feat: add reserved username blocklist to block system routes and brand conflicts

app/api/username/check/route.ts

@@ -1,6 +1,7 @@
 import prisma from "@/lib/prisma";
 import { NextResponse } from "next/server";
 import { validateUsername } from "@/lib/validations/username";
+import { isReservedUsername } from '@/lib/reservedUsernames';
 
 async function isAvailable(username: string): Promise<boolean> {
     const [user, alias] = await Promise.all([
@@ -11,6 +12,13 @@ async function isAvailable(username: string): Promise<boolean> {
     return !user && !alias;
 }
 
+if (isReservedUsername(username)) {
+  return NextResponse.json(
+    { available: false, reason: 'This username is reserved and cannot be claimed.' },
+    { status: 200 } // return 200 so the UI can show the message without erroring
+  );
+}
+
 export async function GET(req: Request) {
     const { searchParams } = new URL(req.url);
     const username = searchParams.get("username")?.toLowerCase();

lib/reservedUsernames.ts

@@ -0,0 +1,21 @@
+// lib/reservedUsernames.ts
+export const RESERVED_USERNAMES = new Set([
+  // App Router path conflicts
+  'api', 'app', 'auth', '_next',
+  // Admin paths
+  'admin', 'administrator', 'root', 'superuser', 'moderator',
+  // Auth routes
+  'login', 'logout', 'register', 'signup', 'signin', 'signout',
+  'callback', 'verify', 'reset', 'forgot', 'onboarding',
+  // Dashboard routes
+  'dashboard', 'settings', 'profile', 'account',
+  // Brand reserved
+  'linkid', 'support', 'help', 'docs', 'blog', 'about',
+  'contact', 'terms', 'privacy', 'security', 'status',
+  // Generic abuse targets
+  'null', 'undefined', 'anonymous', 'test', 'demo', 'example',
+]);
+
+export function isReservedUsername(username: string): boolean {
+  return RESERVED_USERNAMES.has(username.toLowerCase().trim());
+}