refactor(auth): improve signup validation, optimize user retrieval, and update docs

Author: yash-pouranik

backend/controllers/userAuth.controller.js

@@ -2,14 +2,16 @@ const jwt = require('jsonwebtoken');
 const bcrypt = require('bcryptjs');
 const { z } = require('zod');
 const mongoose = require('mongoose');
-const { loginSchema, signupSchema } = require('../utils/input.validation');
+const { loginSchema, userSignupSchema } = require('../utils/input.validation');
 
 module.exports.signup = async (req, res) => {
     try {
         const project = req.project;
 
+        const data = userSignupSchema.parse(req.body);
+
         // Zod Validation (Prevents NoSQL Injection too)
-        const { email, password, username, ...otherData } = signupSchema.parse(req.body);
+        const { email, password, username, ...otherData } = userSignupSchema.parse(req.body);
 
         const collectionName = `${project._id}_users`;
         const collection = mongoose.connection.db.collection(collectionName);
@@ -26,6 +28,7 @@ module.exports.signup = async (req, res) => {
             username,
             email,
             password: hashedPassword,
+            ...otherData,
             createdAt: new Date()
         };
 
@@ -45,6 +48,7 @@ module.exports.signup = async (req, res) => {
     } catch (err) {
         if (err instanceof z.ZodError) return res.status(400).json({ error: err.errors });
         res.status(500).json({ error: err.message }); // Fixed: .json()
+        console.log(err)
     }
 }
 
@@ -90,17 +94,17 @@ module.exports.me = async (req, res) => {
             const collectionName = `${project._id}_users`;
             const collection = mongoose.connection.db.collection(collectionName);
 
-            const user = await collection.findOne({
-                _id: new mongoose.Types.ObjectId(decoded.userId)
-            });
+            const user = await collection.findOne(
+                { _id: new mongoose.Types.ObjectId(decoded.userId) },
+                { projection: { password: 0 } }
+            );
 
             if (!user) return res.status(404).json({ error: "User not found" });
 
-            const { password, ...userData } = user;
-            res.json(userData);
+            res.json(user);
 
         } catch (err) {
-            return res.status(400).json({ error: "Invalid or Expired Token" });
+            return res.status(401).json({ error: "Invalid or Expired Token" });
         }
 
     } catch (err) {

backend/middleware/verifyApiKey.js

@@ -28,7 +28,8 @@ module.exports = async (req, res, next) => {
                     databaseLimit
                     databaseUsed
                     storageLimit
-                    storageUsed
+                    storageUsed,
+                    jwtSecret
                 `)
                 .populate('owner', 'isVerified')
                 .lean();

backend/utils/input.validation.js

@@ -90,4 +90,19 @@ module.exports.updateExternalConfigSchema = z.object({
     return !!(data.dbUri || (data.storageUrl && data.storageKey));
 }, {
     message: "Provide either a DB URI or a complete Storage config (URL + Key)."
-});
+});
+
+module.exports.userSignupSchema = z.object({
+    username: z.string()
+        .min(3, { message: "Username must be at least 3 characters." })
+        .max(30, { message: "Username is too long." }).optional(),
+
+    email: z.string()
+        .min(1, { message: "Email is required." })
+        .email({ message: "Invalid email format." })
+        .max(100, { message: "Email is too long." }),
+
+    password: z.string()
+        .min(6, { message: "Password must be at least 6 characters." })
+        .max(100, { message: "Password is too long." })
+}).passthrough();

frontend/src/pages/Docs.jsx

@@ -238,7 +238,7 @@ console.log(data);
                         <CodeBlock
                             method="POST"
                             url="/api/userAuth/signup"
-                            body={{ email: "user@example.com", password: "securePassword123", name: "John Doe" }}
+                            body={{ email: "user@example.com", password: "securePassword123", username: "John Doe" }}
                             comment="Register a new user"
                         />
 
@@ -297,7 +297,7 @@ console.log(data);
                             body={{ name: "MacBook Pro", price: 1299, inStock: true }}
                             comment="Add a new item"
                         />
-                       <TryItPanel endpoint="/api/data/:collectionName" method="POST" />
+                        <TryItPanel endpoint="/api/data/:collectionName" method="POST" />
 
 
                         <h3 style={{ fontSize: '1.1rem', marginTop: '2rem' }}>3. Get / Update / Delete by ID</h3>