES = 72;
+const PASSWORD_PATTERN = `^[\\x20-\\x7E]{${MIN_PASSWORD_LENGTH},${MAX_PASSWORD_BYTES}}$`;
 
 @ValidatorConstraint({ name: 'email' })
 class EmailConstraint {
@@ -40,8 +43,9 @@ class EmailConstraint {
   }
 }
 
-@ValidatorConstraint({ name: 'passwordBytes' })
-class PasswordBytesConstraint {
+// Login stays lenient: accounts created under an older policy must still sign in.
+@ValidatorConstraint({ name: 'passwordMaxBytes' })
+class PasswordMaxBytesConstraint {
   validate(value: unknown): boolean {
     return (
       typeof value === 'string' &&
@@ -50,11 +54,11 @@ class PasswordBytesConstraint {
   }
 
   defaultMessage(): string {
-    return 'must not exceed 72 UTF-8 bytes';
+    return `must not exceed ${MAX_PASSWORD_BYTES} UTF-8 bytes`;
   }
 }
 
-export class CredentialsDto {
+class EmailDto {
   @ApiProperty({ example: 'user@example.com' })
   @IsString()
   @Transform(({ value }: { value: unknown }) =>
@@ -62,14 +66,28 @@ export class CredentialsDto {
   )
   @Validate(EmailConstraint)
   declare email: string;
+}
 
+export class RegisterDto extends EmailDto {
   @ApiProperty({
-    minLength: MIN_PASSWORD_LENGTH,
-    maxLength: MAX_PASSWORD_BYTES,
+    description: `Raw password: ${MIN_PASSWORD_LENGTH}-${MAX_PASSWORD_BYTES} printable ASCII characters (letters, digits, symbols, space). Not trimmed or normalized.`,
+    pattern: PASSWORD_PATTERN,
     example: 'a secure password',
   })
   @IsString()
-  @MinLength(MIN_PASSWORD_LENGTH)
-  @Validate(PasswordBytesConstraint)
+  @Matches(new RegExp(PASSWORD_PATTERN), {
+    message: `must be ${MIN_PASSWORD_LENGTH}-${MAX_PASSWORD_BYTES} printable ASCII characters`,
+  })
+  declare password: string;
+}
+
+export class LoginDto extends EmailDto {
+  @ApiProperty({
+    description: `Raw password, at most ${MAX_PASSWORD_BYTES} UTF-8 bytes. Not trimmed or normalized.`,
+    example: 'a secure password',
+  })
+  @IsString()
+  @IsNotEmpty()
+  @Validate(PasswordMaxBytesConstraint)
   declare password: string;
 }