Code reviewed and issue fixed.

app/routes/auth.py

@@ -6,6 +6,7 @@ from flask_login import login_user, logout_user, login_required, current_user
 from app import db, limiter
 from app.models import User, UserRole
 from app.services.log_service import log_action
+from app.services.validation_service import validate_password
 
 auth_bp = Blueprint('auth', __name__, url_prefix='/auth')
 logger  = logging.getLogger(__name__)
@@ -75,26 +76,30 @@ def register():
             flash('Email already registered.', 'danger')
         elif User.query.filter_by(username=username).first():
             flash('Username already taken.', 'danger')
-        elif password != confirm:
-            flash('Passwords do not match.', 'danger')
-        elif len(password) < 8:
-            flash('Password must be at least 8 characters.', 'danger')
         else:
-            user = User(
-                email      = email,
-                username   = username,
-                full_name  = full_name,
-                department = department,
-                phone      = phone,
-                role       = UserRole.EMPLOYEE,
-            )
-            user.set_password(password)
-            db.session.add(user)
-            log_action(user.id, 'user_register', 'user', user.id, f'email={email}')
-            db.session.commit()
-            logger.info(f'[AUTH REGISTER] user_id={user.id} email={email}')
-            flash('Account created! You may now log in.', 'success')
-            return redirect(url_for('auth.login'))
+            pw_error = validate_password(password, confirm)
+            if pw_error:
+                flash(pw_error, 'danger')
+            else:
+                user = User(
+                    email      = email,
+                    username   = username,
+                    full_name  = full_name,
+                    department = department,
+                    phone      = phone,
+                    role       = UserRole.EMPLOYEE,
+                )
+                user.set_password(password)
+                db.session.add(user)
+                # Flush to obtain user.id from the DB sequence before logging.
+                # Without this flush, user.id is None and the activity log entry
+                # records entity_id=None, making the log entry unlinkable.
+                db.session.flush()
+                log_action(user.id, 'user_register', 'user', user.id, f'email={email}')
+                db.session.commit()
+                logger.info(f'[AUTH REGISTER] user_id={user.id} email={email}')
+                flash('Account created! You may now log in.', 'success')
+                return redirect(url_for('auth.login'))
 
     return render_template('auth/register.html')
 
@@ -128,11 +133,9 @@ def profile():
         current_user.web_notif  = web_notif
 
         if new_pw:
-            if new_pw != confirm_pw:
-                flash('Passwords do not match.', 'danger')
-                return render_template('auth/profile.html')
-            if len(new_pw) < 8:
-                flash('Password must be at least 8 characters.', 'danger')
+            pw_error = validate_password(new_pw, confirm_pw)
+            if pw_error:
+                flash(pw_error, 'danger')
                 return render_template('auth/profile.html')
             current_user.set_password(new_pw)
             logger.info(f'[AUTH PASSWORD CHANGE] user_id={current_user.id}')