fix(user): Update reserved username and enforce check

- Add `String.isReversedUsername` helper function
- Bump version to 0.5.3

Author: gymynnym

build.gradle.kts

@@ -10,7 +10,7 @@ plugins {
 
 group = "me.loghub"
 
-version = "0.5.2-SNAPSHOT"
+version = "0.5.3-SNAPSHOT"
 
 java { toolchain { languageVersion = JavaLanguageVersion.of(21) } }
 

src/main/kotlin/me/loghub/api/constant/message/ResponseMessage.kt

@@ -56,6 +56,7 @@ object ResponseMessage {
         const val PRIVACY_UPDATE_SUCCESS = "정보 공개 설정이 성공적으로 업데이트되었습니다!"
         const val USERNAME_UPDATE_SUCCESS = "아이디가 성공적으로 변경되었습니다!"
         const val USERNAME_NOT_CHANGED = "유저네임이 변경되지 않았습니다."
+        const val USERNAME_NOT_ALLOWED = "유저네임에 허용되지 않는 단어가 포함되어 있습니다."
         const val INVALID_DATE_RANGE = "날짜 범위가 유효하지 않습니다."
 
         object GitHub {

src/main/kotlin/me/loghub/api/lib/validation/UsernameValidation.kt

@@ -9,15 +9,6 @@ import kotlin.reflect.KClass
 
 private const val USERNAME_REGEX = "[a-zA-Z0-9]+$"
 
-// root, admin,
-// search, post, edit,
-// join, login, logout,
-// setting, settings, support, notifications,
-// article, articles, series, question, questions, topic, topics
-private const val USERNAME_RESERVED =
-    "root|admin|search|post|edit|join|login|logout|setting|settings|support|notifications|article|articles|series|question|questions|topic|topics"
-private const val USERNAME_RESERVED_REGEX = "^(?!.*\\b($USERNAME_RESERVED)\\b).*$"
-
 @Constraint(validatedBy = [])
 @Target(
     AnnotationTarget.FIELD,
@@ -28,10 +19,101 @@ private const val USERNAME_RESERVED_REGEX = "^(?!.*\\b($USERNAME_RESERVED)\\b).*
 @NotBlank(message = "유저네임은 필수 입력 항목입니다.")
 @Size(min = 4, max = 12, message = "유저네임은 4자 이상 12자 이하이어야 합니다.")
 @Pattern(regexp = USERNAME_REGEX, message = "유저네임은 영문 소문자와 숫자로만 입력해주세요.")
-@Pattern(regexp = USERNAME_RESERVED_REGEX, message = "유저네임에 사용할 수 없는 단어가 포함되어 있습니다.")
 @Trimmed
 annotation class UsernameValidation(
     val message: String = "잘못된 유저네임입니다.",
     val groups: Array<KClass<*>> = [],
     val payload: Array<KClass<out Payload>> = []
-)
+)
+
+private val RESERVED_USERNAMES: Set<String> = setOf(
+    // System / Admin
+    "root", "admin", "administrator", "superadmin", "superuser", "owner", "master",
+    "moderator", "mod", "staff", "team", "developers", "devs",
+
+    // Dashboard / Access
+    "dashboard", "adminpanel", "system", "sys",
+    "config", "configs", "configuration",
+    "internal", "private", "public",
+
+    // API / Tech
+    "api", "apis", "api-doc", "api-docs",
+    "graphql", "rest", "soap", "rpc", "ws", "websocket",
+    "static", "assets", "fonts", "icons", "images", "media",
+    "file", "files", "upload", "uploads",
+    "download", "downloads",
+
+    // Environments
+    "dev", "prod", "test",
+
+    // Exec / Command injection
+    "sh", "shell", "cmd", "command", "commands",
+    "exec", "execute", "run", "eval",
+    "php", "bin",
+    "cdn", "cdn-cgi", "cgi",
+
+    // Security / Logs / Monitoring
+    "secure", "security", "audit",
+    "log", "logs", "error", "errors",
+    "status", "statuspage",
+    "health", "healthcheck",
+    "metrics",
+    "monitor", "monitoring",
+    "trace", "debug", "debugger",
+
+    // Billing / Payment
+    "billing", "payment", "payments",
+    "subscribe", "subscription",
+
+    // Common pages
+    "index", "home", "about", "contact", "help", "faq",
+    "docs", "manual", "documentation",
+    "terms", "privacy", "policy",
+    "feed", "rss", "sitemap", "robots", "license",
+
+    // Auth / Account
+    "auth", "authenticate", "authorize",
+    "account", "accounts",
+    "profile", "profiles",
+    "user", "users", "my", "me", "self",
+    "register", "signup", "signin",
+    "join", "login", "logout",
+    "password", "forgot", "reset",
+    "verify", "confirm",
+    "oauth", "oauth2", "callback",
+    "session", "sessions",
+    "token", "tokens",
+    "setting", "settings",
+    "legal", "support",
+
+    // Content routes
+    "article", "articles",
+    "series",
+    "question", "questions",
+    "topic", "topics",
+    "tag", "tags",
+    "comment", "comments",
+    "search", "post", "edit",
+
+    // Additional conflict-prone words
+    "new", "create", "update", "delete",
+    "remove", "add", "list",
+    "page", "pages",
+    "reply", "replies",
+    "inbox", "outbox",
+    "message", "messages",
+    "chat", "chats",
+    "notification", "notifications",
+
+    // Anti-phishing
+    "admin123", "support-team", "helpdesk",
+    "service", "services",
+    "official", "official-team",
+    "secure-login",
+
+    // Domain
+    "loghub",
+).map { it.lowercase() }.toSet()
+
+fun String.isReservedUsername(): Boolean =
+    this.lowercase() in RESERVED_USERNAMES

