From 2696e858aee3a5091311360a68ebbf144723b156 Mon Sep 17 00:00:00 2001
From: francesca <francescascarpellini327@gmail.com>
Date: Tue, 27 Jan 2026 21:28:01 +0100
Subject: [PATCH 1/3] feat: add username field to signup validation schema

---
 backend/controllers/userAuth.controller.js |  6 +++---
 backend/package-lock.json                  |  4 ++--
 backend/utils/input.validation.js          | 15 +++++++++++++++
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/backend/controllers/userAuth.controller.js b/backend/controllers/userAuth.controller.js
index dc1632e7e..9adbcea46 100644
--- a/backend/controllers/userAuth.controller.js
+++ b/backend/controllers/userAuth.controller.js
@@ -1,14 +1,14 @@
 const jwt = require('jsonwebtoken');
 const bcrypt = require('bcryptjs');
 const mongoose = require('mongoose');
-const { loginSchema } = require('../utils/input.validation');
+const { loginSchema, signupSchema } = require('../utils/input.validation');
 
 module.exports.signup = async (req, res) => {
     try {
         const project = req.project;
 
         // Zod Validation (Prevents NoSQL Injection too)
-        const { email, password, ...otherData } = loginSchema.parse(req.body);
+        const { username, email, password } = signupSchema.parse(req.body);
 
         const collectionName = `${project._id}_users`;
         const collection = mongoose.connection.db.collection(collectionName);
@@ -22,9 +22,9 @@ module.exports.signup = async (req, res) => {
         const hashedPassword = await bcrypt.hash(password, salt);
 
         const newUser = {
+            username,
             email,
             password: hashedPassword,
-            ...otherData,
             createdAt: new Date()
         };
 
diff --git a/backend/package-lock.json b/backend/package-lock.json
index 3a6dc4ad1..aa1f1d206 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "urbackend",
-  "version": "1.0.0",
+  "version": "0.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "urbackend",
-      "version": "1.0.0",
+      "version": "0.1.0",
       "license": "MIT",
       "dependencies": {
         "@supabase/supabase-js": "^2.84.0",
diff --git a/backend/utils/input.validation.js b/backend/utils/input.validation.js
index 03d8c4852..dff435db7 100644
--- a/backend/utils/input.validation.js
+++ b/backend/utils/input.validation.js
@@ -10,6 +10,21 @@ module.exports.loginSchema = z.object({
         .max(100, { message: "Password is too long." })
 });
 
+module.exports.signupSchema = z.object({
+    username: z.string()
+        .min(3, { message: "Username must be at least 3 characters." })
+        .max(30, { message: "Username is too long." }),
+
+    email: z.string()
+        .min(1, { message: "Email is required." })
+        .email({ message: "Invalid email format." })
+        .max(100, { message: "Email is too long." }),
+
+    password: z.string()
+        .min(6, { message: "Password must be at least 6 characters." })
+        .max(100, { message: "Password is too long." })
+});
+
 module.exports.changePasswordSchema = z.object({
     currentPassword: z.string().min(1, "Current password is required"),
     newPassword: z.string().min(6, "New password must be at least 6 characters")

From 2bdd1dacb3aee71cd6655af98a79d03c874d1f73 Mon Sep 17 00:00:00 2001
From: francesca <francescascarpellini327@gmail.com>
Date: Wed, 28 Jan 2026 12:22:22 +0100
Subject: [PATCH 2/3] fix: use signupSchema in signup and add missing zod
 import

---
 backend/controllers/userAuth.controller.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/backend/controllers/userAuth.controller.js b/backend/controllers/userAuth.controller.js
index dc1632e7e..5a1a5411d 100644
--- a/backend/controllers/userAuth.controller.js
+++ b/backend/controllers/userAuth.controller.js
@@ -1,7 +1,8 @@
 const jwt = require('jsonwebtoken');
 const bcrypt = require('bcryptjs');
+const { z } = require('zod');
 const mongoose = require('mongoose');
-const { loginSchema } = require('../utils/input.validation');
+const { loginSchema, signupSchema } = require('../utils/input.validation');
 
 module.exports.signup = async (req, res) => {
     try {

From aec485f01e5de9967c517bb41dca6de49be422ce Mon Sep 17 00:00:00 2001
From: francesca <francescascarpellini327@gmail.com>
Date: Wed, 28 Jan 2026 12:36:49 +0100
Subject: [PATCH 3/3] fix: use signupSchema in signup and add missing zod
 import2

---
 backend/controllers/userAuth.controller.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/controllers/userAuth.controller.js b/backend/controllers/userAuth.controller.js
index 5a1a5411d..c4acf3ffa 100644
--- a/backend/controllers/userAuth.controller.js
+++ b/backend/controllers/userAuth.controller.js
@@ -9,7 +9,7 @@ module.exports.signup = async (req, res) => {
         const project = req.project;
 
         // Zod Validation (Prevents NoSQL Injection too)
-        const { email, password, ...otherData } = loginSchema.parse(req.body);
+        const { email, password, username, ...otherData } = signupSchema.parse(req.body);
 
         const collectionName = `${project._id}_users`;
         const collection = mongoose.connection.db.collection(collectionName);