Feature/password validation 790

[aarushii25]

## 🔐 feat: Implement Strong Password Validation (Fixes #790)

Hey @devanshi14malhotra! I've implemented the strong password validation system as discussed in Issue #790. Here's a detailed breakdown of everything that was done:

---

📋 What Was Done

This PR adds a complete password validation system with both frontend real-time feedback and backend enforcement — so weak passwords are blocked at every layer.

---

🗂️ Files Changed

New Files:

• frontend/js/passwordValidator.js — Reusable validation utility with 5 password rules and strength scoring
• frontend/js/authValidator.js — Wires up real-time UI (strength bar, checklist, submit button toggle) on the auth page

Modified Files:

• backend/validators.py — Added validate_password_strength() function and integrated it into RegisterRequest via Pydantic's field_validator so weak passwords are rejected before any business logic runs
• backend/middleware.py — Added require_strong_password decorator as a second layer of backend defence
• backend/app.py — Applied @require_strong_password decorator to the /api/v1/register route
• frontend/pages/auth.html — Added strength bar, strength label, and checklist UI elements (already present)
• frontend/css/style.css — Added password strength styles (already present)
• tests/test_validation.py — Added test_password_strength() and test_register_password_integration() with 19 test cases

---

✅ Password Rules Enforced

Rule	Example
Minimum 8 characters	password ❌ → passwords ✅
One uppercase letter (A–Z)	secure@1 ❌ → Secure@1 ✅
One lowercase letter (a–z)	SECURE@1 ❌ → Secure@1 ✅
One digit (0–9)	Secure@! ❌ → Secure@1 ✅
One special character (@#$!%&*)	Secure123 ❌ → Secure@123 ✅

---

🎯 How It Works

Frontend:

• Real-time strength bar updates as user types
• Checklist shows ✓ (green) or ✗ (red) for each rule
• Strength label shows: Weak / Fair / Good / Strong
• Submit button stays disabled until all 5 rules pass
• Checklist only appears in Register mode, not Login mode
• If user tries to submit with a weak password, checklist shakes to draw attention

Backend:

• RegisterRequest Pydantic model validates password strength before any DB operation
• require_strong_password middleware decorator provides a second layer of protection
• Passwords are never sanitized or modified — only validated
• Clear error messages returned: {"error": "Password does not meet security requirements", "requirements": [...]}

---

🧪 Tests Added

Run with:

cd backend
python tests/test_validation.py

10 unit tests for validate_password_strength() covering boundary cases, empty strings, missing rules etc.
9 integration tests for RegisterRequest covering strong/weak password combinations.

---

🔗 Related

Closes #790

Let me know if any changes are needed! Happy to update anything. 🙌

[netlify]

✅ Deploy Preview for bibliodrift-dm ready!

Name	Link
🔨 Latest commit	6111dfb
🔍 Latest deploy log	https://app.netlify.com/projects/bibliodrift-dm/deploys/6a195e6028d75600089023f2
😎 Deploy Preview	https://deploy-preview-1082--bibliodrift-dm.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[devanshi14malhotra]

@aarushii25 pr is not ready for merge yet... pls:

• Include the missing vault-author-fix.js file.
• Remove the old password strength UI from auth.html so only the new one remains.
• Completely remove the require_strong_password middleware (since the Pydantic validation handles it perfectly) to remove the dead code.

[aarushii25]

Hi @devanshi14malhotra,

Thanks for the review! I've made all the requested changes and successfully resolved the merge conflicts:

Added missing file: Created the vault-author-fix.js file.

Cleaned up UI: Verified auth.html and ensured only the new password strength UI remains.

Removed Dead Code: Completely removed the require_strong_password middleware and its imports from app.py since Pydantic handles validation now.

The PR is ready for another review. Let me know if anything else is needed!