♿ Better account name validation

pkg/internal/server/api/accounts_api.go

@@ -3,6 +3,7 @@ package api
 import (
 	"fmt"
 	"strconv"
+	"strings"
 	"time"
 
 	"git.solsynth.dev/hydrogen/passport/pkg/internal/server/exts"
@@ -118,7 +119,7 @@ func editUserinfo(c *fiber.Ctx) error {
 	user := c.Locals("user").(models.Account)
 
 	var data struct {
-		Nick        string    `json:"nick" validate:"required,min=2,max=24"`
+		Nick        string    `json:"nick" validate:"required"`
 		Description string    `json:"description"`
 		FirstName   string    `json:"first_name"`
 		LastName    string    `json:"last_name"`
@@ -127,6 +128,11 @@ func editUserinfo(c *fiber.Ctx) error {
 
 	if err := exts.BindAndValidate(c, &data); err != nil {
 		return err
+	} else {
+		data.Nick = strings.TrimSpace(data.Nick)
+	}
+	if !services.ValidateAccountName(data.Nick, 4, 24) {
+		return fiber.NewError(fiber.StatusBadRequest, "invalid account nick, length requires 4 to 24")
 	}
 
 	var account models.Account
@@ -156,8 +162,8 @@ func editUserinfo(c *fiber.Ctx) error {
 
 func doRegister(c *fiber.Ctx) error {
 	var data struct {
-		Name       string `json:"name" validate:"required,lowercase,alphanum,min=2,max=16"`
-		Nick       string `json:"nick" validate:"required,min=2,max=24"`
+		Name       string `json:"name" validate:"required,lowercase,alphanum,min=4,max=16"`
+		Nick       string `json:"nick" validate:"required"`
 		Email      string `json:"email" validate:"required,email"`
 		Password   string `json:"password" validate:"required,min=4,max=32"`
 		MagicToken string `json:"magic_token"`
@@ -165,7 +171,15 @@ func doRegister(c *fiber.Ctx) error {
 
 	if err := exts.BindAndValidate(c, &data); err != nil {
 		return err
-	} else if viper.GetBool("use_registration_magic_token") && len(data.MagicToken) <= 0 {
+	} else {
+		data.Name = strings.TrimSpace(data.Name)
+		data.Nick = strings.TrimSpace(data.Nick)
+		data.Email = strings.TrimSpace(data.Email)
+	}
+	if !services.ValidateAccountName(data.Nick, 4, 24) {
+		return fiber.NewError(fiber.StatusBadRequest, "invalid account nick, length requires 4 to 24")
+	}
+	if viper.GetBool("use_registration_magic_token") && len(data.MagicToken) <= 0 {
 		return fmt.Errorf("missing magic token in request")
 	} else if viper.GetBool("use_registration_magic_token") {
 		if tk, err := services.ValidateMagicToken(data.MagicToken, models.RegistrationMagicToken); err != nil {

pkg/internal/server/api/userinfo_api.go

@@ -39,14 +39,25 @@ func getOtherUserinfo(c *fiber.Ctx) error {
 
 func getOtherUserinfoBatch(c *fiber.Ctx) error {
 	idSet := strings.Split(c.Query("id"), ",")
-	if len(idSet) == 0 {
-		return fiber.NewError(fiber.StatusBadRequest, "id list is required")
+	nameSet := strings.Split(c.Query("name"), ",")
+	if len(idSet) == 0 && len(nameSet) == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "query filter is required")
+	}
+
+	if len(idSet)+len(nameSet) > 100 {
+		return fiber.NewError(fiber.StatusBadRequest, "only support 100 users in a single batch")
+	}
+
+	tx := database.C.Model(&models.Account{}).Limit(100)
+	if len(idSet) > 0 {
+		tx = tx.Where("id IN ?", idSet)
+	}
+	if len(nameSet) > 0 {
+		tx = tx.Where("name IN ?", nameSet)
 	}
 
 	var accounts []models.Account
-	if err := database.C.
-		Where("id IN ?", idSet).
-		Find(&accounts).Error; err != nil {
+	if err := tx.Find(&accounts).Error; err != nil {
 		return fiber.NewError(fiber.StatusBadRequest, err.Error())
 	}
 

pkg/internal/services/accounts.go

@@ -3,6 +3,7 @@ package services
 import (
 	"fmt"
 	"time"
+	"unicode"
 
 	"gorm.io/gorm/clause"
 
@@ -16,6 +17,18 @@ import (
 	"github.com/samber/lo"
 )
 
+func ValidateAccountName(val string, min, max int) bool {
+	actualLength := 0
+	for _, r := range val {
+		if unicode.Is(unicode.Han, r) || unicode.Is(unicode.Hiragana, r) || unicode.Is(unicode.Katakana, r) || unicode.Is(unicode.Hangul, r) {
+			actualLength += 2
+		} else {
+			actualLength += 1
+		}
+	}
+	return min > actualLength && actualLength < max
+}
+
 func GetAccount(id uint) (models.Account, error) {
 	var account models.Account
 	if err := database.C.Where(models.Account{