refactor: remove unused Pinia stores and related code

- Deleted the layout-store, profiles-store, and index.ts files from the Pinia store setup.
- Removed the zod-sync script as it is no longer needed.
- Cleaned up the tsconfig.json file by removing unnecessary references.
- Updated the login logic in the profiles package to use polling for login results instead of in-process waiters.
- Added validation methods for personal data and profile parameters.
- Introduced new tests for validation logic in profiles and registration packages.
- Enhanced email normalization and validation in the registration package.

auth/password_validation_test.go

@@ -0,0 +1,111 @@
+package auth
+
+import (
+	"testing"
+
+	authpkg "encore.dev/beta/auth"
+	"encore.dev/beta/errs"
+	"encore.dev/types/uuid"
+)
+
+func TestValidatePasswordRejectsShortAndEmptyValues(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		password string
+	}{
+		{name: "empty", password: ""},
+		{name: "spaces", password: "   "},
+		{name: "short", password: "short"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validatePassword(tc.password)
+			if err == nil {
+				t.Fatalf("validatePassword(%q) = nil, want error", tc.password)
+			}
+			e, ok := err.(*errs.Error)
+			if !ok {
+				t.Fatalf("validatePassword(%q) returned %T, want *errs.Error", tc.password, err)
+			}
+			if e.Code != errs.InvalidArgument {
+				t.Fatalf("validatePassword(%q) returned code %v, want %v", tc.password, e.Code, errs.InvalidArgument)
+			}
+		})
+	}
+}
+
+func TestLoginParamsValidate(t *testing.T) {
+	uid, err := uuid.NewV4()
+	if err != nil {
+		t.Fatalf("uuid.NewV4() failed: %v", err)
+	}
+
+	if err := (&LoginParams{UserID: uuid.Nil, Password: "validpass"}).Validate(); err == nil {
+		t.Fatal("Validate() should reject nil user id")
+	}
+	if err := (&LoginParams{UserID: uid, Password: "short"}).Validate(); err == nil {
+		t.Fatal("Validate() should reject short password")
+	}
+	if err := (&LoginParams{UserID: uid, Password: "validpass"}).Validate(); err != nil {
+		t.Fatalf("Validate() returned unexpected error: %v", err)
+	}
+}
+
+func TestRegisterParamsValidate(t *testing.T) {
+	uid, err := uuid.NewV4()
+	if err != nil {
+		t.Fatalf("uuid.NewV4() failed: %v", err)
+	}
+
+	if err := (&RegisterParams{UserID: uuid.Nil, Password: "validpass"}).Validate(); err == nil {
+		t.Fatal("Validate() should reject nil user id")
+	}
+	if err := (&RegisterParams{UserID: uid, Password: "weak"}).Validate(); err == nil {
+		t.Fatal("Validate() should reject weak password")
+	}
+}
+
+func TestPepperedPasswordRequiresConfiguredSecret(t *testing.T) {
+	old := secrets.PasswordPepper
+	secrets.PasswordPepper = ""
+	defer func() { secrets.PasswordPepper = old }()
+
+	if _, err := pepperedPassword("validpass"); err == nil {
+		t.Fatal("pepperedPassword() should fail when PasswordPepper is empty")
+	}
+}
+
+func TestPasswordReuseDetection(t *testing.T) {
+	old := secrets.PasswordPepper
+	secrets.PasswordPepper = "pepper-test"
+	defer func() { secrets.PasswordPepper = old }()
+
+	hash, err := hashPassword("this-is-a-valid-password")
+	if err != nil {
+		t.Fatalf("hashPassword() failed: %v", err)
+	}
+	if !isPasswordReuse(hash, "this-is-a-valid-password") {
+		t.Fatal("isPasswordReuse() should return true for the same password")
+	}
+	if isPasswordReuse(hash, "another-very-different-pass") {
+		t.Fatal("isPasswordReuse() should return false for a different password")
+	}
+}
+
+func TestParseUserID(t *testing.T) {
+	uid, err := uuid.NewV4()
+	if err != nil {
+		t.Fatalf("uuid.NewV4() failed: %v", err)
+	}
+
+	parsed, err := parseUserID(authpkg.UID(uid.String()))
+	if err != nil {
+		t.Fatalf("parseUserID() returned unexpected error: %v", err)
+	}
+	if parsed != uid {
+		t.Fatalf("parseUserID() mismatch: got %v, want %v", parsed, uid)
+	}
+
+	if _, err := parseUserID(authpkg.UID("not-a-uuid")); err == nil {
+		t.Fatal("parseUserID() should reject invalid UUID strings")
+	}
+}