auth.validate-login

validateLogin(" Ada@Example.COM ", "correct horse battery staple")
# {valid: true, email: "Ada@example.com", fields: {}}
validateLogin("ada@localhost", "")
# {valid: false, email: null,
#  fields: {"email": "Enter a valid email address, like name@example.com.",
#           "password": "Enter your password."}}

def validate_login(email: str, password: str) -> LoginCheck

@dataclass(frozen=True)
class LoginCheck:
    """A login form's verdict, shaped for an API's validation error and a form's field messages."""

    valid: bool
    #: normalised, when the email is an address
    email: Optional[str]
    #: field name to message, only for fields that need fixing; empty when valid
    fields: Dict[str, str]

from fune.auth.validate_login import validate_login  # auth.validate-login@^1

from typing import Any, Dict

from .auth_normalise_email import normalise_email  ← from auth.normalise-email ^1.0.0 · built alongside by fune
from .auth_validate_login_types import LoginCheck

_ASCII_SPACE = " \t\n\r\f\v"


def _text(value: Any) -> str:
    # A non-string (a malformed JSON body) is an empty field, not an exception.
    return value if isinstance(value, str) else ""


def validate_login(email: str, password: str) -> LoginCheck:
    """A login form checked for shape only: the email to look up when valid,
    and a message for each field that needs fixing. The password is never
    judged against a policy here, so a password set under older rules still
    logs in."""
    email_text, password_text = _text(email), _text(password)
    fields: Dict[str, str] = {}

    normalised = normalise_email(email_text)
    if normalised is None:
        fields["email"] = (
            "Enter your email address."
            if email_text.strip(_ASCII_SPACE) == ""
            else "Enter a valid email address, like name@example.com."
        )
    if password_text == "":
        fields["password"] = "Enter your password."

    return LoginCheck(valid=len(fields) == 0, email=normalised, fields=fields)

Install

fune build

With that line in your source, in a Python project (language python in fune.project), fune build resolves it and its 1 dependency, pins them in fune.lock, downloads only the Python package of each, and builds the code above into your project’s .fune/build, one readable file per capability with a header linking back here. Or pin a range in fune.project and build in one step:

fune add auth.validate-login

The manifest, vectors and README with only the Python implementation. Install it without the registry with fune add ./auth.validate-login-1.0.0-python.fune, or fetch it from a terminal with fune pull auth.validate-login@1.0.0:python.

The whole function, every language, is one file too: auth.validate-login-1.0.0.fune, 10,888 bytes, sha256 fe4473f438dfa5de4b3d85efea93e2d2b0863864953844544b1801e656e6120f. It installs into a project of any language.

# fune: before auth.validate-login

# fune: after auth.validate-login

# fune: replace auth.normalise-email in auth.validate-login

# fune: step auth.validate-login after <n|label>

More from the author

When `valid` is true, look the account up by `email` from the result: it has been through `auth.normalise-email` (trimmed, domain lower-cased), exactly as `auth.validate-registration` stored it, so `Ada@EXAMPLE.com` finds the account `Ada@example.com` made. Throttle on that normalised email too (`auth.login-throttle`), so changing the domain's case does not dodge the count.

**email**: empty after trimming ASCII whitespace is "Enter your email address."; anything else `auth.normalise-email` refuses is "Enter a valid email address, like name@example.com.", the same messages sign-up uses.

**password**: only its presence is checked, "Enter your password." when it is empty. It is deliberately not trimmed (a space can be part of a password) and never checked against a password policy: a password set under an older, weaker policy must still log in, and a login form that says "use at least 15 characters" tells an attacker what the policy is while telling the user nothing useful. Whether it is right is `auth.password-hash`'s `verifyPassword`, after the throttle allows the attempt.

`fields` lists only the fields that need fixing, keyed `email` then `password`. A value that is not a string (a JSON body with a number where the password goes) is treated as empty, so a malformed request gets field messages rather than an exception. It never throws.

Files