Validate Registration and Login Requests
Create src/validators/auth.validator.js.
Registration and login should have separate schemas.
Registration requires a name, valid email, and password.
Login requires an email and password.
Never allow clients to provide privileged properties such as role or isActive during registration.
src/validators/auth.validator.js
import { z } from 'zod';
export const registerSchema = z.object({
name: z.string().trim().min(2).max(80),
email: z.string().trim().email().max(254),
password: z.string().min(8).max(72),
age: z.number().int().min(18).max(120).optional()
}).strict();
export const loginSchema = z.object({
email: z.string().trim().email().max(254),
password: z.string().min(1).max(72)
}).strict();Defines separate validation rules for account registration and login while rejecting unexpected fields.
Key Takeaways
Registration and login require different validation rules.
Do not allow clients to assign their own roles.
Validate credentials before executing authentication logic.