feat: add backend input validation using Zod for auth routes#279
feat: add backend input validation using Zod for auth routes#279Likhi2005 wants to merge 2 commits into
Conversation
✅ Deploy Preview for github-spy ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR implements schema-based request validation for authentication routes. It adds the Zod validation library, creates validation schemas for signup and login inputs, introduces a middleware factory that validates request bodies and attaches results to ChangesAuthentication Request Validation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🎉 Thank you @Likhi2005 for your contribution. Please make sure your PR follows https://github.com/GitMetricsLab/github_tracker/blob/main/CONTRIBUTING.md#-pull-request-guidelines
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
backend/validators/validationRequest.js (1)
1-1: ⚡ Quick winFix inconsistent spacing in function parameters.
The function signature has inconsistent spacing:
(req,res, next)should be(req, res, next).✨ Proposed fix
-const validateRequest = (schema) => (req,res, next) => { +const validateRequest = (schema) => (req, res, next) => {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/validators/validationRequest.js` at line 1, The validateRequest middleware function signature has inconsistent spacing in its parameters; update the parameter list in the arrow function for validateRequest from (req,res, next) to use consistent spacing (req, res, next) so it matches the project's style and other middleware declarations in validationRequest.js.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/routes/auth.js`:
- Line 28: The login failure is caused because passport.authenticate('local')
reads credentials from req.body while your validateRequest middleware stores the
normalized input in req.validated; update the middleware (validationRequest.js /
validateRequest) to copy the validated data back onto req.body (i.e., set
req.body = req.validated or req.body = result.data after validation) so passport
sees the transformed email, or alternatively adjust the LocalStrategy to read
from req.validated or add a small middleware before
passport.authenticate('local') that copies req.validated into req.body.
In `@backend/validators/authValidator.js`:
- Around line 10-13: The email Zod chain applies .toLowerCase() and .trim()
after .email(), causing format validation to run on unnormalized input; in
authValidator.js update the email schema (the email property using z.string())
to perform .trim() and .toLowerCase() before calling .email(...) so the chain
becomes z.string().trim().toLowerCase().email("Invalid email address") to
normalize input prior to format validation.
- Around line 4-8: The username schema calls .trim() after length and regex
checks so inputs like " user " fail; move .trim() to the start of the chain on
the username z.string() schema so whitespace is removed before .min(), .max(),
and .regex validations (update the username validator definition accordingly to
call .trim() immediately after z.string()).
- Around line 26-29: The loginSchema applies .email() before normalization; move
the string transforms so .trim() and .toLowerCase() are called before .email()
on the email field (matching signupSchema) so validation runs against the
normalized value—update the email chain in loginSchema to call .trim() and
.toLowerCase() first, then .email().
- Around line 18-20: The password regex in authValidator.js (the .regex(...)
call) uses lookaheads correctly but the main pattern only matches a single
allowed character and lacks end anchoring, so update the main pattern to enforce
that the entire string consists only of the allowed character set and is at
least one character long by replacing the trailing token with an anchored
repetition of the allowed character class (i.e., ensure the pattern is wrapped
with ^ and $ and uses a quantifier like + on the [A-Za-z\d@$!%*?&] class) so
emojis or other disallowed characters cannot appear anywhere in the password
while keeping the existing lookaheads for required types.
---
Nitpick comments:
In `@backend/validators/validationRequest.js`:
- Line 1: The validateRequest middleware function signature has inconsistent
spacing in its parameters; update the parameter list in the arrow function for
validateRequest from (req,res, next) to use consistent spacing (req, res, next)
so it matches the project's style and other middleware declarations in
validationRequest.js.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 214fa33e-fb9d-4fa0-9b5b-cf265cec2b61
📒 Files selected for processing (4)
backend/package.jsonbackend/routes/auth.jsbackend/validators/authValidator.jsbackend/validators/validationRequest.js
1 participant
Related Issue
Description
This PR adds backend input validation for authentication routes using Zod.
Previously, the application accepted invalid inputs such as malformed emails and weak passwords, which were directly stored in the database. This caused data inconsistency and potential security risks.
This update introduces schema-based validation to ensure all incoming authentication data is properly validated before processing.
Changes Made
How Has This Been Tested?
Screenshots (if applicable)
Invalid Email Test
Weak Password Test
Type of Change
Summary by CodeRabbit
New Features
Chores