From 215b26acacf7274ec67083ca66a1c098fda5e49f Mon Sep 17 00:00:00 2001
From: Kalista Payne <kalista@habitica.com>
Date: Tue, 13 Jan 2026 17:01:09 -0600
Subject: [PATCH] fix(auth): run the actual verify check

---
 .../user/auth/POST-user_auth_social.test.js       | 15 +++++++++++++--
 website/server/libs/auth/social.js                |  4 +++-
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/test/api/v3/integration/user/auth/POST-user_auth_social.test.js b/test/api/v3/integration/user/auth/POST-user_auth_social.test.js
index f492d8e0a0..a447bf68d7 100644
--- a/test/api/v3/integration/user/auth/POST-user_auth_social.test.js
+++ b/test/api/v3/integration/user/auth/POST-user_auth_social.test.js
@@ -76,7 +76,7 @@ describe('POST /user/auth/social', () => {
       await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.eventually.equal('googleusername');
     });
 
-    it('generates a random username if provided username is entirely invalid', async () => {
+    it('generates a random username if provided username contains only disallowed characters', async () => {
       const response = await api.post(endpoint, {
         authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
         network,
@@ -87,8 +87,19 @@ describe('POST /user/auth/social', () => {
       await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.eventually.contain('hb-');
     });
 
+    it('generates a random username if provided username contains a disallowed word', async () => {
+      const response = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+        username: 'i am a TESTPLACEHOLDERSLURWORDHERE',
+      });
+
+      await expect(getProperty('users', response.id, 'auth.local.username')).to.eventually.contain('hb-');
+      await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.eventually.contain('hb-');
+    });
+
     it('generates a random username if sanitized username conflicts with an extant user', async () => {
-      user = generateUser({ 'auth.local.username': 'GoogleUserName' });
+      user = await generateUser({ 'auth.local.username': 'GoogleUserName' });
 
       const response = await api.post(endpoint, {
         authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
diff --git a/website/server/libs/auth/social.js b/website/server/libs/auth/social.js
index 6d3ac59d12..945d06f81a 100644
--- a/website/server/libs/auth/social.js
+++ b/website/server/libs/auth/social.js
@@ -1,6 +1,7 @@
 import pick from 'lodash/pick';
 import passport from 'passport';
 import common from '../../../common';
+import { verifyUsername } from '../user/validation';
 import { BadRequest, NotAuthorized, NotFound } from '../errors';
 import logger from '../logger';
 import {
@@ -100,7 +101,8 @@ export async function loginSocial (req, res) { // eslint-disable-line import/pre
   }
 
   let sanitizedUsername = username.replace(/[^a-zA-Z0-9_-]/g, '');
-  if (!sanitizedUsername) {
+  const issues = verifyUsername(sanitizedUsername, res, true);
+  if (issues.length > 0) {
     sanitizedUsername = generateUsername();
   } else {
     const conflictingUser = await User.findOne({