auth.validate-login

validateLogin(" Ada@Example.COM ", "correct horse battery staple")
# {valid: true, email: "Ada@example.com", fields: {}}
validateLogin("ada@localhost", "")
# {valid: false, email: null,
#  fields: {"email": "Enter a valid email address, like name@example.com.",
#           "password": "Enter your password."}}

export function validateLogin(email: string, password: string): LoginCheck

/** A login form's verdict, shaped for an API's validation error and a form's field messages. */
export interface LoginCheck {
  readonly valid: boolean;
  /** normalised, when the email is an address */
  readonly email: string | null;
  /** field name to message, only for fields that need fixing; empty when valid */
  readonly fields: Readonly<Record<string, string>>;
}

import { validateLogin } from "#fune/auth.validate-login@^1";

import { normaliseEmail } from "./auth_normalise_email.ts";  ← from auth.normalise-email ^1.0.0 · built alongside by fune
import { type LoginCheck } from "./auth_validate_login_types.ts";

function isAsciiSpace(ch: string): boolean {
  return ch === " " || ch === "\t" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
}

function isBlank(text: string): boolean {
  return Array.from(text).every(isAsciiSpace);
}

/**
 * A login form checked for shape only: the email to look up when valid, and
 * a message for each field that needs fixing. The password is never judged
 * against a policy here, so a password set under older rules still logs in.
 */
export function validateLogin(email: string, password: string): LoginCheck {
  // A non-string (a malformed JSON body) is an empty field, not an exception.
  const emailText = typeof email === "string" ? email : "";
  const passwordText = typeof password === "string" ? password : "";
  const fields: Record<string, string> = {};

  const normalised = normaliseEmail(emailText);
  if (normalised === null) {
    fields.email = isBlank(emailText) ? "Enter your email address." : "Enter a valid email address, like name@example.com.";
  }
  if (passwordText === "") fields.password = "Enter your password.";

  return { valid: Object.keys(fields).length === 0, email: normalised, fields };
}

Install

fune build

With that line in your source, in a TypeScript project (language typescript in fune.project), fune build resolves it and its 1 dependency, pins them in fune.lock, downloads only the TypeScript package of each, and builds the code above into your project’s .fune/build, one readable file per capability with a header linking back here. Or pin a range in fune.project and build in one step:

fune add auth.validate-login

The manifest, vectors and README with only the TypeScript implementation. Install it without the registry with fune add ./auth.validate-login-1.0.0-typescript.fune, or fetch it from a terminal with fune pull auth.validate-login@1.0.0:typescript.

The whole function, every language, is one file too: auth.validate-login-1.0.0.fune, 10,888 bytes, sha256 fe4473f438dfa5de4b3d85efea93e2d2b0863864953844544b1801e656e6120f. It installs into a project of any language.

// fune: before auth.validate-login

// fune: after auth.validate-login

// fune: replace auth.normalise-email in auth.validate-login

// fune: step auth.validate-login after <n|label>

More from the author

When `valid` is true, look the account up by `email` from the result: it has been through `auth.normalise-email` (trimmed, domain lower-cased), exactly as `auth.validate-registration` stored it, so `Ada@EXAMPLE.com` finds the account `Ada@example.com` made. Throttle on that normalised email too (`auth.login-throttle`), so changing the domain's case does not dodge the count.

**email**: empty after trimming ASCII whitespace is "Enter your email address."; anything else `auth.normalise-email` refuses is "Enter a valid email address, like name@example.com.", the same messages sign-up uses.

**password**: only its presence is checked, "Enter your password." when it is empty. It is deliberately not trimmed (a space can be part of a password) and never checked against a password policy: a password set under an older, weaker policy must still log in, and a login form that says "use at least 15 characters" tells an attacker what the policy is while telling the user nothing useful. Whether it is right is `auth.password-hash`'s `verifyPassword`, after the throttle allows the attempt.

`fields` lists only the fields that need fixing, keyed `email` then `password`. A value that is not a string (a JSON body with a number where the password goes) is treated as empty, so a malformed request gets field messages rather than an exception. It never throws.

Files