fix(auth): accept single-label email domains and readable 422s

- RegisterIn.email: replace strict EmailStr with validated string;
  email-validator rejected 'user@localhost' (no dot) and reserved
  names, causing 422 on register/login with dev-style emails.
  Now normalized (trim+lowercase) with structural checks instead.
- UI: render Pydantic list-form 422 details readably instead of
  '[object Object]'; applied to login and run-error paths.
- dev secret_key padded to >=32 bytes to satisfy PyJWT's
  InsecureKeyLengthWarning for HS256.
- gitignore *.egg-info/

Author: beacoder

.gitignore

@@ -1,5 +1,6 @@
 __pycache__/
 *.pyc
+*.egg-info/
 .coverage
 htmlcov/
 .pytest_cache/

app/core/config.py

@@ -47,7 +47,7 @@ class Settings(BaseSettings):
     )
 
     db_url: str = "sqlite:///./paw.db"
-    secret_key: str = "dev-only-insecure-key-change-me"
+    secret_key: str = "dev-only-insecure-key-change-me-0123456789abcdef"
     fernet_key: str = ""
     """Fernet key for the secrets store; empty = derived from
     ``secret_key`` (dev convenience, stable across restarts)."""

app/schemas.py

@@ -4,15 +4,29 @@
 
 from datetime import datetime
 
-from pydantic import BaseModel, EmailStr, Field
+from pydantic import BaseModel, Field, field_validator
 
 # --- auth ---
 
 
 class RegisterIn(BaseModel):
-    email: EmailStr
+    # Deliberately a plain validated string, not EmailStr: email-validator
+    # rejects single-label domains ("user@localhost", common in dev) and
+    # reserved names outright, which made login/register 422 in practice.
+    email: str = Field(min_length=3, max_length=254)
     password: str = Field(min_length=8, max_length=128)
 
+    @field_validator("email")
+    @classmethod
+    def _normalize_email(cls, v: str) -> str:
+        v = v.strip().lower()
+        if v.count("@") != 1 or not v.split("@")[0]:
+            raise ValueError("must contain exactly one @ with a local part")
+        local, domain = v.split("@")
+        if not domain or " " in v or any(c in v for c in "\"'<>,;:\\"):
+            raise ValueError("invalid email address")
+        return v
+
 
 class TokenPair(BaseModel):
     access_token: str

app/static/index.html

@@ -79,6 +79,12 @@ <h1>python-agent-web</h1>
   msgs.appendChild(div); msgs.scrollTop = msgs.scrollHeight; return div;
 }
 
+function errMsg(res) {
+  return res.json().then(j => {
+    const d = j.detail ?? j;
+    return Array.isArray(d) ? d.map(e => `${(e.loc||[]).slice(1).join('.')}: ${e.msg}`).join('; ') : String(d);
+  }).catch(() => res.statusText || 'request failed');
+}
 $('loginBtn').onclick = async () => {
   const email = $('email').value.trim(), password = $('password').value;
   let res = await fetch('/auth/login', {method:'POST', headers:{'Content-Type':'application/json'},
@@ -87,7 +93,7 @@ <h1>python-agent-web</h1>
     res = await fetch('/auth/register', {method:'POST', headers:{'Content-Type':'application/json'},
       body: JSON.stringify({email, password})});
   }
-  if (!res.ok) { $('authMsg').textContent = 'auth failed: ' + (await res.json()).detail; return; }
+  if (!res.ok) { $('authMsg').textContent = 'auth failed: ' + await errMsg(res); return; }
   const tokens = await res.json();
   api.token = tokens.access_token; sessionStorage.setItem('token', api.token); showApp();
 };
@@ -152,7 +158,7 @@ <h1>python-agent-web</h1>
   }
   const res = await api.req(`/conversations/${currentConv}/runs`,
     {method:'POST', body: JSON.stringify({prompt})});
-  if (!res.ok) { add('err', (await res.json()).detail); return; }
+  if (!res.ok) { add('err', await errMsg(res)); return; }
   const run = await res.json();
   startStream(run.id);
 }