John O'Keefe
cc5677eb17
14 endpoints backfilled: devices pending/approve/reject; users
password/profile/profile-delete self-service (admin variants in prose);
admin list_users + update_user_max_devices; progress history; book
matching; new password-rules doc.
Gate fix: authLabel missed JWT middleware written inline as
createJWTMiddleware(cfg) (uppercase 'JWT') — reported auth 'none' for
/api/auth self-service routes and would have for any wrapper-inlined
group. Labeled 'JWTMiddleware' + fallthrough 'jwt' case.
Claude registry: 12 entries. Drift fixed by gate: list_users on-device —
handler returns raw []database.Users (bare array, full model incl.
password_hash — real leak the API emits; pinned + documented; earlier
draft had invented {users,total,limit,offset} wrapper). max-devices
response is {message} only. books/match is GET /api/books/match
{matches, action}. progress history sessions = ReadingHistory rows
(pgtype fields). make test 9/9.
31 lines
624 B
Markdown
31 lines
624 B
Markdown
---
|
|
method: GET
|
|
path: /api/auth/password-rules
|
|
auth: none
|
|
area: authentication
|
|
---
|
|
<!-- source: internal/handlers/auth.go:746 AuthHandler.GetPasswordRules -->
|
|
|
|
# Password Rules
|
|
|
|
Returns the active password complexity configuration, so UI requirement
|
|
checkers mirror the real rules. The server remains the enforcer. This
|
|
route is rate-limited.
|
|
|
|
## Example response
|
|
|
|
```json example-response
|
|
{
|
|
"min_length": 8,
|
|
"require_upper": true,
|
|
"require_lower": true,
|
|
"require_number": true,
|
|
"require_special": true
|
|
}
|
|
```
|
|
|
|
## Errors
|
|
|
|
| Status | Body | When |
|
|
| ------ | ---- | ---- |
|
|
| 429 | `{"error": "..."}` | rate limited | |