1 files changed, 12 insertions, 1 deletions
diff --git a/code/api/src/Endpoints/Internal/PasswordResetRequests/FulfillResetRequestRoute.cs b/code/api/src/Endpoints/Internal/PasswordResetRequests/FulfillResetRequestRoute.cs
index c831470..8c7ce03 100644
--- a/code/api/src/Endpoints/Internal/PasswordResetRequests/FulfillResetRequestRoute.cs
+++ b/code/api/src/Endpoints/Internal/PasswordResetRequests/FulfillResetRequestRoute.cs
@@ -1,11 +1,15 @@
+using Microsoft.Extensions.Localization;
+
 namespace IOL.GreatOffice.Api.Endpoints.Internal.PasswordResetRequests;
 
 public class FulfillResetRequestRoute : RouteBaseAsync.WithRequest<FulfillResetRequestRoute.Payload>.WithActionResult
 {
+    private readonly IStringLocalizer<SharedResources> _localizer;
     private readonly PasswordResetService _passwordResetService;
 
-    public FulfillResetRequestRoute(PasswordResetService passwordResetService) {
+    public FulfillResetRequestRoute(PasswordResetService passwordResetService, IStringLocalizer<SharedResources> localizer) {
         _passwordResetService = passwordResetService;
+        _localizer = localizer;
     }
 
     public class Payload
@@ -17,6 +21,13 @@ public class FulfillResetRequestRoute : RouteBaseAsync.WithRequest<FulfillResetR
     [AllowAnonymous]
     [HttpPost("~/_/password-reset-request/fulfill")]
     public override async Task<ActionResult> HandleAsync(Payload request, CancellationToken cancellationToken = default) {
+        if (request.NewPassword.Length < 6) {
+            return KnownProblem(_localizer["Invalid form"],
+                _localizer["One or more fields is invalid"],
+                new() {{"newPassword", new string[] {_localizer["The new password needs to be atleast 6 characters"]}}}
+            );
+        }
+
         return await _passwordResetService.FulfillRequestAsync(request.Id, request.NewPassword, cancellationToken) switch {
             FulfillPasswordResetRequestResult.REQUEST_NOT_FOUND => NotFound(),
             FulfillPasswordResetRequestResult.USER_NOT_FOUND => NotFound(),