fix(auth): run the actual verify check

test/api/v3/integration/user/auth/POST-user_auth_social.test.js

@@ -76,7 +76,7 @@ describe('POST /user/auth/social', () => {
       await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.eventually.equal('googleusername');
     });
 
-    it('generates a random username if provided username is entirely invalid', async () => {
+    it('generates a random username if provided username contains only disallowed characters', async () => {
       const response = await api.post(endpoint, {
         authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
         network,
@@ -87,8 +87,19 @@ describe('POST /user/auth/social', () => {
       await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.eventually.contain('hb-');
     });
 
+    it('generates a random username if provided username contains a disallowed word', async () => {
+      const response = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+        username: 'i am a TESTPLACEHOLDERSLURWORDHERE',
+      });
+
+      await expect(getProperty('users', response.id, 'auth.local.username')).to.eventually.contain('hb-');
+      await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.eventually.contain('hb-');
+    });
+
     it('generates a random username if sanitized username conflicts with an extant user', async () => {
-      user = generateUser({ 'auth.local.username': 'GoogleUserName' });
+      user = await generateUser({ 'auth.local.username': 'GoogleUserName' });
 
       const response = await api.post(endpoint, {
         authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase

website/server/libs/auth/social.js

@@ -1,6 +1,7 @@
 import pick from 'lodash/pick';
 import passport from 'passport';
 import common from '../../../common';
+import { verifyUsername } from '../user/validation';
 import { BadRequest, NotAuthorized, NotFound } from '../errors';
 import logger from '../logger';
 import {
@@ -100,7 +101,8 @@ export async function loginSocial (req, res) { // eslint-disable-line import/pre
   }
 
   let sanitizedUsername = username.replace(/[^a-zA-Z0-9_-]/g, '');
-  if (!sanitizedUsername) {
+  const issues = verifyUsername(sanitizedUsername, res, true);
+  if (issues.length > 0) {
     sanitizedUsername = generateUsername();
   } else {
     const conflictingUser = await User.findOne({