auth.validate-registration

validateRegistration(" Ada@Example.com ", "short", "Ada Lovelace", passwordPolicy("nist-800-63b-4-single-factor"))
# {valid: false, email: "Ada@example.com", name: "Ada Lovelace",
#  fields: {"password": "Use at least 15 characters."}}

def validate_registration(email: str, password: str, name: str, policy: PasswordPolicy) -> RegistrationCheck

@dataclass(frozen=True)
class RegistrationCheck:
    """A sign-up form's verdict, shaped for an API's validation error and a form's field messages."""

    valid: bool
    #: normalised, when the email is valid
    email: Optional[str]
    #: trimmed, when the name is valid
    name: Optional[str]
    #: field name to message, only for fields that need fixing; empty when valid
    fields: Dict[str, str]

from fune.auth.validate_registration import validate_registration  # auth.validate-registration@^1

from typing import Any, Dict

from .auth_normalise_email import normalise_email  ← from auth.normalise-email ^1.0.0 · built alongside by fune
from .auth_password_policy_check_password import check_password
from .auth_password_policy_types import PasswordPolicy
from .auth_validate_registration_types import RegistrationCheck

MAX_NAME = 100
_ASCII_SPACE = " \t\n\r\f\v"


def _text(value: Any) -> str:
    # A non-string (a malformed JSON body) is an empty field, not an exception.
    return value if isinstance(value, str) else ""


def validate_registration(email: str, password: str, name: str, policy: PasswordPolicy) -> RegistrationCheck:
    """A sign-up form's email, password and name checked together: the values
    to store when valid, and a message for each field that needs fixing."""
    email_text, password_text, name_text = _text(email), _text(password), _text(name)
    fields: Dict[str, str] = {}

    normalised = normalise_email(email_text)
    if normalised is None:
        fields["email"] = (
            "Enter your email address."
            if email_text.strip(_ASCII_SPACE) == ""
            else "Enter a valid email address, like name@example.com."
        )

    trimmed_name = name_text.strip(_ASCII_SPACE)
    name_error = None
    if len(trimmed_name) == 0:
        name_error = "Enter your name."
    elif len(trimmed_name) > MAX_NAME:
        name_error = "Use no more than %d characters for your name." % MAX_NAME
    elif any(ord(ch) < 0x20 or ord(ch) == 0x7F for ch in trimmed_name):
        name_error = "Your name cannot contain control characters."

    check = check_password(password_text, normalised, trimmed_name if name_error is None else None, policy)
    if password_text == "":
        fields["password"] = "Enter a password."
    elif not check.valid:
        fields["password"] = " ".join(f.message for f in check.failures)
    if name_error is not None:
        fields["name"] = name_error

    return RegistrationCheck(
        valid=len(fields) == 0,
        email=normalised,
        name=trimmed_name if name_error is None else None,
        fields=fields,
    )

Install

fune build

With that line in your source, in a Python project (language python in fune.project), fune build resolves it and its 2 dependencies, pins them in fune.lock, downloads only the Python package of each, and builds the code above into your project’s .fune/build, one readable file per capability with a header linking back here. Or pin a range in fune.project and build in one step:

fune add auth.validate-registration

The manifest, vectors and README with only the Python implementation. Install it without the registry with fune add ./auth.validate-registration-1.0.0-python.fune, or fetch it from a terminal with fune pull auth.validate-registration@1.0.0:python.

The whole function, every language, is one file too: auth.validate-registration-1.0.0.fune, 20,018 bytes, sha256 61f73a1f82c59d4baea20cec7e33b7e61e88780f6af7fc6438ddca4bad4208e4. It installs into a project of any language.

# fune: before auth.validate-registration

# fune: after auth.validate-registration

# fune: replace auth.normalise-email in auth.validate-registration
# fune: replace auth.password-policy in auth.validate-registration

# fune: step auth.validate-registration after <n|label>

More from the author

The browser runs it on submit to show messages beside the fields; the API runs the very same function and returns `fields` in its 400 response, so the two can never disagree about what is acceptable. When `valid` is true, store `email` and `name` from the result (normalised and trimmed), never the raw input.

**email** goes through `auth.normalise-email` (trimmed, domain lower-cased). Empty after trimming: "Enter your email address."; otherwise not an address `validation.email` accepts: "Enter a valid email address, like name@example.com."

**password** goes through `auth.password-policy`'s `checkPassword`, with the normalised email and trimmed name as the personal words to refuse. Empty: "Enter a password."; otherwise every failure's message, joined with a space in the policy's fixed order, so the field shows the whole story ("Use at least 15 characters. This password is too common. Choose something harder to guess.").

**name** is trimmed of ASCII whitespace and must then be 1 to 100 characters (code points), with no control characters (U+0000 to U+001F and U+007F): "Enter your name.", "Use no more than 100 characters for your name." or "Your name cannot contain control characters.". Any script is welcome; names are not otherwise judged (see "Falsehoods Programmers Believe About Names").

`fields` lists only the fields that need fixing, keyed `email`, `password`, `name`, in that order. A value that is not a string (a JSON body with a number where the password goes) is treated as empty, so a malformed request gets field messages rather than an exception. A nonsensical policy throws, as in `checkPassword`.

Whether the email is already taken is not a rule a pure function can know; the API checks its database after this passes (409 `email_taken`).

Files