feat: add deckyvault.xyz domain block to signupSchema (Task 2)

lib/auth/__tests__/validation.test.ts

@@ -180,3 +180,57 @@ describe("resetPasswordSchema", () => {
     expect(result.success).toBe(false)
   })
 })
+
+describe("signupSchema — domain block", () => {
+  it("rejects @deckyvault.xyz email when NODE_ENV is not development", () => {
+    const result = signupSchema.safeParse({
+      name: "Test User",
+      email: "user@deckyvault.xyz",
+      password: "abcdefghij",
+    })
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      const emailIssues = result.error.issues.filter(
+        (i) => i.path[0] === "email"
+      )
+      expect(emailIssues.length).toBeGreaterThan(0)
+      expect(emailIssues[0].message).toContain("deckyvault.xyz")
+    }
+  })
+
+  it("rejects @DECKYVAULT.XYZ email (uppercase) when not in dev", () => {
+    const result = signupSchema.safeParse({
+      name: "Test User",
+      email: "admin@DECKYVAULT.XYZ",
+      password: "abcdefghij",
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it("rejects @deckyvault.xyz with plus addressing when not in dev", () => {
+    const result = signupSchema.safeParse({
+      name: "Test User",
+      email: "user+spam@deckyvault.xyz",
+      password: "abcdefghij",
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it("accepts @gmail.com email (non-deckyvault domain)", () => {
+    const result = signupSchema.safeParse({
+      name: "Test User",
+      email: "user@gmail.com",
+      password: "abcdefghij",
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it("accepts valid email from any non-deckyvault domain", () => {
+    const result = signupSchema.safeParse({
+      name: "Test User",
+      email: "hello@outlook.com",
+      password: "abcdefghij",
+    })
+    expect(result.success).toBe(true)
+  })
+})

lib/auth/validation.ts

@@ -1,4 +1,5 @@
 import { z } from "zod"
+import { isDeckyVaultEmail, DOMAIN_BLOCK_ERROR } from "./domain-block"
 
 export const loginEmailSchema = z.object({
     email: z.string().email("Please enter a valid email address"),
@@ -9,7 +10,8 @@ export const loginSchema = z.object({
     password: z.string().min(1, "Password is required"),
 })
 
-export const signupSchema = z.object({
+export const signupSchema = z
+    .object({
         name: z
             .string()
             .min(1, "Name is required")
@@ -18,7 +20,16 @@ export const signupSchema = z.object({
         password: z
             .string()
             .min(10, "Password must be at least 10 characters"),
-})
+    })
+    .refine(
+        (data) =>
+            process.env.NODE_ENV === "development" ||
+            !isDeckyVaultEmail(data.email),
+        {
+            message: DOMAIN_BLOCK_ERROR,
+            path: ["email"],
+        },
+    )
 
 export const otpSchema = z.object({
     otp: z.string().length(6, "OTP must be exactly 6 digits"),