apply basic email validation to createAccount (#1658)

* apply basic email validation to createAccount

* format

packages/pds/package.json

@@ -47,6 +47,7 @@
     "bytes": "^3.1.2",
     "compression": "^1.7.4",
     "cors": "^2.8.5",
+    "disposable-email": "^0.2.3",
     "dotenv": "^16.0.0",
     "express": "^4.17.2",
     "express-async-errors": "^3.1.1",
@@ -77,6 +78,7 @@
     "@atproto/lex-cli": "workspace:^",
     "@did-plc/server": "^0.0.1",
     "@types/cors": "^2.8.12",
+    "@types/disposable-email": "^0.2.0",
     "@types/express": "^4.17.13",
     "@types/express-serve-static-core": "^4.17.36",
     "@types/jsonwebtoken": "^8.5.9",

packages/pds/src/api/com/atproto/server/createAccount.ts

@@ -1,4 +1,5 @@
 import { InvalidRequestError } from '@atproto/xrpc-server'
+import disposable from 'disposable-email'
 import { normalizeAndValidateHandle } from '../../../../handle'
 import * as plc from '@did-plc/lib'
 import * as scrypt from '../../../../db/scrypt'
@@ -27,6 +28,12 @@ export default function (server: Server, ctx: AppContext) {
         )
       }
 
+      if (!disposable.validate(email)) {
+        throw new InvalidRequestError(
+          'This email address is not supported, please use a different email.',
+        )
+      }
+
       // normalize & ensure valid handle
       const handle = await normalizeAndValidateHandle({
         ctx,

packages/pds/tests/account.test.ts

@@ -76,6 +76,28 @@ describe('account', () => {
     await expect(promise).rejects.toThrow('Input/handle must be a valid handle')
   })
 
+  describe('email validation', () => {
+    it('succeeds on allowed emails', async () => {
+      const promise = agent.api.com.atproto.server.createAccount({
+        email: '[email protected]',
+        handle: 'ok-email.test',
+        password: 'asdf',
+      })
+      await expect(promise).resolves.toBeTruthy()
+    })
+
+    it('fails on disallowed emails', async () => {
+      const promise = agent.api.com.atproto.server.createAccount({
+        email: '[email protected]',
+        handle: 'bad-email.test',
+        password: 'asdf',
+      })
+      await expect(promise).rejects.toThrow(
+        'This email address is not supported, please use a different email.',
+      )
+    })
+  })
+
   let did: string
   let jwt: string