timescale.info#198 · Usernames that would pass for the site or its staff are refused (#184)
- timeline-app
- pull request
Closes #184. Registration already refused the site's own page names (`api`, `timelines`, `admin`, … — `RESERVED_NAMES`, from #148). This adds what was still open: - **Names that would pass for the site or its staff** — `root`, `moderator`, `staff`, `noreply`, `postmaster`, `abuse`, `official`, `team` and others (`OFFICIAL_NAMES` in `src/addresses.ts`). - **Spellings around them** — with hyphens or underscores removed (`ad_min`, `sign-in`, `time-lines`), with a trailing number (`admin1`, `root-2`), and anything starting with `openchronology` (`openchronology-support`, `open_chronology`). Names that merely contain one stay free (`rootbeer`, `admiral`, `team-rocket`, `2admin`). Not changed: - **Existing accounts** keep their names and addresses. Routing (`timelineAddress`, the proxy) still reserves only the site's pages, so a pre-existing `root` keeps `/root/ `. - **The first administrator** (`ADMIN_USERNAME`, default `admin`) is the operator's choice and may still be any of these, as the deployment docs and packages set it up. - Identity-provider sign-ups get generated ` _ ` names, which never match. Tests: `test/addresses.test.mjs` (refused and allowed names, existing addresses), `test/account-security-postgres.mjs` (registration refuses `root`, `Admin_1`, `openchronology-team`). Docs: `docs/sharing.md`, and the OpenAPI registration schema.
Sources
Open #198 · Usernames that would pass for the site or its staff are refused (#184) in the timeline