[Anshuu2004]

What does this PR do?

POST /api/v1/auth/register had no check on the body, so a missing field went straight into prisma.user.findUnique / bcrypt.hash(undefined, 10), threw, and came back as a generic 500. Now it answers 400 and says which field is the problem.

• new utils/registerInput.ts (parseRegisterInput, a small zod schema, same shape as questionInput.ts from fix: validate question input and keep question order unique #219). userRegisterController calls it first, so nothing reaches findUnique or bcrypt until name, email and password are all real strings. The 400 uses the same errorResponse shape as login: { "success": false, "error": "..." }.
• messages name the field(s): password is required, name and password are required, name, email and password are required, password must be a string. Missing, null, empty and whitespace-only all count as "required"; a number, array or object gives "must be a string". A request with no body at all or a JSON array reports all three as required.
• values are used exactly as sent (no trimming), so a valid registration and the duplicate-email 400 behave as before.

One thing I found while checking: on main an empty or whitespace-only password was not just a 500 case, it actually registered (201), so you could create an account with password "". That is rejected now too.

Other controllers, as the issue asked me to look (not changed here, to keep this small): createQuizController already checks !title || !description, but a non-string like {"title": 5} is not caught. joinQuizController in sessionController.ts checks presence but answers { message } instead of { success, error }, and also does not check types. I can do these as a follow up if you want. I also left email format checking out on purpose, it did not exist for register before and the issue is about missing fields.

The terminal output below is the real curl output from the built http-server against a local Postgres, before (upstream main) and after (this branch). I rendered the text into an image with Playwright, and shortened the JWT in the successful responses to its first 12 characters, nothing else is edited.

Before:

After:

Related issue

Closes #191

NSoC 2026, level1.

Type of change

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance
• Tests
• Build / CI / deployment

Which services does this touch?

• apps/frontend
• apps/http-server
• apps/ws-server
• apps/genAI
• packages/db (schema or Prisma changes)
• Docker / CI

How did you test this?

Unit tests, pnpm --filter http-server run test: 70 pass (was 43 on main, 27 new). The new ones are registerInput.test.ts (the schema and its messages) and authController.test.ts, which mocks @repo/db and bcrypt and checks that the bad bodies get a 400 and never call findUnique, bcrypt.hash or user.create, and that a valid user still gets a 201 and a duplicate email still gets the 400. With the controller change reverted, 5 of the 7 controller tests fail (the two regression ones pass, as they should).

Against a real server and database: throwaway PG 18 with prisma migrate deploy, http-server built with tsc -b and started on a local port, same curl cases before and after (in the screenshots):

case	before	after
no password	500	400 password is required
only email	500	400 name and password are required
{} or no body	500	400 name, email and password are required
"password": ""	201, account created	400 password is required
"password": " "	201, account created	400 password is required
"name": " "	201	400 name is required
"email": null	500	400 email is required
"password": 12345678	500	400 password must be a string
"email": {"$ne":"x"}	500	400 email must be a string
"name": ["t"]	500	400 name must be a string
body [1,2]	500	400 name, email and password are required
valid registration	201	201
same email again	400 Email is already existed..	400 Email is already existed..
login with the new account	200	200

pnpm run check-types passes. pnpm run lint still exits 1 because of the frontend (20 problems, 18 errors), identical on clean main, nothing from this change. pnpm run build fails at admin (VITE_ADMIN_API_URL is not set), also the same on clean main; tsc -b for http-server on its own builds fine.

Not tested: the frontend (not touched), docker compose up. Side note, not changed here: Signup.tsx reads error.response?.data?.erorr (typo), so the signup form never shows the server's message and always says "Failed to register...". Happy to fix that in a separate PR.

Checklist

• I ran pnpm run lint (it runs, but exits non-zero because of 18 errors already on main in the frontend; http-server has none)
• I ran pnpm run check-types
• I ran pnpm run build (fails at admin on a missing env var, same on main; http-server builds)
• The app still starts with docker-compose up
• I updated documentation if this changes behaviour or setup
• I did not commit any .env file, API key or other secret

---

First pull request here? CONTRIBUTING.md walks through the
whole process, and a checkbox left unticked is not a problem — say so and we
will help.