feat: block registration/sign-in from .shop/.top TLDs

[jrf0110]

Summary

• Adds TLD-based email blocking via a new BLACKLIST_TLDS env var (pipe-delimited, e.g. shop|top), matching the existing BLACKLIST_DOMAINS pattern
• Enforced at the NextAuth signIn callback, magic-link API route, and validateUserAuthorization for existing sessions
• Includes 8 unit tests covering blocked/allowed TLDs, subdomains, case insensitivity, and edge cases

Deployment

Set the BLACKLIST_TLDS environment variable in production:

BLACKLIST_TLDS="foo|bar"

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

This PR adds TLD-based blocking for new user signups across both the magic-link and OAuth (Google) authentication flows. The implementation is clean and consistent:

• isBlockedTLD uses String.endsWith() with dot-prefixed TLDs (e.g. .shop), which correctly matches only the TLD portion of email addresses without false positives on subdomains or local parts.
• Config parsing in config.server.ts properly handles edge cases: empty env var → empty array, with trim(), toLowerCase(), and filter(Boolean) applied.
• Blocking is consistently applied in both magic-link (route.ts) and OAuth (user.server.ts) flows, only for new users (existing users can still sign in).
• Test coverage is thorough — covers case insensitivity, subdomains, non-TLD occurrences of blocked strings, empty blocklist, and multi-part TLDs like .co.uk.

Previous review comments have been addressed or dismissed by the repo owner.

Files Reviewed (4 files)

• src/app/api/auth/magic-link/route.ts - TLD blocking for magic-link signups
• src/lib/config.server.ts - BLACKLIST_TLDS env var parsing
• src/lib/user.server.ts - isBlockedTLD function + OAuth flow integration
• src/lib/user.server.test.ts - Comprehensive tests for isBlockedTLD

[markijbema]

we're banning the UK?

[jrf0110]

Yeah, someone needs to put a stop to their questionable cuisine

[jrf0110]

In all seriousness, we are not blocking .co.uk but it was just an example the agent put in there