backend/utils/input.validation.js (2)

14-16: Consider adding format validation for username.

The username field only validates length but allows any characters including spaces, special characters, or emojis. Depending on your requirements, you may want to add a regex constraint for alphanumeric characters and common symbols (e.g., underscores, hyphens).

Additionally, consider adding .trim() before validation to prevent whitespace-only or padded usernames from passing validation.

💡 Optional enhancement

     username: z.string()
+        .trim()
         .min(3, { message: "Username must be at least 3 characters." })
-        .max(30, { message: "Username is too long." }),
+        .max(30, { message: "Username is too long." })
+        .regex(/^[a-zA-Z0-9_-]+$/, { message: "Username can only contain letters, numbers, underscores, and hyphens." }),

---

18-25: Email and password validation is duplicated from loginSchema.

The email and password validation logic is repeated between loginSchema (lines 4-10) and signupSchema. Consider extracting reusable field schemas to reduce duplication and ensure consistency.

♻️ Optional refactor to reduce duplication

// Reusable field schemas
const emailField = z.string()
    .min(1, { message: "Email is required." })
    .email({ message: "Invalid email format." })
    .max(100, { message: "Email is too long." });

const passwordField = z.string()
    .min(6, { message: "Password must be at least 6 characters." })
    .max(100, { message: "Password is too long." });

module.exports.loginSchema = z.object({
    email: emailField,
    password: passwordField
});

module.exports.signupSchema = z.object({
    username: z.string()
        .min(3, { message: "Username must be at least 3 characters." })
        .max(30, { message: "Username is too long." }),
    email: emailField,
    password: passwordField
});