adds password max chars hint

web/src/routes/api/v1/auth/confirm-reset/+server.ts

@@ -8,8 +8,8 @@ export async function POST(event: RequestEvent) {
         const data = await event.request.json()
         const safeData = z.object({
             token: z.string(),
-            password: z.string(),
-            passwordConfirm: z.string()
+            password: z.string().min(8).max(72),
+            passwordConfirm: z.string().min(8).max(72)
         }).refine(d => d.password === d.passwordConfirm).parse(data)
         const r = await pb.collection('users').confirmPasswordReset(safeData.token, safeData.password, safeData.passwordConfirm);
         return json(r);

web/src/routes/api/v1/auth/login/+server.ts

@@ -9,7 +9,7 @@ export async function POST(event: RequestEvent) {
         const safeData = z.object({
             email: z.string().email().optional(),
             username: z.string().optional(),
-            password: z.string()
+            password: z.string().min(8).max(72)
         }).refine(d => d.email !== undefined || d.username !== undefined).parse(data);