refactor: remove unused Pinia stores and related code

- Deleted the layout-store, profiles-store, and index.ts files from the Pinia store setup.
- Removed the zod-sync script as it is no longer needed.
- Cleaned up the tsconfig.json file by removing unnecessary references.
- Updated the login logic in the profiles package to use polling for login results instead of in-process waiters.
- Added validation methods for personal data and profile parameters.
- Introduced new tests for validation logic in profiles and registration packages.
- Enhanced email normalization and validation in the registration package.

registration/registration.go

@@ -9,6 +9,7 @@ import (
 	htmltemplate "html/template"
 	"net"
 	"net/mail"
+	"os"
 	"strings"
 	texttemplate "text/template"
 	"time"
@@ -31,11 +32,19 @@ var db = sqldb.NewDatabase("registration", sqldb.DatabaseConfig{
 var profilesDB = sqldb.Named("profiles")
 
 const (
-	welcomeTokenTTL       = 24 * time.Hour
-	passwordResetTokenTTL = time.Hour
-	frontendBaseURL       = "http://localhost:9000/#"
+	welcomeTokenTTL        = 24 * time.Hour
+	passwordResetTokenTTL  = time.Hour
+	defaultFrontendBaseURL = "http://localhost:9000/#"
 )
 
+var frontendBaseURL = defaultFrontendBaseURL
+
+func init() {
+	if value := strings.TrimSpace(os.Getenv("FRONTEND_BASE_URL")); value != "" {
+		frontendBaseURL = value
+	}
+}
+
 type RegisterParams struct {
 	Email       string `json:"email"`
 	DisplayName string `json:"display_name"`
@@ -57,6 +66,14 @@ type PasswordResetRequestParams struct {
 	Email string `json:"email"`
 }
 
+func (p *PasswordResetRequestParams) Validate() error {
+	if p == nil {
+		return &errs.Error{Code: errs.InvalidArgument, Message: "password reset request is required"}
+	}
+	_, err := normalizeEmail(p.Email)
+	return err
+}
+
 type PasswordResetRequestResponse struct {
 	EmailSent bool `json:"email_sent"`
 }
@@ -65,6 +82,13 @@ type PasswordResetConfirmParams struct {
 	Password string `json:"password" encore:"sensitive"`
 }
 
+func (p *PasswordResetConfirmParams) Validate() error {
+	if p == nil {
+		return &errs.Error{Code: errs.InvalidArgument, Message: "password reset confirm params are required"}
+	}
+	return authsvc.ValidatePassword(p.Password)
+}
+
 type PasswordResetConfirmResponse struct {
 	Email string `json:"email"`
 	Reset bool   `json:"reset"`
@@ -114,6 +138,18 @@ func CheckEmail(ctx context.Context, email string) (*EmailAvailabilityResponse,
 //
 //encore:api public method=POST path=/registration
 func Register(ctx context.Context, p *RegisterParams) (*RegisterResponse, error) {
+	if p == nil {
+		return nil, &errs.Error{Code: errs.InvalidArgument, Message: "register params are required"}
+	}
+	if err := (&profilessvc.RegisterParams{
+		Email:       p.Email,
+		DisplayName: p.DisplayName,
+		AvatarURL:   p.AvatarURL,
+		Password:    p.Password,
+	}).Validate(); err != nil {
+		return nil, err
+	}
+	pruneExpiredTokens(ctx)
 	profile, err := profilessvc.Insert(ctx, &profilessvc.RegisterParams{
 		Email:       p.Email,
 		DisplayName: p.DisplayName,
@@ -178,10 +214,14 @@ func ConfirmWelcome(ctx context.Context, token uuid.UUID) (*WelcomeResponse, err
 //
 //encore:api public method=POST path=/registration/password-reset
 func RequestPasswordReset(ctx context.Context, p *PasswordResetRequestParams) (*PasswordResetRequestResponse, error) {
+	if err := p.Validate(); err != nil {
+		return nil, err
+	}
 	email, err := normalizeEmail(p.Email)
 	if err != nil {
 		return nil, err
 	}
+	pruneExpiredTokens(ctx)
 
 	var profile profilessvc.Profile
 	err = profilesDB.QueryRow(ctx, `
@@ -226,6 +266,9 @@ func RequestPasswordReset(ctx context.Context, p *PasswordResetRequestParams) (*
 //
 //encore:api public method=POST path=/registration/password-reset/:token
 func ConfirmPasswordReset(ctx context.Context, token uuid.UUID, p *PasswordResetConfirmParams) (*PasswordResetConfirmResponse, error) {
+	if err := p.Validate(); err != nil {
+		return nil, err
+	}
 	var userID uuid.UUID
 	var email string
 	var expiresAt time.Time
@@ -285,7 +328,7 @@ func createPasswordResetToken(ctx context.Context, profile *profilessvc.Profile)
 }
 
 func normalizeEmail(email string) (string, error) {
-	email = strings.TrimSpace(email)
+	email = strings.TrimSpace(strings.ToLower(email))
 	if email == "" {
 		return "", &errs.Error{Code: errs.InvalidArgument, Message: "email is required"}
 	}
@@ -293,7 +336,12 @@ func normalizeEmail(email string) (string, error) {
 	if err != nil {
 		return "", &errs.Error{Code: errs.InvalidArgument, Message: "invalid email"}
 	}
-	return parsed.Address, nil
+	return strings.TrimSpace(strings.ToLower(parsed.Address)), nil
+}
+
+func pruneExpiredTokens(ctx context.Context) {
+	_, _ = db.Exec(ctx, `DELETE FROM welcome_tokens WHERE expires_at < NOW() OR used_at IS NOT NULL`)
+	_, _ = db.Exec(ctx, `DELETE FROM password_reset_tokens WHERE expires_at < NOW() OR used_at IS NOT NULL`)
 }
 
 func emailDomain(email string) (string, bool) {

registration/validation_test.go

@@ -0,0 +1,26 @@
+package registration
+
+import "testing"
+
+func TestNormalizeEmail(t *testing.T) {
+	got, err := normalizeEmail("  Alice@Example.com  ")
+	if err != nil {
+		t.Fatalf("normalizeEmail() returned unexpected error: %v", err)
+	}
+	if got != "alice@example.com" {
+		t.Fatalf("normalizeEmail() = %q, want %q", got, "alice@example.com")
+	}
+
+	if _, err := normalizeEmail(" "); err == nil {
+		t.Fatal("normalizeEmail() should reject empty email")
+	}
+}
+
+func TestPasswordResetConfirmParamsValidate(t *testing.T) {
+	if err := (&PasswordResetConfirmParams{Password: "weak"}).Validate(); err == nil {
+		t.Fatal("Validate() should reject weak password")
+	}
+	if err := (&PasswordResetConfirmParams{Password: "validpass"}).Validate(); err != nil {
+		t.Fatalf("Validate() returned unexpected error: %v", err)
+	}
+}