auth.validate-registration

validateRegistration(" Ada@Example.com ", "short", "Ada Lovelace", passwordPolicy("nist-800-63b-4-single-factor"))
# {valid: false, email: "Ada@example.com", name: "Ada Lovelace",
#  fields: {"password": "Use at least 15 characters."}}

export function validateRegistration(email: string, password: string, name: string, policy: PasswordPolicy): RegistrationCheck

/** A sign-up form's verdict, shaped for an API's validation error and a form's field messages. */
export interface RegistrationCheck {
  readonly valid: boolean;
  /** normalised, when the email is valid */
  readonly email: string | null;
  /** trimmed, when the name is valid */
  readonly name: string | null;
  /** field name to message, only for fields that need fixing; empty when valid */
  readonly fields: Readonly<Record<string, string>>;
}

import { validateRegistration } from "#fune/auth.validate-registration@^1";

import { normaliseEmail } from "./auth_normalise_email.ts";  ← from auth.normalise-email ^1.0.0 · built alongside by fune
import { checkPassword } from "./auth_password_policy_check_password.ts";
import { type PasswordPolicy } from "./auth_password_policy_types.ts";
import { type RegistrationCheck } from "./auth_validate_registration_types.ts";

const MAX_NAME = 100;

function isAsciiSpace(ch: string): boolean {
  return ch === " " || ch === "\t" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
}

function trimAscii(text: string): string {
  let start = 0;
  let end = text.length;
  while (start < end && isAsciiSpace(text[start])) start++;
  while (end > start && isAsciiSpace(text[end - 1])) end--;
  return text.slice(start, end);
}

/**
 * A sign-up form's email, password and name checked together: the values to
 * store when valid, and a message for each field that needs fixing.
 */
export function validateRegistration(email: string, password: string, name: string, policy: PasswordPolicy): RegistrationCheck {
  // A non-string (a malformed JSON body) is an empty field, not an exception.
  const emailText = typeof email === "string" ? email : "";
  const passwordText = typeof password === "string" ? password : "";
  const nameText = typeof name === "string" ? name : "";
  const fields: Record<string, string> = {};

  const normalised = normaliseEmail(emailText);
  if (normalised === null) {
    fields.email = trimAscii(emailText) === "" ? "Enter your email address." : "Enter a valid email address, like name@example.com.";
  }

  const trimmedName = trimAscii(nameText);
  const nameChars = Array.from(trimmedName);
  let nameError: string | null = null;
  if (nameChars.length === 0) nameError = "Enter your name.";
  else if (nameChars.length > MAX_NAME) nameError = `Use no more than ${MAX_NAME} characters for your name.`;
  else if (nameChars.some((ch) => ch.charCodeAt(0) < 0x20 || ch.charCodeAt(0) === 0x7f)) nameError = "Your name cannot contain control characters.";

  const check = checkPassword(passwordText, normalised, nameError === null ? trimmedName : null, policy);
  if (passwordText === "") {
    fields.password = "Enter a password.";
  } else if (!check.valid) {
    fields.password = check.failures.map((f) => f.message).join(" ");
  }
  if (nameError !== null) fields.name = nameError;

  return {
    valid: Object.keys(fields).length === 0,
    email: normalised,
    name: nameError === null ? trimmedName : null,
    fields,
  };
}

Install

fune build

With that line in your source, in a TypeScript project (language typescript in fune.project), fune build resolves it and its 2 dependencies, pins them in fune.lock, downloads only the TypeScript package of each, and builds the code above into your project’s .fune/build, one readable file per capability with a header linking back here. Or pin a range in fune.project and build in one step:

fune add auth.validate-registration

The manifest, vectors and README with only the TypeScript implementation. Install it without the registry with fune add ./auth.validate-registration-1.0.0-typescript.fune, or fetch it from a terminal with fune pull auth.validate-registration@1.0.0:typescript.

The whole function, every language, is one file too: auth.validate-registration-1.0.0.fune, 20,018 bytes, sha256 61f73a1f82c59d4baea20cec7e33b7e61e88780f6af7fc6438ddca4bad4208e4. It installs into a project of any language.

// fune: before auth.validate-registration

// fune: after auth.validate-registration

// fune: replace auth.normalise-email in auth.validate-registration
// fune: replace auth.password-policy in auth.validate-registration

// fune: step auth.validate-registration after <n|label>

More from the author

The browser runs it on submit to show messages beside the fields; the API runs the very same function and returns `fields` in its 400 response, so the two can never disagree about what is acceptable. When `valid` is true, store `email` and `name` from the result (normalised and trimmed), never the raw input.

**email** goes through `auth.normalise-email` (trimmed, domain lower-cased). Empty after trimming: "Enter your email address."; otherwise not an address `validation.email` accepts: "Enter a valid email address, like name@example.com."

**password** goes through `auth.password-policy`'s `checkPassword`, with the normalised email and trimmed name as the personal words to refuse. Empty: "Enter a password."; otherwise every failure's message, joined with a space in the policy's fixed order, so the field shows the whole story ("Use at least 15 characters. This password is too common. Choose something harder to guess.").

**name** is trimmed of ASCII whitespace and must then be 1 to 100 characters (code points), with no control characters (U+0000 to U+001F and U+007F): "Enter your name.", "Use no more than 100 characters for your name." or "Your name cannot contain control characters.". Any script is welcome; names are not otherwise judged (see "Falsehoods Programmers Believe About Names").

`fields` lists only the fields that need fixing, keyed `email`, `password`, `name`, in that order. A value that is not a string (a JSON body with a number where the password goes) is treated as empty, so a malformed request gets field messages rather than an exception. A nonsensical policy throws, as in `checkPassword`.

Whether the email is already taken is not a rule a pure function can know; the API checks its database after this passes (409 `email_taken`).

Files