feat: add email normalization and disposable domain blocking via better-auth-harmony

Author: Medformatik

apps/api/package.json

@@ -29,6 +29,7 @@
     "@motis-project/motis-client": "^2.9.1",
     "@openstreetmap/id-tagging-schema": "^6.15.0",
     "better-auth": "^1.5.5",
+    "better-auth-harmony": "^1.3.1",
     "cached-hafas-client": "^5.1.9",
     "db-vendo-client": "^6.10.8",
     "drizzle-orm": "^0.45.1",

apps/api/src/auth.ts

@@ -3,6 +3,7 @@ import { passkey } from "@better-auth/passkey";
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { admin, emailOTP, genericOAuth, twoFactor } from "better-auth/plugins";
+import { emailHarmony } from "better-auth-harmony";
 import { eq } from "drizzle-orm";
 import { db } from "./db";
 import { user as userTable } from "./db/schema";
@@ -135,6 +136,7 @@ export const auth = betterAuth({
   plugins: [
     admin(),
     expo(),
+    emailHarmony({ allowNormalizedSignin: true }),
     passkey({
       rpID: process.env.PASSKEY_RP_ID ?? "localhost",
       rpName: "OpenMapX",

apps/api/src/db/auth-schema.ts

@@ -16,6 +16,7 @@ export const user = pgTable("user", {
   banned: boolean("banned").default(false),
   banReason: text("ban_reason"),
   banExpires: timestamp("ban_expires"),
+  normalizedEmail: text("normalized_email").unique(),
   twoFactorEnabled: boolean("two_factor_enabled").default(false),
 });
 

apps/api/src/db/migrations/0001_add-normalized-email.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "user" ADD COLUMN "normalized_email" text;--> statement-breakpoint
+ALTER TABLE "user" ADD CONSTRAINT "user_normalized_email_unique" UNIQUE("normalized_email");