@johnnyboy11234/esg-idea-contest 0.1.0 → 0.2.1

package/backend/api/openapi.yaml

@@ -41,6 +41,35 @@ paths:
         '204': { description: Logged out }
         '403': { $ref: '#/components/responses/Problem' }
         '500': { $ref: '#/components/responses/Problem' }
+  /auth/register:
+    post:
+      operationId: register
+      tags: [auth]
+      summary: Self-service registration (no session is created)
+      description: >
+        Validation order: format, password policy, uniqueness (PRD 6.3). Sets no cookie.
+      security: []
+      parameters:
+        - $ref: '#/components/parameters/CsrfToken'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/RegisterRequest' }
+      responses:
+        '201':
+          description: Account created; log in separately
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/RegisterResponse' }
+        '400': { $ref: '#/components/responses/Problem' }
+        '403': { $ref: '#/components/responses/Problem' }
+        '409': { $ref: '#/components/responses/Problem' }
+        '413': { $ref: '#/components/responses/Problem' }
+        '415': { $ref: '#/components/responses/Problem' }
+        '422': { $ref: '#/components/responses/Problem' }
+        '500': { $ref: '#/components/responses/Problem' }
+        '503': { $ref: '#/components/responses/Problem' }
   /deadline:
     get:
       operationId: getDeadline
@@ -125,6 +154,21 @@ components:
       required: [token]
       properties:
         token: { type: string }
+    RegisterRequest:
+      type: object
+      required: [empNo, name, email, password]
+      properties:
+        empNo: { type: string, description: 'Exactly 6 ASCII digits' }
+        name: { type: string, description: 1-50 code points after clean-up }
+        email: { type: string, description: 'Printable ASCII with exactly one @, at most 254 characters; stored lower-cased' }
+        password: { type: string, format: password }
+    RegisterResponse:
+      type: object
+      required: [empNo, name, email]
+      properties:
+        empNo: { type: string }
+        name: { type: string }
+        email: { type: string }
     Problem:
       type: object
       required: [type, title, status, code]

package/backend/cmd/server/main.go

@@ -13,6 +13,8 @@ import (
 
 	_ "github.com/go-sql-driver/mysql"
 
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/account"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/config"
@@ -42,7 +44,15 @@ func run() error {
 	}
 	defer func() { _ = db.Close() }()
 
-	si := server.API{Deadline: deadline.Handler{Store: deadline.SQLStore{DB: db}}}
+	auditSvc := audit.New(db, log)
+	errs := server.ErrorAdapter{Audit: auditSvc, Log: log}
+	si := server.API{
+		Account: account.Handler{
+			Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
+			Fail:    errs.Write,
+		},
+		Deadline: deadline.Handler{Store: deadline.SQLStore{DB: db}},
+	}
 
 	var ready atomic.Bool
 	return server.Run(ctx, cfg, log, server.NewPublic(log, server.Mount(si)), &ready, server.DBCheck(db))

