From b9ef239e843efc5afb8f91b40391dae9e63bd310 Mon Sep 17 00:00:00 2001
From: Jackson Harper <jacksonh@gmail.com>
Date: Wed, 10 May 2023 23:09:04 +0800
Subject: [PATCH 1/3] Add test

---
 packages/api/test/routers/auth.test.ts | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/packages/api/test/routers/auth.test.ts b/packages/api/test/routers/auth.test.ts
index 4e4044a17..38b889f24 100644
--- a/packages/api/test/routers/auth.test.ts
+++ b/packages/api/test/routers/auth.test.ts
@@ -152,6 +152,23 @@ describe('auth router', () => {
         )
       })
     })
+
+    context('when password is over max length', () => {
+      before(() => {
+        email = 'Some_email'
+        password = 'badpass'.repeat(100)
+        username = 'omnivore_admin'
+      })
+
+      it('redirects to sign up page with error code INVALID_PASSWORD', async () => {
+        const res = await signupRequest(email, password, name, username).expect(
+          302
+        )
+        expect(res.header.location).to.endWith(
+          '/email-signup?errorCodes=INVALID_PASSWORD'
+        )
+      })
+    })
   })
 
   describe('login', () => {

From f8df71508b085a167d212c95412758dadce397ad Mon Sep 17 00:00:00 2001
From: Jackson Harper <jacksonh@gmail.com>
Date: Wed, 10 May 2023 23:09:31 +0800
Subject: [PATCH 2/3] Enforce max lengths on signup credentials

---
 packages/api/src/routers/auth/auth_router.ts | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/packages/api/src/routers/auth/auth_router.ts b/packages/api/src/routers/auth/auth_router.ts
index 0b4b5266c..8022d1caa 100644
--- a/packages/api/src/routers/auth/auth_router.ts
+++ b/packages/api/src/routers/auth/auth_router.ts
@@ -74,13 +74,17 @@ const cookieParams = {
 export const isValidSignupRequest = (obj: any): obj is SignupRequest => {
   return (
     'email' in obj &&
-    obj.email.trim().length > 0 && // email must not be empty
+    obj.email.trim().length > 0 &&
+    obj.email.trim().length < 512 && // email must not be empty
     'password' in obj &&
-    obj.password.length >= 8 && // password must be at least 8 characters
+    obj.password.length >= 8 &&
+    obj.password.trim().length < 512 && // password must be at least 8 characters
     'name' in obj &&
-    obj.name.trim().length > 0 && // name must not be empty
+    obj.name.trim().length > 0 &&
+    obj.name.trim().length < 512 && // name must not be empty
     'username' in obj &&
-    obj.username.trim().length > 0 // username must not be empty
+    obj.username.trim().length > 0 &&
+    obj.username.trim().length < 512 // username must not be empty
   )
 }
 

From e0c96838d9f92d54044a4c51143011e68f994906 Mon Sep 17 00:00:00 2001
From: Jackson Harper <jacksonh@gmail.com>
Date: Thu, 11 May 2023 09:09:34 +0800
Subject: [PATCH 3/3] Update test

---
 packages/api/test/routers/auth.test.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/api/test/routers/auth.test.ts b/packages/api/test/routers/auth.test.ts
index 38b889f24..79dfc2dcf 100644
--- a/packages/api/test/routers/auth.test.ts
+++ b/packages/api/test/routers/auth.test.ts
@@ -160,12 +160,12 @@ describe('auth router', () => {
         username = 'omnivore_admin'
       })
 
-      it('redirects to sign up page with error code INVALID_PASSWORD', async () => {
+      it('redirects to sign up page with error code INVALID_CREDENTIALS', async () => {
         const res = await signupRequest(email, password, name, username).expect(
           302
         )
         expect(res.header.location).to.endWith(
-          '/email-signup?errorCodes=INVALID_PASSWORD'
+          '/email-signup?errorCodes=INVALID_CREDENTIALS'
         )
       })
     })