fix: remove username in $validFields by default

The default configration does not validate username.

Author: kenjis

src/Config/Auth.php

@@ -223,7 +223,7 @@ class Auth extends BaseConfig
      */
     public array $validFields = [
         'email',
-        'username',
+        // 'username',
     ];
 
     /**

src/Controllers/RegisterController.php

@@ -79,7 +79,7 @@ public function registerAction(): RedirectResponse
         $allowedPostFields = array_merge(
             setting('Auth.validFields'),
             setting('Auth.personalFields'),
-            ['password']
+            array_keys($rules),
         );
         $user = $this->getUserEntity();
         $user->fill($this->request->getPost($allowedPostFields));

tests/Controllers/LoginTest.php

@@ -118,6 +118,11 @@ public function testLoginActionUsernameSuccess(): void
     {
         Time::setTestNow('March 10, 2017', 'America/Chicago');
 
+        // Add 'username' to $validFields
+        $authConfig                = config('Auth');
+        $authConfig->validFields[] = 'username';
+        Factories::injectMock('config', 'Auth', $authConfig);
+
         // Change the validation rules
         $config = new class () extends Validation {
             public $login = [