package/backend/db/migration/V002__audit_log_full.sql

@@ -0,0 +1,32 @@
+-- V002 (B1-03): the remaining audit_log columns (PRD 6.11 "Fields"). Expand-only: V001 created
+-- the skeleton (id, occurred_at); the table is still empty, so NOT NULL columns are safe.
+-- Append-only: application code only INSERTs (test/arch scans for anything else).
+-- "before" / "after" are reserved words in MariaDB, hence before_json / after_json.
+-- No foreign keys: a row must outlive the user or Idea it describes.
+
+ALTER TABLE audit_log
+    ADD COLUMN request_id       UUID              NULL     COMMENT 'X-Request-Id of the request' AFTER occurred_at,
+    ADD COLUMN actor_emp_no     VARCHAR(64)       NULL     COMMENT 'NULL for ANONYMOUS and SYSTEM' AFTER request_id,
+    ADD COLUMN actor_role       VARCHAR(16)       NOT NULL AFTER actor_emp_no,
+    ADD COLUMN action           VARCHAR(40)       NOT NULL AFTER actor_role,
+    ADD COLUMN outcome          VARCHAR(16)       NOT NULL AFTER action,
+    ADD COLUMN target_type      VARCHAR(16)       NULL     AFTER outcome,
+    ADD COLUMN target_id        UUID              NULL     AFTER target_type,
+    ADD COLUMN method           VARCHAR(8)        NULL     AFTER target_id,
+    ADD COLUMN route            VARCHAR(200)      NULL     COMMENT 'route template, never the raw path' AFTER method,
+    ADD COLUMN status           SMALLINT UNSIGNED NULL     AFTER route,
+    ADD COLUMN error_code       VARCHAR(64)       NULL     AFTER status,
+    ADD COLUMN ip               INET6             NULL     AFTER error_code,
+    ADD COLUMN user_agent       VARCHAR(256)      NULL     AFTER ip,
+    ADD COLUMN submitted_emp_no VARCHAR(64)       NULL     COMMENT 'sanitized employee ID typed into a failed login or registration' AFTER user_agent,
+    ADD COLUMN before_json      JSON              NULL     AFTER submitted_emp_no,
+    ADD COLUMN after_json       JSON              NULL     AFTER before_json,
+    -- Reserved for the optional hash chain (PRD 9 #5); nothing writes them yet.
+    ADD COLUMN prev_hash        BINARY(32)        NULL,
+    ADD COLUMN hash             BINARY(32)        NULL,
+    ADD CONSTRAINT ck_audit_log_actor_role  CHECK (actor_role IN ('USER', 'ADMIN', 'ANONYMOUS', 'SYSTEM')),
+    ADD CONSTRAINT ck_audit_log_outcome     CHECK (outcome IN ('SUCCESS', 'FAILED', 'DENIED', 'THROTTLED')),
+    ADD CONSTRAINT ck_audit_log_target_type CHECK (target_type IS NULL OR target_type IN ('USER', 'IDEA', 'DEADLINE')),
+    ADD KEY ix_audit_log_actor (actor_emp_no, occurred_at, id),
+    ADD KEY ix_audit_log_request (request_id),
+    ADD KEY ix_audit_log_target (target_id, occurred_at, id);

package/backend/db/migration/V003__app_user.sql

@@ -0,0 +1,36 @@
+-- V003 (B1-05): app_user, the one table for Users and Admins (PRD 4, 6.3).
+-- Field rules are enforced here as well as in Go, so no code path can store a value the API would reject.
+--   emp_no     exactly 6 ASCII digits (string; keeps leading zeros)
+--   name       1-50 code points, no control characters, none of  / \ : * ? " < > |  (PRD 6.2 #5, #8);
+--              the NFC / whitespace clean-up itself is done by shared/text before the INSERT
+--   email      printable ASCII only, no whitespace, one '@' with non-empty sides, <= 254, already lower-cased (OI-14);
+--              unique byte-exact (utf8mb4_bin). NULL only for Admins, who have no email (PRD 4).
+--   password_hash  bcrypt, cost 10 only (PRD 6.4, OI-13)
+-- Enumerations are VARCHAR + CHECK, never ENUM. Times are database time in UTC.
+
+CREATE TABLE app_user (
+    id            UUID         NOT NULL DEFAULT UUID(),
+    emp_no        CHAR(6)      NOT NULL,
+    name          VARCHAR(50)  NOT NULL,
+    email         VARCHAR(254) NULL,
+    password_hash CHAR(60)     NOT NULL,
+    role          VARCHAR(8)   NOT NULL,
+    -- Every authenticated request checks this (PRD 4); an Admin removed from Vault is disabled, not deleted.
+    enabled       BOOLEAN      NOT NULL DEFAULT TRUE,
+    created_at    DATETIME(6)  NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+    updated_at    DATETIME(6)  NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+    PRIMARY KEY (id),
+    UNIQUE KEY uq_app_user_emp_no (emp_no),
+    -- Several NULLs are allowed (Admins); non-NULL values are unique.
+    UNIQUE KEY uq_app_user_email (email),
+    CONSTRAINT ck_app_user_emp_no CHECK (CHAR_LENGTH(emp_no) = 6 AND emp_no NOT REGEXP '[^0-9]'),
+    CONSTRAINT ck_app_user_name_length CHECK (CHAR_LENGTH(name) BETWEEN 1 AND 50),
+    CONSTRAINT ck_app_user_name_chars CHECK (name NOT REGEXP '[[:cntrl:]]' AND name NOT REGEXP '[/\\\\:*?"<>|]'),
+    CONSTRAINT ck_app_user_email CHECK (email IS NULL OR (
+        email NOT REGEXP '[^!-~]'
+        AND email = LOWER(email)
+        AND email REGEXP '^[^@]+@[^@]+$')),
+    CONSTRAINT ck_app_user_hash CHECK (password_hash REGEXP '^[$]2[aby][$]10[$][./A-Za-z0-9]{53}$'),
+    CONSTRAINT ck_app_user_role CHECK (role IN ('USER', 'ADMIN')),
+    CONSTRAINT ck_app_user_email_by_role CHECK ((role = 'USER' AND email IS NOT NULL) OR (role = 'ADMIN' AND email IS NULL))
+) ENGINE = InnoDB DEFAULT CHARSET = utf8mb4 COLLATE = utf8mb4_bin;

