Bug report

Required System information

• Node.js version: v20.14.0
• NPM version: 10.7.0
• Strapi version: 5.4.0
• Database: mysql
• Operating system: darwin-arm64
• Is your project Javascript or Typescript: Typescript

Describe the bug

The issue occurs in the users-permissions plugin/extension.
I have added a custom field to the user model and configured it as both required and unique. However, when I make a POST request to create or register a user:

• If the custom field is missing from the request body, the request is still processed successfully.
• If the custom field value duplicates an existing value in the database, the request is also allowed, violating the unique constraint.

Steps to reproduce the behavior

1. Go to the users-permissions plugin and add a custom field to the user model.
2. Set the field to be required and unique in the content-type settings.
3. Use a POST request to register a new user via the /auth/local/register endpoint.
   • Test with the custom field unset.
   • Test with a duplicate value for the custom field.
4. Observe the request results.

Expected behavior

• If the custom field is missing from the request body, the API should return a validation error.
• If the custom field value duplicates an existing value in the database, the API should reject the request with a unique constraint violation error.

Screenshots

Code snippets

POST /auth/local/register

Duplicate Value

{ "username": "testuser", "email": "[email protected]", "password": "password123", "customField": {{duplicate value}} }

Missing Value

{ "username": "testuser", "email": "[email protected]", "password": "password123" }

Additional context

This issue directly affects data integrity as the constraints set on the custom field (required and unique) are not being enforced.