fix

internal/app/users/service.go

@@ -31,6 +31,9 @@ type Service struct {
 	// while true, ResolveUsername never resolves @marksbot
 	// (domain.VerifierBotUserID), so a client cannot discover it by username.
 	hideThirdPartyVerification bool
+	// reserved blocks UpdateUsername (self-service only) from claiming a
+	// config.ReservedUsernames entry -- see domain.ReservedUsernameSet.
+	reserved domain.ReservedUsernameSet
 }
 
 type usernameAvailabilityStore interface {
@@ -74,6 +77,12 @@ func WithHideThirdPartyVerification(hidden bool) Option {
 	return func(s *Service) { s.hideThirdPartyVerification = hidden }
 }
 
+// WithReservedUsernames mirrors config.ReservedUsernames: UpdateUsername
+// (self-service only) refuses to set any of these.
+func WithReservedUsernames(names []string) Option {
+	return func(s *Service) { s.reserved = domain.NewReservedUsernameSet(names) }
+}
+
 const (
 	minUsernameLen      = 5
 	maxUsernameLen      = 32
@@ -240,8 +249,16 @@ func (s *Service) UpdateUsername(ctx context.Context, userID int64, username str
 		return domain.User{}, err
 	}
 	username = normalizeUsername(username)
+	// Re-submitting the username the account already has is a no-op, not a
+	// claim -- checked before any validation (including the reserved-word
+	// list) so a name that was fine to keep before this feature existed
+	// (or before it was added to config.ReservedUsernames) never gets
+	// rejected just because the client re-sent an unchanged value.
+	if self.Username == username {
+		return s.projectOne(ctx, self.ID, self)
+	}
 	if username != "" {
-		if !validUsername(username) {
+		if !validUsername(username) || s.reserved.Contains(username) {
 			return domain.User{}, domain.ErrUsernameInvalid
 		}
 		ok, err := s.checkUsernameAvailable(ctx, self.ID, username)
@@ -252,9 +269,6 @@ func (s *Service) UpdateUsername(ctx context.Context, userID int64, username str
 			return domain.User{}, domain.ErrUsernameOccupied
 		}
 	}
-	if self.Username == username {
-		return s.projectOne(ctx, self.ID, self)
-	}
 	u, err := s.users.UpdateUsername(ctx, self.ID, username)
 	if err != nil {
 		return domain.User{}, err

internal/app/users/service_test.go

@@ -89,6 +89,43 @@ func TestServiceUsernameLifecycle(t *testing.T) {
 	}
 }
 
+// TestServiceUsernameReservedBlocksNewClaimsButKeepsExisting locks in the
+// grandfather behavior config.ReservedUsernames needs: adding a word to the
+// list (or turning the feature on after channels/accounts already own a
+// matching username) must never break an account that already has it --
+// only a genuinely new claim of a reserved word is refused.
+func TestServiceUsernameReservedBlocksNewClaimsButKeepsExisting(t *testing.T) {
+	ctx := context.Background()
+	store := memory.NewUserStore()
+	grandfathered, err := store.Create(ctx, domain.User{AccessHash: 1, Phone: "15550000003", FirstName: "Old", Username: "admin"})
+	if err != nil {
+		t.Fatalf("create grandfathered: %v", err)
+	}
+	newcomer, err := store.Create(ctx, domain.User{AccessHash: 2, Phone: "15550000004", FirstName: "New"})
+	if err != nil {
+		t.Fatalf("create newcomer: %v", err)
+	}
+	svc := NewService(store, WithReservedUsernames([]string{"admin"}))
+
+	// Re-submitting the exact same (grandfathered) reserved username -- the
+	// shape a client resubmitting an unmodified field sends, "@" prefix and
+	// all -- must be a no-op, not a rejection.
+	if u, err := svc.UpdateUsername(ctx, grandfathered.ID, "@admin"); err != nil || u.Username != "admin" {
+		t.Fatalf("re-submit grandfathered username = user %+v err %v, want no-op keeping %q", u, err, "admin")
+	}
+	// A different account claiming the same reserved word for the first time
+	// must still be refused.
+	if _, err := svc.UpdateUsername(ctx, newcomer.ID, "admin"); !errors.Is(err, domain.ErrUsernameInvalid) {
+		t.Fatalf("new claim of reserved username err = %v, want username invalid", err)
+	}
+	// The grandfathered account moving to a *different* reserved word is a
+	// genuine new claim too, and must be refused the same way.
+	svc2 := NewService(store, WithReservedUsernames([]string{"admin", "support"}))
+	if _, err := svc2.UpdateUsername(ctx, grandfathered.ID, "support"); !errors.Is(err, domain.ErrUsernameInvalid) {
+		t.Fatalf("grandfathered account claiming a different reserved word err = %v, want username invalid", err)
+	}
+}
+
 // marksbotOverrideStore wraps memory.UserStore to serve domain.VerifierBotUser()
 // for a fixed username lookup, since memory.UserStore.Create always assigns an
 // id from its own auto-increment sequence and can never produce the fixed