Show provisioning requesters and reserve Maxis for system actions

src/lib/server/auth/index.ts

@@ -2,7 +2,7 @@ import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypt
 import { db } from '../db/index.js';
 import { ensureAuthSchema } from './schema.js';
 import { hashPassword, verifyPassword } from './passwords.js';
-import type { AuthUser, UserRole } from '../../auth.js';
+import { systemUsername, type AuthUser, type UserRole } from '../../auth.js';
 
 export const SESSION_COOKIE = '__Host-ec_session';
 export const SESSION_LIFETIME_MS = 12 * 60 * 60_000;
@@ -25,7 +25,9 @@ export function listUsers(): AuthUser[] { return (database().prepare('SELECT * F
 export function setupRequired(): boolean { return !(database().prepare('SELECT 1 FROM auth_users LIMIT 1').get()); }
 function username(value: unknown): string {
     if (typeof value !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{2,63}$/.test(value)) throw new AuthError('Usernames need 3–64 letters, numbers, dots, underscores or hyphens.');
-    return value.toLowerCase();
+    const normalized = value.toLowerCase();
+    if (normalized === systemUsername.toLowerCase()) throw new AuthError(`${systemUsername} is reserved for system actions. Choose another username.`);
+    return normalized;
 }
 function displayName(value: unknown, fallback: string): string {
     const name = value === undefined ? fallback : value;