Add UsernameBlockListEntry and tie it to is_reserved, and the admin panel. (Fixes #831)

Author: MelissaAutumn

src/thunderbird_accounts/authentication/admin/__init__.py

@@ -3,10 +3,16 @@
 from django.contrib import admin
 from django.contrib.admin.models import LogEntry
 
-from thunderbird_accounts.authentication.admin.models import CustomUserAdmin, AllowListEntryAdmin, LogEntryAdmin
-from thunderbird_accounts.authentication.models import User, AllowListEntry
+from thunderbird_accounts.authentication.admin.models import (
+    CustomUserAdmin,
+    AllowListEntryAdmin,
+    LogEntryAdmin,
+    UsernameBlockListEntryAdmin,
+)
+from thunderbird_accounts.authentication.models import User, AllowListEntry, UsernameBlockListEntry
 
 # Register the User admin here
 admin.site.register(User, CustomUserAdmin)
 admin.site.register(AllowListEntry, AllowListEntryAdmin)
 admin.site.register(LogEntry, LogEntryAdmin)
+admin.site.register(UsernameBlockListEntry, UsernameBlockListEntryAdmin)

src/thunderbird_accounts/authentication/admin/models.py

@@ -163,3 +163,12 @@ def has_view_permission(self, request, obj=None):
 
     def get_queryset(self, request):
         return super().get_queryset(request).prefetch_related('content_type')
+
+class UsernameBlockListEntryAdmin(admin.ModelAdmin):
+    search_fields = ('pattern',)
+    list_filter = ['created_at', 'updated_at']
+    list_display = (
+        'pattern',
+        'created_at',
+        'updated_at',
+    )

src/thunderbird_accounts/authentication/migrations/0016_alter_user_username_usernameblocklistentry.py

@@ -0,0 +1,34 @@
+# Generated by Django 6.0.5 on 2026-05-12 18:35
+
+import django.core.validators
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('authentication', '0015_add_allowlist_discount'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='user',
+            name='username',
+            field=models.CharField(error_messages={'unique': 'A user with that username already exists.'}, help_text='Required. 3–150 characters.', max_length=150, unique=True, validators=[django.core.validators.MinLengthValidator(3)], verbose_name='username'),
+        ),
+        migrations.CreateModel(
+            name='UsernameBlockListEntry',
+            fields=[
+                ('uuid', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('pattern', models.CharField(help_text='A full or partial string using wildcard `*`.<br><b>Example:</b> <code>thunderbird</code> to block <code>thunderbird@example.com</code>, or <code>thunderbird*</code> to block usernames like <code>thunderbird-admin@example.com</code>', unique=True, verbose_name='pattern')),
+            ],
+            options={
+                'verbose_name_plural': 'Username block list entries',
+                'abstract': False,
+                'indexes': [models.Index(fields=['uuid'], name='authenticat_uuid_11f328_idx'), models.Index(fields=['created_at'], name='authenticat_created_81fb2a_idx'), models.Index(fields=['updated_at'], name='authenticat_updated_6ecea2_idx'), models.Index(fields=['pattern'], name='authenticat_pattern_e6bc1f_idx')],
+            },
+        ),
+    ]

src/thunderbird_accounts/authentication/models.py

@@ -137,3 +137,33 @@ def __str__(self):
         if self.user:
             return f'Allow List Entry [{self.uuid}] {self.email} - {self.user.username}'
         return f'Allow List Entry [{self.uuid}] {self.email} - <Unassociated>'
+
+class UsernameBlockListEntry(BaseModel):
+    """Username Block List Entry
+
+    This is a small model that holds full strings or partial string that
+    will be checked against the username along-side the full reversed list.
+
+    These are unique to cut down on entries to check.
+    """
+
+    pattern = models.CharField(
+        _('pattern'),
+        unique=True,
+        help_text=_(
+            "A full or partial string using wildcard `*`."
+            '<br>'
+            '<b>Example:</b> <code>thunderbird</code> to block <code>thunderbird@example.com</code>,'
+            ' or <code>thunderbird*</code> to block usernames like <code>thunderbird-admin@example.com</code>'
+        ),
+    )
+
+    class Meta(BaseModel.Meta):
+        verbose_name_plural = 'Username block list entries'
+        indexes = [
+            *BaseModel.Meta.indexes,
+            models.Index(fields=['pattern']),
+        ]
+
+    def __str__(self):
+        return f'Blocked Username Entry [{self.uuid}] {self.pattern}'

src/thunderbird_accounts/authentication/reserved.py

@@ -1,3 +1,4 @@
+from fnmatch import fnmatch
 import re
 
 # brand related names, and also help/support
@@ -102,4 +103,15 @@
 
 def is_reserved(test_string: str) -> bool:
     """Checks the address or random string is a reserved name which should fail user or alias creation if so."""
-    return any(r.match(test_string) for r in regexes)
+    from thunderbird_accounts.authentication.models import UsernameBlockListEntry
+
+    matches = any(r.match(test_string) for r in regexes)
+    if matches:
+        return True
+
+    # This most likely won't scale well in the future...
+    entries = UsernameBlockListEntry.objects.all()
+
+    # This is a filename search, but it's simpler than regex so hopefully it won't be a footgun. :)
+    # https://docs.python.org/3/library/fnmatch.html#fnmatch.fnmatch
+    return any(fnmatch(test_string, entry.pattern) for entry in entries)

src/thunderbird_accounts/authentication/tests/test_utils.py

@@ -1,10 +1,10 @@
-
 from django.test import TestCase, override_settings
 
-from thunderbird_accounts.authentication.models import AllowListEntry, User
+from thunderbird_accounts.authentication.models import AllowListEntry, User, UsernameBlockListEntry
 from thunderbird_accounts.authentication.reserved import is_reserved, servers, support
 from thunderbird_accounts.authentication.utils import is_email_in_allow_list
 
+
 class IsReservedUnitTests(TestCase):
     def test_brand_names(self):
         for brand in ['thunderbird', 'thundermail', 'tbpro', 'mozilla', 'firefox', 'help', 'support', 'mzla']:
@@ -95,6 +95,25 @@ def test_partial_matches_should_pass(self):
         for name in ['user123', 'myusernamex', 'rooted', 'teamwork', 'contacting']:
             self.assertFalse(is_reserved(name))
 
+    def test_username_block_list_entries(self):
+        block_list_entries = ['skeletons', 'dog*', 'pizza']
+        for name in block_list_entries:
+            name = name.replace('*', '')
+            self.assertFalse(is_reserved(name))
+
+        for name in block_list_entries:
+            UsernameBlockListEntry.objects.create(pattern=name)
+
+        # Add some entries that will pass with the wildcard entry (dog)
+        block_list_entries += ['dog-dog', 'dog-skeleton']
+        # Add some entries that will fail the wildcard entry (dog)
+        not_reserved_entries = ['skeleton-dog', 'skeletons2']
+
+        for name in block_list_entries:
+            self.assertTrue(is_reserved(name))
+        for name in not_reserved_entries:
+            self.assertFalse(is_reserved(name))
+
 
 @override_settings(USE_ALLOW_LIST=True)
 class IsEmailInAllowListUnitTests(TestCase):