package/backend/db/migration/V004__session.sql

@@ -0,0 +1,19 @@
+-- V004 (B1-07): server-side sessions (PRD 6.5). Only SHA-256(session ID) is stored, never the ID itself,
+-- so a database read does not yield usable cookies. The role is NOT stored: it is read from app_user on
+-- every request. Times are database time in UTC (Architecture principle 4).
+--   idle timeout     30 min since last_access_at (refreshed at most once per 60 s, OI-11)
+--   absolute timeout  8 h since created_at
+-- Deleting or disabling a user ends their sessions: ON DELETE CASCADE here, SessionRevoker for disable.
+
+CREATE TABLE session (
+    id_hash        BINARY(32)  NOT NULL,
+    user_id        UUID        NOT NULL,
+    created_at     DATETIME(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+    last_access_at DATETIME(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+    PRIMARY KEY (id_hash),
+    KEY ix_session_user (user_id),
+    -- Purge scans by age.
+    KEY ix_session_created (created_at),
+    KEY ix_session_last_access (last_access_at),
+    CONSTRAINT fk_session_user FOREIGN KEY (user_id) REFERENCES app_user (id) ON DELETE CASCADE
+) ENGINE = InnoDB DEFAULT CHARSET = utf8mb4 COLLATE = utf8mb4_bin;

package/backend/go.mod

@@ -12,6 +12,7 @@ require (
 	github.com/oapi-codegen/runtime v1.8.0
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	github.com/testcontainers/testcontainers-go/modules/mariadb v0.45.0
+	golang.org/x/crypto v0.58.0
 	golang.org/x/text v0.43.0
 )
 
@@ -73,7 +74,6 @@ require (
 	go.opentelemetry.io/otel/metric v1.44.0 // indirect
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/crypto v0.58.0 // indirect
 	golang.org/x/mod v0.41.0 // indirect
 	golang.org/x/sync v0.24.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect

