feat: block disposable email signups (#2883)

Reject disposable / throwaway email providers (mailinator, yopmail,
10minutemail, ...) across all signup paths: email/password, Google,
Microsoft, personal OIDC and organisation OIDC. Backed by the
mailchecker package (offline, ~55k domains, subdomain-aware).

Exposes a SIGNUP_DISPOSABLE_EMAIL error code so the signup form and
SSO redirect alert can show a dedicated message instead of the
generic 'signup disabled' one.
This commit is contained in:
Lucas Smith
2026-05-28 21:15:27 +09:00
committed by GitHub
parent d304d8720c
commit 7e8da85bd8
8 changed files with 91 additions and 3 deletions
+1
View File
@@ -51,6 +51,7 @@
"konva": "^10.0.9",
"kysely": "0.29.2",
"luxon": "^3.7.2",
"mailchecker": "^6.0.20",
"nanoid": "^5.1.6",
"oslo": "^0.17.0",
"p-map": "^7.0.4",