ee72d71872
Added PASSWORD_MIN_LENGTH and RESERVED_USERNAMES to src/constants.py as the single source of truth. Previously PASSWORD_MIN_LENGTH was hardcoded as 8 in four route handlers and all three JS validation paths; RESERVED_USERNAMES was an inline frozenset duplicated in core/auth.py, routes/assistant_routes.py, routes/research_routes.py, and src/task_scheduler.py. Added GET /api/auth/policy (unauthenticated) so the frontend reads the real values from the server instead of hardcoding them in JS. Added missing empty-username guard to /setup and admin POST /users. Both returned a misleading 500/409 on whitespace-only input. /signup already had the check; this makes all three consistent. |
||
|---|---|---|
| .. | ||
| fonts | ||
| icons | ||
| js | ||
| lib | ||
| app.js | ||
| icon.ico | ||
| index.html | ||
| login.html | ||
| manifest.json | ||
| style.css | ||
| sw.js | ||