Skip to content

P1 auth: add password policy, email normalization and IntegrityError handling #49

Closed
#77
Closed
P1 auth: add password policy, email normalization and IntegrityError handling#49
#77
Assignees
SlavaKuntsov
Labels
area:autharea:authphase:16Phase 16 security hotfix: CRITICAL chain + CVE

Description

@SlavaKuntsov
SlavaKuntsov
opened on Sep 13, 2026

Регистрация (schemas.py:5-11, routers/auth.py:46-51): пароль любой длины (включая пустой); EmailStr не нормализует регистр, а users.email UNIQUE регистрозависим — два аккаунта на одну почту; SELECT-then-INSERT без ловли IntegrityError — конкурентная регистрация даёт 500.

Фикс: password: str = Field(min_length=8); email в lowercase перед вставкой (CITEXT или нормализация); ловить IntegrityError → 409.
Verify: регистрация дубликата → 409; a@x.com == A@x.com.
Источник: docs/REVIEW-2026-09-13-merged.md M9

Автоматически создано из сводного ревью. Сверяй актуальность номеров строк — они зафиксированы на коммите 91efb5b.

Activity

  1. SlavaKuntsov
    added
    phase:backlogBacklog
    area:autharea:auth
    phase:16Phase 16 security hotfix: CRITICAL chain + CVE
    and removed
    phase:backlogBacklog
    on Sep 13, 2026
  2. SlavaKuntsov
    self-assigned this
    on Sep 14, 2026

  3. SlavaKuntsov commented on Sep 18, 2026

    @SlavaKuntsov
    SlavaKuntsov
    on Sep 18, 2026
    OwnerAuthor

    Ready for review — Phase 16

    Implemented (#49)

    • password: Field(min_length=8) в RegisterRequest (login без политики — не ломаем существующих)
    • Email нормализуется в lowercase в register и login (validator в схемах)
    • IntegrityError на commit → rollback + 409 (гонка SELECT-then-INSERT)
    • Тесты: короткий пароль 422, lowercase нормализация (register+login), IntegrityError→409

    Verification

    Commits: 56f4536 (+ cf78449 fixes). PR закроет тикет через Closes #49.

  4. SlavaKuntsov commented on Sep 18, 2026

    @SlavaKuntsov
    SlavaKuntsov
    on Sep 18, 2026
    OwnerAuthor

    Pull request opened

    #77 — will auto-close via Closes #49 on merge.

    Project status: In review (synced).

    Verification

    • make test-py / make test-go — pass
    • make lint-py / make lint-go / make lint-front — чисто
    • make up && make e2e — PASS на чистых volumes

    Remaining risks

    none known (follow-up: #76)

  5. SlavaKuntsov
    closed this as completedin #77on Sep 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:autharea:authphase:16Phase 16 security hotfix: CRITICAL chain + CVE

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions