fix(signup): align frontend password validation with backend Zod schema#465
Conversation
❌ Deploy Preview for github-spy failed.
|
|
Warning Review limit reached
More reviews will be available in 53 minutes and 50 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Hi @GitMetricsLab team, following up on this PR. The frontend password regex was accepting passwords that the backend Zod schema would then reject, leaving users with a confusing server-side error and no inline guidance on what went wrong. The fix extracts a |
The frontend regex accepted passwords that the backend Zod schema rejects, causing silent server-side failures with no actionable inline feedback. Root cause: Signup.tsx used a weaker regex that only required one letter and one digit, allowed # (not in the backend allowlist), and gave no indication that uppercase or a special character was needed. Changes in src/pages/Signup/Signup.tsx: - Extract PASSWORD_REGEX constant that mirrors the Zod rule in backend/validators/authValidator.js exactly: requires lowercase, uppercase, digit, one of @$!%*?& and 8+ chars - Replace the old regex in both handleChange and handleSubmit with PASSWORD_REGEX so a single source of truth drives both validation paths - Replace the vague error message with a descriptive one that lists all four requirements and the allowed special characters No backend changes needed: authValidator.js is already correct and is the reference source for the frontend rule. Fixes GitMetricsLab#415
anshul23102
force-pushed
the
fix/415-password-validation-mismatch
branch
from
8b414cb to
5a9ff43
Compare
|
🎉🎉 Thank you for your contribution! Your PR #465 has been merged! 🎉🎉 |
2 participants
Summary
Fixes #415
The password regex in
Signup.tsxwas weaker than the Zod schema inbackend/validators/authValidator.js, creating a class of passwords that cleared the frontend check but were rejected by the server with a generic error and no inline guidance.Mismatch table (before this fix)
password1Password1Password1##allowed by old frontend regex)#not in backend allowlist)Password1!Changes in
src/pages/Signup/Signup.tsxPASSWORD_REGEXconstant placed at module level so there is a single source of truth rather than the same regex copy-pasted in two places:This is an exact copy of the Zod
.regex(...)inauthValidator.js, with{8,}appended to the character class to also enforce the.min(8)constraint inline.Replaced both usages of the old regex in
handleChangeandhandleSubmitwithPASSWORD_REGEX.Updated the error message from the vague
"Password must be 8+ characters with letters and numbers"to a descriptive"Password must be at least 8 characters and include uppercase, lowercase, a number, and a special character (@$!%*?&)"so users know exactly what is required without trial and error.No backend changes:
authValidator.jsis already correct and serves as the reference.Test plan
password1in the password field: inline error appears immediatelyPassword1in the password field: inline error appears (no special char)Password1#in the password field: inline error appears (#not allowed)Password1!in the password field: no error shown, submit succeeds