Update email validation logic (bluesky-social#3092)

.changeset/happy-beers-notice.md

@@ -0,0 +1,5 @@
+---
+"@atproto/pds": patch
+---
+
+Improve email validation logic

.changeset/soft-tigers-taste.md

@@ -0,0 +1,5 @@
+---
+"@atproto/pds": patch
+---
+
+Update list of forbidden domain names in email addresses

packages/pds/package.json

@@ -43,11 +43,12 @@
     "@atproto/xrpc": "workspace:^",
     "@atproto/xrpc-server": "workspace:^",
     "@did-plc/lib": "^0.0.4",
+    "@hapi/address": "^5.1.1",
     "better-sqlite3": "^10.0.0",
     "bytes": "^3.1.2",
     "compression": "^1.7.4",
     "cors": "^2.8.5",
-    "disposable-email": "^0.2.3",
+    "disposable-email-domains-js": "^1.5.0",
     "express": "^4.17.2",
     "express-async-errors": "^3.1.1",
     "file-type": "^16.5.4",
@@ -78,7 +79,6 @@
     "@atproto/pds-entryway": "npm:@atproto/[email protected]",
     "@did-plc/server": "^0.0.1",
     "@types/cors": "^2.8.12",
-    "@types/disposable-email": "^0.2.0",
     "@types/express": "^4.17.13",
     "@types/express-serve-static-core": "^4.17.36",
     "@types/nodemailer": "^6.4.6",

packages/pds/src/api/com/atproto/server/createAccount.ts

@@ -3,7 +3,9 @@ import { AtprotoData, ensureAtpDocument } from '@atproto/identity'
 import { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'
 import { ExportableKeypair, Keypair, Secp256k1Keypair } from '@atproto/crypto'
 import * as plc from '@did-plc/lib'
-import disposable from 'disposable-email'
+import { isEmailValid } from '@hapi/address'
+import { isDisposableEmail } from 'disposable-email-domains-js'
+
 import {
   baseNormalizeAndValidate,
   normalizeAndValidateHandle,
@@ -175,7 +177,7 @@ const validateInputsForLocalPds = async (
 
   if (!email) {
     throw new InvalidRequestError('Email is required')
-  } else if (!disposable.validate(email)) {
+  } else if (!isEmailValid(email) || isDisposableEmail(email)) {
     throw new InvalidRequestError(
       'This email address is not supported, please use a different email.',
     )

packages/pds/src/api/com/atproto/server/updateEmail.ts

@@ -1,7 +1,8 @@
 import assert from 'node:assert'
 
 import { InvalidRequestError } from '@atproto/xrpc-server'
-import disposable from 'disposable-email'
+import { isEmailValid } from '@hapi/address'
+import { isDisposableEmail } from 'disposable-email-domains-js'
 
 import { UserAlreadyExistsError } from '../../../../account-manager/helpers/account'
 import AppContext from '../../../../context'
@@ -14,7 +15,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async ({ auth, input }) => {
       const did = auth.credentials.did
       const { token, email } = input.body
-      if (!disposable.validate(email)) {
+      if (!isEmailValid(email) || isDisposableEmail(email)) {
         throw new InvalidRequestError(
           'This email address is not supported, please use a different email.',
         )