Reserve a few user names

These are all names that are used for domain.com/:route routes or projected to be.

3 files changed, 44 insertions, 0 deletions

diff --git a/config/config.exs b/config/config.exs
index 4b8762761..980c215c8 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -220,6 +220,35 @@ config :cors_plug,
   credentials: true,
   headers: ["Authorization", "Content-Type", "Idempotency-Key"]
 
+config :pleroma, Pleroma.User,
+  restricted_nicknames: [
+    "main",
+    "users",
+    "settings",
+    "objects",
+    "activities",
+    "web",
+    "registration",
+    "friend-requests",
+    "pleroma",
+    "api",
+    "tag",
+    "notice",
+    "status",
+    "user-search",
+    "ostatus_subscribe",
+    "oauth",
+    "push",
+    "relay",
+    "inbox",
+    ".well-known",
+    "nodeinfo",
+    "auth",
+    "proxy",
+    "dev",
+    "internal"
+  ]
+
 # Import environment specific config. This must remain at the bottom
 # of this file so it overrides the configuration defined above.
 import_config "#{Mix.env()}.exs"
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 1f930479d..33f5e43fc 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -197,6 +197,7 @@ defmodule Pleroma.User do
       |> validate_confirmation(:password)
       |> unique_constraint(:email)
       |> unique_constraint(:nickname)
+      |> validate_exclusion(:nickname, Pleroma.Config.get([Pleroma.User, :restricted_nicknames]))
       |> validate_format(:nickname, local_nickname_regex())
       |> validate_format(:email, @email_regex)
       |> validate_length(:bio, max: 1000)
diff --git a/test/user_test.exs b/test/user_test.exs
index aab6473cf..8c7e1594b 100644
--- a/test/user_test.exs
+++ b/test/user_test.exs
@@ -153,6 +153,20 @@ defmodule Pleroma.UserTest do
       end)
     end
 
+    test "it restricts certain nicknames" do
+      [restricted_name | _] = Pleroma.Config.get([Pleroma.User, :restricted_nicknames])
+
+      assert is_bitstring(restricted_name)
+
+      params =
+        @full_user_data
+        |> Map.put(:nickname, restricted_name)
+
+      changeset = User.register_changeset(%User{}, params)
+
+      refute changeset.valid?
+    end
+
     test "it sets the password_hash, ap_id and following fields" do
       changeset = User.register_changeset(%User{}, @full_user_data)