flightsimulatorplatfrom/OpenSquawk
1
0
Fork 0
mirror of https://github.com/OpenSquawk/OpenSquawk synced 2026-08-09 11:06:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

Harden runtime config and input validation

Browse Source
This commit is contained in:
Remi
2025-09-18 13:39:16 +02:00
committed by itsrubberduck
parent 88497a3848
commit e17169655d
10 changed files with 295 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
server/api/service/auth/register.post.ts
View File

@@ -3,6 +3,7 @@ import { hashPassword, issueAuthTokens } from '../../../utils/auth'
import { User } from '../../../models/User'
import { InvitationCode } from '../../../models/InvitationCode'
import { WaitlistEntry } from '../../../models/WaitlistEntry'
import { isValidEmail, validatePasswordStrength } from '../../../utils/validation'
interface RegisterBody {
email?: string
@@ -15,12 +16,13 @@ interface RegisterBody {
export default defineEventHandler(async (event) => {
const body = await readBody<RegisterBody>(event)
const email = body.email?.trim().toLowerCase()
const password = body.password?.trim()
const emailInput = body.email?.trim() || ''
const password = body.password?.trim() || ''
const name = body.name?.trim()
const code = body.invitationCode?.trim().toUpperCase()
const email = emailInput.toLowerCase()
if (!email || !password || !code) {
if (!emailInput || !password || !code) {
throw createError({ statusCode: 400, statusMessage: 'Bitte E-Mail, Passwort und Einladungscode angeben' })
}
@@ -28,6 +30,15 @@ export default defineEventHandler(async (event) => {
throw createError({ statusCode: 400, statusMessage: 'Bitte AGB und Datenschutz bestätigen' })
}
if (!isValidEmail(emailInput)) {
throw createError({ statusCode: 400, statusMessage: 'Bitte eine gültige E-Mail-Adresse angeben' })
}
const passwordValidation = validatePasswordStrength(password)
if (!passwordValidation.valid) {
throw createError({ statusCode: 400, statusMessage: passwordValidation.message || 'Passwort ist zu schwach' })
}
const existingUser = await User.findOne({ email })
if (existingUser) {
throw createError({ statusCode: 409, statusMessage: 'Für diese E-Mail existiert bereits ein Konto' })