Fix Codacy code quality issues

- Add curly braces around single-line if statements (S121)
- Fix redundant assignment in template rendering (S3441)
- Add Regex timeout to prevent potential ReDoS (Semgrep security)

Author: nickprotop

Commands/ViewCommand.cs

@@ -1433,7 +1433,7 @@ public static (string key, int? occurrence) ParseKeyWithOccurrence(string input)
             return (input, null);
 
         // Match pattern like "KeyName [2]" at the end
-        var match = Regex.Match(input, @"^(.+?)\s*\[(\d+)\]$");
+        var match = Regex.Match(input, @"^(.+?)\s*\[(\d+)\]$", RegexOptions.None, TimeSpan.FromSeconds(1));
         if (match.Success)
         {
             var key = match.Groups[1].Value.Trim();

cloud/src/LrmCloud.Api/Helpers/PasswordValidator.cs

@@ -2,24 +2,36 @@
 
 namespace LrmCloud.Api.Helpers;
 
-public static class PasswordValidator
+public static partial class PasswordValidator
 {
+    private static readonly TimeSpan RegexTimeout = TimeSpan.FromSeconds(1);
+
     public static (bool IsValid, string? ErrorMessage) Validate(string password)
     {
         if (password.Length < 12)
+        {
             return (false, "Password must be at least 12 characters");
+        }
 
-        if (!Regex.IsMatch(password, @"[A-Z]"))
+        if (!Regex.IsMatch(password, @"[A-Z]", RegexOptions.None, RegexTimeout))
+        {
             return (false, "Password must contain at least one uppercase letter");
+        }
 
-        if (!Regex.IsMatch(password, @"[a-z]"))
+        if (!Regex.IsMatch(password, @"[a-z]", RegexOptions.None, RegexTimeout))
+        {
             return (false, "Password must contain at least one lowercase letter");
+        }
 
-        if (!Regex.IsMatch(password, @"[0-9]"))
+        if (!Regex.IsMatch(password, @"[0-9]", RegexOptions.None, RegexTimeout))
+        {
             return (false, "Password must contain at least one digit");
+        }
 
-        if (!Regex.IsMatch(password, @"[^a-zA-Z0-9]"))
+        if (!Regex.IsMatch(password, @"[^a-zA-Z0-9]", RegexOptions.None, RegexTimeout))
+        {
             return (false, "Password must contain at least one special character");
+        }
 
         return (true, null);
     }

cloud/src/LrmCloud.Api/Services/AuthService.cs

@@ -125,7 +125,7 @@ private async Task SendAccountExistsEmailAsync(string email)
 
             var html = await template.RenderAsync(new
             {
-                email = email,
+                email,
                 login_link = loginLink,
                 reset_link = resetLink
             });
@@ -149,20 +149,30 @@ await _mailService.TrySendEmailAsync(_logger,
         var user = await _db.Users.FirstOrDefaultAsync(u => u.Email == email.ToLowerInvariant());
 
         if (user == null)
+        {
             return (false, "Invalid verification link");
+        }
 
         if (user.EmailVerified)
+        {
             return (false, "Email already verified");
+        }
 
         if (user.EmailVerificationExpiresAt == null || user.EmailVerificationExpiresAt < DateTime.UtcNow)
+        {
             return (false, "Verification link expired");
+        }
 
         if (string.IsNullOrEmpty(user.EmailVerificationTokenHash))
+        {
             return (false, "Invalid verification token");
+        }
 
         // Verify token by hashing and comparing
         if (!BCrypt.Net.BCrypt.Verify(token, user.EmailVerificationTokenHash))
+        {
             return (false, "Invalid verification token");
+        }
 
         // Mark as verified
         user.EmailVerified = true;
@@ -259,14 +269,20 @@ await _mailService.TrySendEmailAsync(_logger,
             return (false, "Password reset is only available for email accounts");
 
         if (string.IsNullOrEmpty(user.PasswordResetTokenHash))
+        {
             return (false, "No password reset requested");
+        }
 
         if (user.PasswordResetExpires == null || user.PasswordResetExpires < DateTime.UtcNow)
+        {
             return (false, "Password reset link expired");
+        }
 
         // Verify token by hashing and comparing
         if (!BCrypt.Net.BCrypt.Verify(request.Token, user.PasswordResetTokenHash))
+        {
             return (false, "Invalid password reset token");
+        }
 
