feat: validate auth and user request structs

Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/auth/local.go

@@ -5,6 +5,7 @@ import (
 	"crussell/auth"
 	"crussell/db"
 	"crussell/internal/dav"
+	"crussell/internal/validators"
 	"crussell/mw"
 	"crypto/rand"
 	"database/sql"
@@ -56,19 +57,19 @@ func init() {
 }
 
 type RegisterRequest struct {
-	FirstName      string `json:"firstName"`
-	LastName       string `json:"lastName"`
-	Email          string `json:"email"`
-	Password       string `json:"password"`
-	Phone          string `json:"phone"`
-	DateOfBirth    string `json:"dateOfBirth"`
-	AgreedToPolicy bool   `json:"agreedToPolicy"`
-	ReferralCode   string `json:"referralCode,omitempty"`
+	FirstName    string `json:"firstName"    validate:"required,min=1,max=50"`
+	LastName     string `json:"lastName"     validate:"required,min=1,max=50"`
+	Email          string `json:"email"        validate:"required,email,max=254"`
+	Password       string `json:"password"     validate:"required,max=72"`
+	Phone          string `json:"phone"        validate:"required"`
+	DateOfBirth  string `json:"dateOfBirth"  validate:"required"`
+	AgreedToPolicy bool `json:"agreedToPolicy"`
+	ReferralCode string `json:"referralCode,omitempty" validate:"omitempty,max=12"`
 }
 
 type LoginRequest struct {
-	Email    string `json:"email"`
-	Password string `json:"password"`
+	Email    string `json:"email"    validate:"required,email,max=254"`
+	Password string `json:"password" validate:"required,max=72"`
 }
 
 // POST /api/register
@@ -79,6 +80,11 @@ func RegisterHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
 	// Must accept terms
 	if !req.AgreedToPolicy {
 		http.Error(w, "must agree to terms", http.StatusBadRequest)
@@ -282,6 +288,11 @@ func LoginHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
 	// Normalize email
 	req.Email = strings.ToLower(strings.TrimSpace(req.Email))