Jul 2nd - Optimized code

app/services/validation_service.py

@@ -23,7 +23,7 @@ def validate_password(password: str, confirm: str) -> str | None:
     Rules
     -----
     - Password and confirmation must match.
-    - Minimum length: 8 characters.
+    - Length: 8-128 characters.
     - Must contain at least one uppercase letter (A-Z).
     - Must contain at least one digit (0-9).
     - Must contain at least one special character (!@#$%^&* etc.).
@@ -38,6 +38,10 @@ def validate_password(password: str, confirm: str) -> str | None:
         return 'Passwords do not match.'
     if len(password) < 8:
         return 'Password must be at least 8 characters.'
+    # Upper bound prevents a pathologically long input from driving up the
+    # cost of password hashing (which scales with input size) on the server.
+    if len(password) > 128:
+        return 'Password must be no more than 128 characters.'
     if not re.search(r'[A-Z]', password):
         return 'Password must contain at least one uppercase letter.'
     if not re.search(r'\d', password):