package/backend/internal/account/account_test.go

@@ -0,0 +1,191 @@
+package account_test
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/account"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// A Service with no database: every case here must be rejected before any I/O.
+func validate(t *testing.T, cmd account.RegisterCommand) *web.Error {
+	t.Helper()
+	svc := &account.Service{Policy: account.StubPolicy{}}
+	_, err := svc.Register(context.Background(), cmd, account.Request{})
+	var e *web.Error
+	if !errors.As(err, &e) {
+		t.Fatalf("want *web.Error, got %v", err)
+	}
+	return e
+}
+
+func good() account.RegisterCommand {
+	return account.RegisterCommand{EmpNo: "089290", Name: "王小明", Email: "a@b.c", Password: "whatever-goes"}
+}
+
+func codes(e *web.Error) []string {
+	var out []string
+	for _, f := range e.Fields {
+		out = append(out, f.Field+":"+string(f.Code))
+	}
+	return out
+}
+
+func TestRegisterValidation(t *testing.T) {
+	cases := []struct {
+		name   string
+		mut    func(*account.RegisterCommand)
+		top    web.ErrorCode
+		fields string
+	}{
+		{"empty emp no", func(c *account.RegisterCommand) { c.EmpNo = " " }, web.CodeValidationFailed, "empNo:REQUIRED"},
+		{"emp no 5 digits", func(c *account.RegisterCommand) { c.EmpNo = "12345" }, web.CodeValidationFailed, "empNo:INVALID_FORMAT"},
+		{"emp no 7 digits", func(c *account.RegisterCommand) { c.EmpNo = "1234567" }, web.CodeValidationFailed, "empNo:INVALID_FORMAT"},
+		{"emp no letter", func(c *account.RegisterCommand) { c.EmpNo = "12345a" }, web.CodeValidationFailed, "empNo:INVALID_FORMAT"},
+		{"emp no not trimmed", func(c *account.RegisterCommand) { c.EmpNo = " 12345" }, web.CodeValidationFailed, "empNo:INVALID_FORMAT"},
+		{"emp no fullwidth digits", func(c *account.RegisterCommand) { c.EmpNo = "１２３４５６" }, web.CodeValidationFailed, "empNo:INVALID_FORMAT"},
+		{"name empty after clean-up", func(c *account.RegisterCommand) { c.Name = " 　\t" }, web.CodeValidationFailed, "name:REQUIRED"},
+		{"name forbidden char", func(c *account.RegisterCommand) { c.Name = "a/b" }, web.CodeInvalidNameChars, "name:INVALID_NAME_CHARS"},
+		{"name control char", func(c *account.RegisterCommand) { c.Name = "a\x00b" }, web.CodeValidationFailed, "name:INVALID_FORMAT"},
+		{"name 51 code points", func(c *account.RegisterCommand) { c.Name = strings.Repeat("名", 51) }, web.CodeValidationFailed, "name:OUT_OF_RANGE"},
+		{"email with space", func(c *account.RegisterCommand) { c.Email = "a b@x.com" }, web.CodeValidationFailed, "email:INVALID_FORMAT"},
+		{"email without @", func(c *account.RegisterCommand) { c.Email = "ab.com" }, web.CodeValidationFailed, "email:INVALID_FORMAT"},
+		{"email two @", func(c *account.RegisterCommand) { c.Email = "a@b@c" }, web.CodeValidationFailed, "email:INVALID_FORMAT"},
+		{"email empty local", func(c *account.RegisterCommand) { c.Email = "@b" }, web.CodeValidationFailed, "email:INVALID_FORMAT"},
+		{"email empty domain", func(c *account.RegisterCommand) { c.Email = "a@" }, web.CodeValidationFailed, "email:INVALID_FORMAT"},
+		{"email non-ASCII", func(c *account.RegisterCommand) { c.Email = "é@x.com" }, web.CodeValidationFailed, "email:INVALID_FORMAT"},
+		{"email empty", func(c *account.RegisterCommand) { c.Email = "" }, web.CodeValidationFailed, "email:REQUIRED"},
+		{"email 255 chars", func(c *account.RegisterCommand) { c.Email = strings.Repeat("a", 253) + "@b" }, web.CodeValidationFailed, "email:OUT_OF_RANGE"},
+		{"password empty", func(c *account.RegisterCommand) { c.Password = "" }, web.CodeValidationFailed, "password:REQUIRED"},
+		{"password beyond bcrypt", func(c *account.RegisterCommand) { c.Password = strings.Repeat("p", 73) }, web.CodeValidationFailed, "password:OUT_OF_RANGE"},
+		{"all fields in form order", func(c *account.RegisterCommand) {
+			c.EmpNo, c.Name, c.Email, c.Password = "x", "a:b", "nope", ""
+		}, web.CodeValidationFailed, "empNo:INVALID_FORMAT name:INVALID_NAME_CHARS email:INVALID_FORMAT password:REQUIRED"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			cmd := good()
+			tc.mut(&cmd)
+			e := validate(t, cmd)
+			if e.Status != 422 || e.Code != tc.top {
+				t.Errorf("status %d code %s, want 422 %s", e.Status, e.Code, tc.top)
+			}
+			if got := strings.Join(codes(e), " "); got != tc.fields {
