From 38f3baf94d08b0e3ec40e6bacc4e330459e2a4d3 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sat, 19 Sep 2026 22:06:16 -0700 Subject: users: reserve service names on registration and rename A username is also a lightning address, so a name that reads as the service collects payments meant for it. "mint" was registered days after the ecash redesign freed it and received payments addressed to mint@coinos.io; the reserved list held only "ecash", and was duplicated in two places. One shared list now, checked on both paths, covering the service-sounding names an account should never be able to take. Co-Authored-By: Claude Opus 5 (1M context) --- lib/reserved.ts | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 lib/reserved.ts (limited to 'lib/reserved.ts') diff --git a/lib/reserved.ts b/lib/reserved.ts new file mode 100644 index 00000000..df5f0d43 --- /dev/null +++ b/lib/reserved.ts @@ -0,0 +1,31 @@ +// Usernames nobody may register or rename into. A coinos username is also a +// lightning address, so a name that reads as ours lets an account collect +// payments meant for the service: "mint" was claimed within days of the ecash +// redesign freeing it (2026-09-18) and took payments addressed to +// mint@coinos.io until it was renamed. +// +// Checked on registration (lib/register.ts) and on rename (routes/users.ts). +// Names already held by the v3 registrar are refused separately, by +// assertNameFree in lib/names.ts. +export const reserved = [ + "admin", + "administrator", + "ark", + "cash", + "coinos", + "ecash", + "fund", + "help", + "info", + "lightning", + "mint", + "pool", + "root", + "security", + "support", + "system", + "wallet", +]; + +export const isReserved = (username: string) => + reserved.includes(String(username || "").toLowerCase().replace(/\s/g, "")); -- cgit v1.2.3