Add request body validation for user login #308

Problem

The login endpoint directly destructures email and password from req.body without validating whether these required fields are present.

const { email, password } = req.body;

If either email or password is missing or empty, the request continues processing and may return generic authentication errors instead of a clear validation response.

This makes it difficult for API consumers to distinguish between invalid credentials and invalid request payloads.

Suggested Improvement

Validate the required request body fields before executing the authentication logic.

The endpoint should verify that:

• email is provided
• password is provided

If either field is missing or empty, return a 400 Bad Request response with a clear validation message.

Expected Result

• Required fields are validated before querying the database.
• Invalid requests receive meaningful validation errors.
• Authentication logic only runs for valid input.
• Improved API reliability and developer experience.

Possible Implementation

• Add request body validation at the beginning of the login controller.
• Return a 400 Bad Request response if email or password is missing.
• Optionally move the validation into a reusable middleware shared across authentication routes.