feat(api): enforce password validation on reset and update flows

Add bcrypt_password validation to password reset and update endpoints:
- Add validation tag to PasswordReset.NewPassword struct field
- Add validation tag to UserPassword.NewPassword struct field
- Add c.Validate() calls in both handlers
- Fix off-by-one error in bcrypt_password validator (use <= 72 not < 72)

Password requirements: min 8 chars, max 72 bytes (bcrypt limit)

pkg/routes/api/v1/user_password_reset.go

@@ -44,6 +44,11 @@ func UserResetPassword(c *echo.Context) error {
 		return echo.NewHTTPError(http.StatusBadRequest, "No password provided.").Wrap(err)
 	}
 
+	// Validate the password
+	if err := c.Validate(pwReset); err != nil {
+		return err
+	}
+
 	s := db.NewSession()
 	defer s.Close()
 

pkg/routes/api/v1/user_update_password.go

@@ -29,7 +29,7 @@ import (
 // UserPassword holds a user password. Used to update it.
 type UserPassword struct {
 	OldPassword string `json:"old_password"`
-	NewPassword string `json:"new_password"`
+	NewPassword string `json:"new_password" valid:"bcrypt_password" minLength:"8" maxLength:"72"`
 }
 
 // UserChangePassword is the handler to change a users password
@@ -58,6 +58,11 @@ func UserChangePassword(c *echo.Context) error {
 		return echo.NewHTTPError(http.StatusBadRequest, "No password provided.").Wrap(err)
 	}
 
+	// Validate the new password
+	if err := c.Validate(newPW); err != nil {
+		return err
+	}
+
 	if newPW.OldPassword == "" {
 		return user.ErrEmptyOldPassword{}
 	}

pkg/user/user_password_reset.go

@@ -27,7 +27,7 @@ type PasswordReset struct {
 	// The previously issued reset token.
 	Token string `json:"token"`
 	// The new password for this user.
-	NewPassword string `json:"new_password"`
+	NewPassword string `json:"new_password" valid:"bcrypt_password" minLength:"8" maxLength:"72"`
 }
 
 // ResetPassword resets a users password. It returns the ID of the user whose

pkg/user/validator.go

@@ -54,7 +54,7 @@ func init() {
 			return false
 		}
 
-		return len([]byte(str)) < 72
+		return len([]byte(str)) <= 72
 	}
 
 	govalidator.TagMap["language"] = i18n.HasLanguage