+				t.Errorf("fields = %q, want %q", got, tc.fields)
+			}
+			// Every failure is an AUTH_REGISTER FAILED attempt for the adapter.
+			if e.AuditAction != "AUTH_REGISTER" || e.AuditOutcome != "FAILED" || e.AuditReason != "validation" {
+				t.Errorf("audit fields = %q %q %q", e.AuditAction, e.AuditOutcome, e.AuditReason)
+			}
+		})
+	}
+}
+
+func TestFailedAuditCarriesEmpNoOnlyWhenWellFormed(t *testing.T) {
+	cmd := good()
+	cmd.Name = ""
+	e := validate(t, cmd)
+	if e.AuditSubmittedEmpNo != "089290" || e.AuditDetail["empNo"] != "089290" {
+		t.Errorf("well-formed: submitted %q detail %v", e.AuditSubmittedEmpNo, e.AuditDetail)
+	}
+	cmd.EmpNo = "12x"
+	e = validate(t, cmd)
+	if e.AuditSubmittedEmpNo != "12x" || e.AuditDetail != nil {
+		t.Errorf("malformed: submitted %q detail %v", e.AuditSubmittedEmpNo, e.AuditDetail)
+	}
+}
+
+type spyPolicy struct{ empNo string }
+
+func (s *spyPolicy) Check(_, empNo string) []web.FieldError {
+	s.empNo = empNo
+	return []web.FieldError{{Field: "password", Code: web.CodePasswordPolicy}}
+}
+
+func TestPolicyRunsWithFormatErrorsAndSeesEmpNoOnlyWhenWellFormed(t *testing.T) {
+	spy := &spyPolicy{}
+	svc := &account.Service{Policy: spy}
+	cmd := good()
+	cmd.Email = "bad"
+
+	_, err := svc.Register(context.Background(), cmd, account.Request{})
+	var e *web.Error
+	if !errors.As(err, &e) {
+		t.Fatal(err)
+	}
+	if got := strings.Join(codes(e), " "); got != "email:INVALID_FORMAT password:PASSWORD_POLICY" {
+		t.Errorf("fields = %q: format and policy errors must come together", got)
+	}
+	if spy.empNo != "089290" {
+		t.Errorf("policy got empNo %q", spy.empNo)
+	}
+
+	cmd.EmpNo = "bad"
+	_, _ = svc.Register(context.Background(), cmd, account.Request{})
+	if spy.empNo != "" {
+		t.Errorf("policy got empNo %q for a malformed ID; CONTAINS_EMP_NO must be skipped", spy.empNo)
+	}
+}
+
+func TestTopCodeIsPasswordPolicyWhenFirst(t *testing.T) {
+	svc := &account.Service{Policy: &spyPolicy{}}
+	_, err := svc.Register(context.Background(), good(), account.Request{})
+	var e *web.Error
+	if !errors.As(err, &e) || e.Code != web.CodePasswordPolicy || e.Status != 422 {
+		t.Fatalf("%v", err)
+	}
+}
+
+func handlerFor(got *error) http.Handler {
+	h := account.Handler{
+		Service: &account.Service{Policy: account.StubPolicy{}},
+		Fail:    func(_ http.ResponseWriter, _ *http.Request, err error) { *got = err },
+	}
+	return http.HandlerFunc(h.Register)
+}
+
+func post(h http.Handler, contentType, body string) {
+	req := httptest.NewRequest("POST", "/api/v1/auth/register", strings.NewReader(body))
+	if contentType != "" {
+		req.Header.Set("Content-Type", contentType)
+	}
+	h.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+func TestHandlerTransportErrors(t *testing.T) {
+	cases := []struct {
+		name, ct, body string
+		code           web.ErrorCode
+		audited        bool
+	}{
+		{"broken JSON", "application/json", `{`, web.CodeMalformedRequest, true},
+		{"missing field", "application/json", `{"empNo":"089290","name":"n","email":"a@b"}`, web.CodeMalformedRequest, true},
+		{"null field", "application/json", `{"empNo":"089290","name":"n","email":"a@b","password":null}`, web.CodeMalformedRequest, true},
+		{"wrong type", "application/json", `{"empNo":89290,"name":"n","email":"a@b","password":"x"}`, web.CodeMalformedRequest, true},
+		{"duplicate key", "application/json", `{"empNo":"1","empNo":"2","name":"n","email":"a@b","password":"x"}`, web.CodeMalformedRequest, true},
+		{"not JSON", "text/plain", `{}`, web.CodeUnsupportedMedia, false},
+		{"no content type", "", `{}`, web.CodeUnsupportedMedia, false},
+		{"over 16 KiB", "application/json", `{"name":"` + strings.Repeat("x", 17<<10) + `"}`, web.CodeRequestTooLarge, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var got error
+			post(handlerFor(&got), tc.ct, tc.body)
+			var e *web.Error
+			if !errors.As(got, &e) || e.Code != tc.code {
+				t.Fatalf("got %v, want %s", got, tc.code)
+			}
+			if audited := e.AuditReason != ""; audited != tc.audited {
+				t.Errorf("audited = %v, want %v (PRD 6.11: only 400, 409, 422)", audited, tc.audited)
+			}
+			if tc.audited && (e.AuditAction != "AUTH_REGISTER" || e.AuditOutcome != "FAILED" || e.AuditSubmittedEmpNo != "") {
+				t.Errorf("audit fields = %q %q %q", e.AuditAction, e.AuditOutcome, e.AuditSubmittedEmpNo)
+			}
+		})
+	}
+}