src/main/kotlin/me/loghub/api/service/auth/JoinService.kt

@@ -11,12 +11,14 @@ import me.loghub.api.dto.task.mail.JoinMailSendRequest
 import me.loghub.api.entity.user.User
 import me.loghub.api.exception.auth.BadOTPException
 import me.loghub.api.lib.redis.key.RedisKeys
+import me.loghub.api.lib.validation.isReservedUsername
 import me.loghub.api.proxy.TaskAPIProxy
 import me.loghub.api.repository.user.UserRepository
 import me.loghub.api.service.auth.token.TokenService
 import me.loghub.api.service.common.MailService
 import me.loghub.api.util.OTPBuilder
 import me.loghub.api.util.checkConflict
+import me.loghub.api.util.checkField
 import org.springframework.data.redis.core.RedisTemplate
 import org.springframework.stereotype.Service
 
@@ -54,6 +56,10 @@ class JoinService(
     }
 
     private fun checkJoinable(email: String, username: String) {
+        checkField(
+            User::username.name,
+            !username.isReservedUsername(),
+        ) { ResponseMessage.User.USERNAME_NOT_ALLOWED }
         checkConflict(
             User::email.name,
             userRepository.existsByEmail(email),

src/main/kotlin/me/loghub/api/service/user/UserService.kt

@@ -4,13 +4,15 @@ import me.loghub.api.constant.message.ResponseMessage
 import me.loghub.api.dto.user.UpdateUsernameDTO
 import me.loghub.api.entity.user.User
 import me.loghub.api.exception.entity.EntityNotFoundException
+import me.loghub.api.lib.validation.isReservedUsername
 import me.loghub.api.mapper.user.UserMapper
 import me.loghub.api.proxy.TaskAPIProxy
 import me.loghub.api.repository.article.ArticleRepository
 import me.loghub.api.repository.question.QuestionRepository
 import me.loghub.api.repository.series.SeriesRepository
 import me.loghub.api.repository.user.UserRepository
 import me.loghub.api.util.checkConflict
+import me.loghub.api.util.checkField
 import me.loghub.api.util.requireNotEquals
 import org.springframework.security.core.userdetails.UsernameNotFoundException
 import org.springframework.stereotype.Service
@@ -32,18 +34,23 @@ class UserService(
 
     @Transactional
     fun updateUsername(requestBody: UpdateUsernameDTO, user: User) {
+        val (oldUsername, newUsername) = Pair(user.username, requestBody.newUsername)
+
         requireNotEquals(
             UpdateUsernameDTO::newUsername.name,
-            user.username, requestBody.newUsername,
+            user.username, newUsername,
         ) { ResponseMessage.User.USERNAME_NOT_CHANGED }
+        checkField(
+            UpdateUsernameDTO::newUsername.name,
+            !newUsername.isReservedUsername(),
+        ) { ResponseMessage.User.USERNAME_NOT_ALLOWED }
         checkConflict(
             UpdateUsernameDTO::newUsername.name,
-            userRepository.existsByUsernameIgnoreCase(requestBody.newUsername)
+            userRepository.existsByUsernameIgnoreCase(newUsername)
         ) { ResponseMessage.User.USERNAME_ALREADY_EXISTS }
 
         val foundUser = userRepository.findByUsername(user.username)
             ?: throw UsernameNotFoundException(ResponseMessage.User.NOT_FOUND)
-        val (oldUsername, newUsername) = Pair(foundUser.username, requestBody.newUsername)
 
         foundUser.updateUsername(newUsername)
         articleRepository.updateWriterUsernameByWriterUsername(oldUsername, newUsername)