Harden public account registration

microservices/AuthApi/Controllers/AuthController.cs

@@ -3,9 +3,12 @@ using AuthApi.Services;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.IdentityModel.Tokens;
+using MongoDB.Driver;
 using System.IdentityModel.Tokens.Jwt;
+using System.Net.Mail;
 using System.Security.Claims;
 using System.Text;
+using System.Text.RegularExpressions;
 
 namespace AuthApi.Controllers;
 
@@ -25,15 +28,31 @@ public class AuthController : ControllerBase
     [HttpPost("register")]
     public async Task<IActionResult> Register([FromBody] RegisterRequest req)
     {
-        if (string.IsNullOrWhiteSpace(req.Username) || string.IsNullOrWhiteSpace(req.Password))
-            return BadRequest("Username and password required");
+        var username = req.Username?.Trim() ?? "";
+        var password = req.Password ?? "";
+        var email = req.Email?.Trim() ?? "";
 
-        if (await _users.GetByUsernameAsync(req.Username) != null)
-            return BadRequest("User already exists");
+        if (!Regex.IsMatch(username, "^[A-Za-z0-9_]{3,24}$"))
+            return BadRequest("Username must be 3-24 characters using only letters, numbers, or underscores");
+        if (password.Length < 8)
+            return BadRequest("Password must be at least 8 characters");
+        var emailDomain = email.Split('@').LastOrDefault() ?? "";
+        if (string.IsNullOrWhiteSpace(email) || !MailAddress.TryCreate(email, out _) || !emailDomain.Contains('.'))
+            return BadRequest("A valid email address is required");
 
-        var hash = BCrypt.Net.BCrypt.HashPassword(req.Password);
-        var user = new User { Username = req.Username, PasswordHash = hash, Role = "USER", Email = req.Email };
-        await _users.CreateAsync(user);
+        if (await _users.GetByUsernameAsync(username) != null)
+            return Conflict("Username already exists");
+
+        var hash = BCrypt.Net.BCrypt.HashPassword(password);
+        var user = new User { Username = username, PasswordHash = hash, Role = "USER", Email = email };
+        try
+        {
+            await _users.CreateAsync(user);
+        }
+        catch (MongoWriteException ex) when (ex.WriteError.Category == ServerErrorCategory.DuplicateKey)
+        {
+            return Conflict("Username already exists");
+        }
         return Ok("User created");
     }