package/backend/internal/account/handler.go

@@ -0,0 +1,58 @@
+package account
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// maxJSONBody is the JSON body limit (error-codes.md §2: 16 KiB → 413).
+const maxJSONBody = 16 << 10
+
+// Handler is the HTTP adapter of the account module. Fail is the central error
+// adapter (server.ErrorAdapter.Write); the module cannot import server.
+type Handler struct {
+	Service *Service
+	Fail    func(w http.ResponseWriter, r *http.Request, err error)
+}
+
+// registerBody holds pointers so DecodeJSON can tell absent/null (400) from
+// empty (422). Unknown keys are ignored.
+type registerBody struct {
+	EmpNo    *string `json:"empNo"`
+	Name     *string `json:"name"`
+	Email    *string `json:"email"`
+	Password *string `json:"password"`
+}
+
+// Register serves POST /auth/register: 201 {empNo, name, email}, no cookie, no Location.
+func (h Handler) Register(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxJSONBody)
+	var b registerBody
+	if err := web.DecodeJSON(r, &b); err != nil {
+		h.Fail(w, r, auditMalformed(err))
+		return
+	}
+	u, err := h.Service.Register(r.Context(), RegisterCommand{
+		EmpNo: *b.EmpNo, Name: *b.Name, Email: *b.Email, Password: *b.Password,
+	}, Request{
+		Method: r.Method, Route: web.RoutePattern(r), UserAgent: r.UserAgent(), IP: web.ClientIP(r),
+	})
+	if err != nil {
+		h.Fail(w, r, err)
+		return
+	}
+	web.WriteJSON(w, http.StatusCreated, api.RegisterResponse{EmpNo: u.EmpNo, Name: u.Name, Email: u.Email})
+}
+
+// auditMalformed marks a 400 as a FAILED registration (PRD §6.11 audits 400,
+// 409 and 422 here). Other transport errors (413, 415) are not audited.
+func auditMalformed(err error) error {
+	var e *web.Error
+	if errors.As(err, &e) && e.Code == web.CodeMalformedRequest {
+		return failed(e, "malformed_request", "", false)
+	}
+	return err
+}