lots of stuff, don't truly remember

internal/user/service.go

@@ -27,14 +27,17 @@ func NewService() *Service {
 }
 
 func (s *Service) CreateUser(username, password, email, firstName, lastName string) (*User, error) {
-	if username == "" || password == "" {
-		return nil, errors.New("username and password are required")
+	if username == "" || password == "" || email == "" {
+		return nil, errors.New("username, password, and email are required")
 	}
 
-	if email != "" {
-		if !isValidEmail(email) {
-			return nil, errors.New("invalid email format")
-		}
+	// Username: 3-30 chars, alphanumeric + underscores/hyphens, must start with a letter
+	if !isValidUsername(username) {
+		return nil, errors.New("username must be 3-30 characters, start with a letter, and contain only letters, numbers, underscores, or hyphens")
+	}
+
+	if !isValidEmail(email) {
+		return nil, errors.New("invalid email format")
 	}
 
 	exists, err := s.repo.UserExists(username, email)
@@ -158,6 +161,14 @@ func (s *Service) UpdateUser(user *User) error {
 	return s.repo.UpdateUser(user)
 }
 
+func isValidUsername(username string) bool {
+	if len(username) < 3 || len(username) > 30 {
+		return false
+	}
+	regex := regexp.MustCompile(`^[a-zA-Z][a-zA-Z0-9_-]{2,29}$`)
+	return regex.MatchString(username)
+}
+
 func isValidEmail(email string) bool {
 	regex := regexp.MustCompile(`^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$`)
 	return regex.MatchString(email)