ksv741
ec95d2756d
Register accepts only printable ASCII (letters, digits, symbols, space), 8-72 characters, so characters equal bytes and the bcrypt 72-byte limit holds without silent truncation. Login only caps the password at 72 bytes so accounts created under the previous policy can still sign in. CredentialsDto is split into RegisterDto and LoginDto; OpenAPI publishes the register pattern and length bounds.