04/06 remediate some issues

app/services/validation_service.py

@@ -24,16 +24,26 @@ def validate_password(password: str, confirm: str) -> str | None:
     -----
     - Password and confirmation must match.
     - Minimum length: 8 characters.
+    - Must contain at least one uppercase letter (A-Z).
+    - Must contain at least one digit (0-9).
+    - Must contain at least one special character (!@#$%^&* etc.).
 
     Parameters
     ----------
     password : str  – the candidate password (plain text)
     confirm  : str  – the confirmation field value
     """
+    import re
     if password != confirm:
         return 'Passwords do not match.'
     if len(password) < 8:
         return 'Password must be at least 8 characters.'
+    if not re.search(r'[A-Z]', password):
+        return 'Password must contain at least one uppercase letter.'
+    if not re.search(r'\d', password):
+        return 'Password must contain at least one number.'
+    if not re.search(r'[!@#$%^&*()\-_=+\[\]{};:\'",.<>?/\\|`~]', password):
+        return 'Password must contain at least one special character.'
     return None
 
 
@@ -163,10 +173,22 @@ def _group_by_alternative(
     [[gif87_sig], [gif89_sig]] so the caller can treat each inner list as
     a complete match candidate.
 
-    The rule: each entry with offset=0 starts a new alternative group.
-    Entries with offset>0 are appended to the current group (they are
-    additional constraints on the same file type, e.g. WEBP needs both
-    offset-0 'RIFF' and offset-8 'WEBP').
+    Grouping rule
+    -------------
+    Each entry with offset=0 starts a **new alternative** group.
+    Entries with offset>0 are appended to the **current** group — they
+    represent additional byte constraints that must ALL match alongside
+    the group's offset-0 anchor (e.g. WEBP requires both RIFF at offset 0
+    AND 'WEBP' at offset 8 within the same file).
+
+    ⚠️  Constraint: no two entries in the same alternative group may share
+    offset=0.  If a future signature needs two offset-0 checks as part of
+    ONE alternative (i.e. two different bytes that must both appear at the
+    start of the same file), this function would incorrectly split them
+    into separate alternatives.  In that case, use a combined bytes object
+    covering the full header range instead of two separate entries, or
+    refactor _MAGIC to use a dedicated tuple type that carries an
+    'alternative_id' discriminator.
     """
     groups: list[list[tuple[int, bytes]]] = []
     for offset, magic in signatures:
@@ -225,4 +247,4 @@ def render_comment_body(raw_text: str) -> str:
         attributes = _COMMENT_ALLOWED_ATTRS,
         strip      = True,
     )
-    return cleaned
+    return cleaned