5073d9342a
Security: per-username login throttling, constant-time unknown-user check, Sec-Fetch-Site CSRF guard for writes, session rotation on login and password change, absolute session lifetime, sessions ended on reset and deactivation, last-admin protection, input length caps, ASCII usernames, clickjacking headers. Covered by tests/authentication.test.ts. Filter panel: toggle, fields and count share one row to save space. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20 lines
609 B
TypeScript
20 lines
609 B
TypeScript
import { z } from "zod";
|
|
|
|
// Upper bounds keep a huge request body from being fed into scrypt.
|
|
export const MAX_USERNAME_LENGTH = 100;
|
|
export const MAX_PASSWORD_LENGTH = 200;
|
|
export const MIN_PASSWORD_LENGTH = 8;
|
|
|
|
export const loginSchema = z
|
|
.object({
|
|
username: z.string().trim().min(1).max(MAX_USERNAME_LENGTH),
|
|
password: z.string().min(1).max(MAX_PASSWORD_LENGTH),
|
|
})
|
|
.strict();
|
|
|
|
export const changePasswordSchema = z
|
|
.object({
|
|
currentPassword: z.string().min(1).max(MAX_PASSWORD_LENGTH),
|
|
newPassword: z.string().min(MIN_PASSWORD_LENGTH).max(MAX_PASSWORD_LENGTH),
|
|
})
|
|
.strict();
|