Harden public account registration

2026-07-11 12:39:02 -05:00
parent 7f21b40d93
commit 7faef2e976
4 changed files with 34 additions and 12 deletions
@@ -9,9 +9,12 @@ Inbound JSON documents
  {
    "username": "string",
    "password": "string",
-    "email": "string (optional)"
+    "email": "string"
  }
  ```
+  Usernames must be 3-24 characters containing only letters, numbers, or
+  underscores. Passwords must contain at least 8 characters, and email is
+  required with a valid address format.
 - LoginRequest (`POST /api/auth/login`)
  ```json
  {
@@ -42,7 +45,7 @@ Stored documents (MongoDB)
    "username": "string",
    "passwordHash": "string",
    "role": "USER | SUPER",
-    "email": "string (optional)",
+    "email": "string",
    "refreshToken": "string (optional)",
    "refreshTokenExpiry": "string (optional, ISO-8601 datetime)"
  }