Validate authentication inputs

@veap/auth/validation exports Zod schemas intended to be reusable on the client and server without importing database services.

Available schemas#

• loginSchema: email, password (minimum eight characters), optional remember.
• registerSchema: username (minimum three characters), email, password (minimum eight characters), and terms which must be true.
• forgotPasswordSchema: email.
• resetPasswordSchema: password plus confirm, with a refinement requiring a match.
• verifyEmailSchema: a six-character code.
• totpSetupSchema and totpVerifySchema: six-digit numeric codes.
• backupCodeSchema: a code from eight to twelve characters.
• verifyEmailInput(email): a basic email format/length predicate.

The package also exports inferred types including LoginInput, RegisterInput, ForgotPasswordInput, ResetPasswordInput, and VerifyEmailInput.

Parse at the boundary#

import { loginSchema } from "@veap/auth/validation";

export async function validateLogin(input: unknown) {
  const result = loginSchema.safeParse(input);

  if (!result.success) {
    return {
      ok: false as const,
      issues: result.error.issues.map(({ path, message }) => ({
        path: path.join("."),
        message,
      })),
    };
  }

  return { ok: true as const, data: result.data };
}

Treat form input as unknown until it has been validated. Client-side validation improves UX but does not replace server-side validation. Apply rate limits, abuse controls and generic error messages to authentication endpoints.