         // Hash new password
         var passwordHash = BCrypt.Net.BCrypt.HashPassword(request.NewPassword, 12);
@@ -663,24 +679,34 @@ public async Task<bool> RevokeRefreshTokenAsync(string refreshToken, string? ipA
         var user = await _db.Users.FirstOrDefaultAsync(u => u.Id == userId);
 
         if (user == null)
+        {
             return (false, "User not found");
+        }
 
         // Only allow password change for email auth users
         if (user.AuthType != "email")
+        {
             return (false, "Password change is only available for email/password accounts");
+        }
 
         // Verify current password
         if (string.IsNullOrEmpty(user.PasswordHash) || !BCrypt.Net.BCrypt.Verify(request.CurrentPassword, user.PasswordHash))
+        {
             return (false, "Current password is incorrect");
+        }
 
         // Validate new password strength
         var (isValid, validationError) = PasswordValidator.Validate(request.NewPassword);
         if (!isValid)
+        {
             return (false, validationError);
+        }
 
         // Check if new password is same as current
         if (BCrypt.Net.BCrypt.Verify(request.NewPassword, user.PasswordHash))
+        {
             return (false, "New password must be different from current password");
+        }
 
         // Hash new password
         var newPasswordHash = BCrypt.Net.BCrypt.HashPassword(request.NewPassword, 12);
@@ -727,12 +753,16 @@ public async Task<bool> RevokeRefreshTokenAsync(string refreshToken, string? ipA
 
         // Check if new email is same as current
         if (newEmail == currentEmail)
+        {
             return (false, "New email is the same as current email");
+        }
 
         // Check if new email is already in use by another user
         var emailExists = await _db.Users.AnyAsync(u => u.Email!.ToLower() == newEmail && u.Id != userId);
         if (emailExists)
+        {
             return (false, "This email address is already in use");
+        }
 
         // Generate verification token
         var verificationToken = TokenGenerator.GenerateSecureToken(32);
@@ -765,11 +795,15 @@ public async Task<bool> RevokeRefreshTokenAsync(string refreshToken, string? ipA
         var user = await _db.Users.FirstOrDefaultAsync(u => u.Id == userId);
 
         if (user == null)
+        {
             return (false, "User not found");
+        }
 
         // Check if there's a pending email change
         if (string.IsNullOrEmpty(user.PendingEmail) || string.IsNullOrEmpty(user.PendingEmailTokenHash))
+        {
             return (false, "No pending email change found");
+        }
 
         // Check if token expired
         if (user.PendingEmailExpiresAt == null || user.PendingEmailExpiresAt < DateTime.UtcNow)
@@ -785,7 +819,9 @@ public async Task<bool> RevokeRefreshTokenAsync(string refreshToken, string? ipA
 
         // Verify token
         if (!BCrypt.Net.BCrypt.Verify(token, user.PendingEmailTokenHash))
+        {
             return (false, "Invalid verification token");
+        }
 
         // Check if new email is still available (might have been taken during verification period)
         var newEmailLower = user.PendingEmail.ToLowerInvariant();
@@ -1004,11 +1040,15 @@ public async Task<List<SessionDto>> GetSessionsAsync(int userId, string? current
             .FirstOrDefaultAsync(rt => rt.Id == sessionId && rt.UserId == userId);
 
         if (session == null)
+        {
             return (false, "Session not found");
+        }
 
         // Check if already revoked
         if (session.RevokedAt != null)
+        {
             return (false, "Session already revoked");
+        }
 
         // Revoke the session
         session.RevokedAt = DateTime.UtcNow;
@@ -1040,7 +1080,9 @@ public async Task<List<SessionDto>> GetSessionsAsync(int userId, string? current
         }
 
         if (currentSession == null)
+        {
             return (false, 0, "Current session not found");
+        }
 
         // Revoke all sessions except current
         int revokedCount = 0;
@@ -1065,13 +1107,17 @@ public async Task<List<SessionDto>> GetSessionsAsync(int userId, string? current
     {
         var user = await _db.Users.FirstOrDefaultAsync(u => u.Id == userId);
         if (user == null)
+        {
             return (false, "User not found");
+        }
 
         // Verify password for confirmation (only if user has password set)
         if (!string.IsNullOrEmpty(user.PasswordHash))
         {
             if (!BCrypt.Net.BCrypt.Verify(request.Password, user.PasswordHash))
+            {
                 return (false, "Incorrect password");
+            }
         }
         else
         {
@@ -1111,7 +1157,9 @@ public async Task<List<SessionDto>> GetSessionsAsync(int userId, string? current
     private async Task SendAccountDeletionConfirmationAsync(User user)
     {
         if (string.IsNullOrEmpty(user.Email))
+        {
             return;
+        }
 
         try
         {