feat(auth): Separate Login, Register, and Profile views with robust validations and SQL-safe backend

scripts/feedback_server.py

@@ -164,8 +164,53 @@ class FeedbackHandler(http.server.BaseHTTPRequestHandler):
             self.wfile.write(json.dumps({"error": f"Invalid JSON: {e}"}).encode("utf-8"))
             return
 
-        # 1. User Authentication (Login & Auto-Registration)
-        if path in ["/api/auth/login", "/api/bugs/auth/login", "/api/auth/register"]:
+        # 1a. User Login
+        if path in ["/api/auth/login", "/api/bugs/auth/login"]:
+            username = str(payload.get("username", "")).strip()
+            password_hash = str(payload.get("passwordHash", "")).strip()
+
+            if not username or not password_hash:
+                self.send_response(400)
+                self._set_cors()
+                self.end_headers()
+                self.wfile.write(json.dumps({"success": False, "message": "Введите логин и пароль"}).encode("utf-8"))
+                return
+
+            import re
+            if not re.match(r"^[a-zA-Zа-яА-ЯёЁ0-9_-]{3,20}$", username):
+                self.send_response(400)
+                self._set_cors()
+                self.end_headers()
+                self.wfile.write(json.dumps({"success": False, "message": "Логин может содержать только буквы, цифры, '-' и '_' (3-20 симв.)"}).encode("utf-8"))
+                return
+
+            user = db.get_user_by_username(username)
+            if not user:
+                self.send_response(404)
+                self._set_cors()
+                self.end_headers()
+                self.wfile.write(json.dumps({"success": False, "message": "Пользователь с таким логином не найден. Зарегистрируйтесь."}).encode("utf-8"))
+                return
+
+            res = db.authenticate_user(username, password_hash)
+            if not res or not res.get("success"):
+                self.send_response(401)
+                self._set_cors()
+                self.end_headers()
+                self.wfile.write(json.dumps(res or {"success": False, "message": "Неверный логин или пароль"}).encode("utf-8"))
+                return
+
+            data = json.dumps(res, ensure_ascii=False).encode("utf-8")
+            self.send_response(200)
+            self._set_cors()
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Content-Length", str(len(data)))
+            self.end_headers()
+            self.wfile.write(data)
+            return
+
+        # 1b. User Registration
+        if path in ["/api/auth/register", "/api/bugs/auth/register"]:
             username = str(payload.get("username", "")).strip()
             password_hash = str(payload.get("passwordHash", "")).strip()
             initial_data = payload.get("initialData")
@@ -174,27 +219,42 @@ class FeedbackHandler(http.server.BaseHTTPRequestHandler):
                 self.send_response(400)
                 self._set_cors()
                 self.end_headers()
-                self.wfile.write(json.dumps({"success": False, "message": "Имя пользователя и пароль обязательны"}).encode("utf-8"))
+                self.wfile.write(json.dumps({"success": False, "message": "Введите логин и пароль для регистрации"}).encode("utf-8"))
+                return
+
+            import re
+            if not re.match(r"^[a-zA-Zа-яА-ЯёЁ0-9_-]{3,20}$", username):
+                self.send_response(400)
+                self._set_cors()
+                self.end_headers()
+                self.wfile.write(json.dumps({"success": False, "message": "Логин может содержать только буквы, цифры, '-' и '_' (3-20 симв.)"}).encode("utf-8"))
+                return
+
+            if len(password_hash) < 1:
+                self.send_response(400)
+                self._set_cors()
+                self.end_headers()
+                self.wfile.write(json.dumps({"success": False, "message": "Пароль не может быть пустым"}).encode("utf-8"))
+                return
+
+            if username.lower() in ["гость", "guest", "admin", "null", "undefined", "system", "anonymous"]:
+                self.send_response(400)
+                self._set_cors()
+                self.end_headers()
+                self.wfile.write(json.dumps({"success": False, "message": "Это имя пользователя зарезервировано"}).encode("utf-8"))
                 return
 
-            # Check if user exists
             user = db.get_user_by_username(username)
             if user:
-                res = db.authenticate_user(username, password_hash)
-                if not res or not res.get("success"):
-                    self.send_response(401)
-                    self._set_cors()
-                    self.end_headers()
-                    self.wfile.write(json.dumps(res or {"success": False, "message": "Неверный пароль"}).encode("utf-8"))
-                    return
-                resp_json = res
-            else:
-                # Auto-register new user
-                res = db.register_user(username, password_hash, initial_data)
-                resp_json = res
+                self.send_response(409)
+                self._set_cors()
+                self.end_headers()
+                self.wfile.write(json.dumps({"success": False, "message": "Пользователь с таким логином уже существует"}).encode("utf-8"))
+                return
 
-            data = json.dumps(resp_json, ensure_ascii=False).encode("utf-8")
-            self.send_response(200)
+            res = db.register_user(username, password_hash, initial_data)
+            data = json.dumps(res, ensure_ascii=False).encode("utf-8")
+            self.send_response(200 if res.get("success") else 400)
             self._set_cors()
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.send_header("Content-Length", str(len(data)))