src/engines/auth/validators/authValidators.ts

/**
 * Auth Engine Input and Tenant Constraints Validators
 */

export class AuthValidators {
  /**
   * Safe check for email standard format
   */
  static validateEmail(email: string): boolean {
    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
    return emailRegex.test(email);
  }

  /**
   * Student PIN must be numeric and match strict length guidelines (e.g. 4 or 6 digits)
   */
  static validateStudentPin(pin: string, expectedLength: number = 4): { isValid: boolean; error?: string } {
    if (!pin) return { isValid: false, error: 'Student Access PIN is required.' };
    const numOnly = /^\d+$/;
    if (!numOnly.test(pin)) {
      return { isValid: false, error: 'Access PIN must contain digits only.' };
    }
    if (pin.length !== expectedLength) {
      return { isValid: false, error: `Access PIN must be exactly ${expectedLength} digits.` };
    }
    return { isValid: true };
  }

  /**
   * Validates robust tenant credentials for school pilot codes
   */
  static validateSchoolCode(schoolCode: string): boolean {
    if (!schoolCode) return false;
    const sanit = schoolCode.trim().toLowerCase();
    // Ensure school codes are alphanumeric with hyphens (e.g., "school-ltd-01")
    return /^[a-z0-9]+(-[a-z0-9]+)*$/.test(sanit);
  }

  /**
   * Enterprise-grade length checks for teacher registrations
   */
  static validatePasswordStrength(password: string): { isValid: boolean; error?: string } {
    if (!password || password.length < 8) {
      return { 
        isValid: false, 
        error: 'Security password must compile to at least 8 alphanumeric elements.' 
      };
    }
    return { isValid: true };
  }
}