From 38f3baf94d08b0e3ec40e6bacc4e330459e2a4d3 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sat, 19 Sep 2026 22:06:16 -0700 Subject: users: reserve service names on registration and rename A username is also a lightning address, so a name that reads as the service collects payments meant for it. "mint" was registered days after the ecash redesign freed it and received payments addressed to mint@coinos.io; the reserved list held only "ecash", and was duplicated in two places. One shared list now, checked on both paths, covering the service-sounding names an account should never be able to take. Co-Authored-By: Claude Opus 5 (1M context) --- routes/users.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'routes') diff --git a/routes/users.ts b/routes/users.ts index cbd2079d..431425b4 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -9,6 +9,7 @@ import { mail, templates } from "$lib/mail"; import { getNostrUser, getProfile, serverPubkey2 } from "$lib/nostr"; import register from "$lib/register"; import { assertNameFree } from "$lib/names"; +import { isReserved } from "$lib/reserved"; import { emit } from "$lib/sockets"; import upload from "$lib/upload"; import { bail, fail, fields, getUser, pick } from "$lib/utils"; @@ -271,11 +272,10 @@ export default { const { confirm, password, pin, newpin } = body; const username = body?.username?.toLowerCase().replace(/\s/g, ""); - const reserved = ["ecash"]; const valid = /^[\p{L}\p{N}]{2,24}$/u; if (!valid.test(username)) fail("Usernames can only have letters and numbers"); - if (reserved.includes(username)) fail("Invalid username"); + if (isReserved(username)) fail("Invalid username"); if (username?.includes("undefined")) fail("Invalid username"); let exists; -- cgit v1.2.3