Prevent email autofill as display name and autosave profile media

Hop-State: A_06FP8EYP9H40CXQH16XPSN8
Hop-Proposal: R_06FP8EY0KW03D22K71DN4KG
Hop-Task: T_06FP8DNXSH7CAHXCHDZ2Z1R
Hop-Attempt: AT_06FP8DNXSKPDEVNXEZRQ5W8

src/lib/auth/display-name.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest';
+import { registrationDisplayName } from './display-name';
+
+describe('registrationDisplayName', () => {
+    it('uses the handle when no display name was provided', () => {
+        expect(registrationDisplayName('alice', 'alice@example.com')).toBe('alice');
+    });
+
+    it('does not expose an autofilled email as the public display name', () => {
+        expect(registrationDisplayName('alice', 'alice@example.com', ' Alice@Example.com ')).toBe('alice');
+    });
+
+    it('trims and preserves an intentional display name', () => {
+        expect(registrationDisplayName('alice', 'alice@example.com', ' Alice Example ')).toBe('Alice Example');
+    });
+});

src/lib/auth/display-name.ts

@@ -0,0 +1,7 @@
+export function registrationDisplayName(handle: string, email: string, displayName?: string): string {
+    const trimmedDisplayName = displayName?.trim();
+    if (!trimmedDisplayName || trimmedDisplayName.toLowerCase() === email.trim().toLowerCase()) {
+        return handle;
+    }
+    return trimmedDisplayName;
+}

src/lib/auth/index.ts

@@ -11,6 +11,7 @@ import { encryptPrivateKey, serializeEncryptedKey } from '@/lib/crypto/private-k
 import { base58btc } from 'multiformats/bases/base58';
 import { cookies } from 'next/headers';
 import { upsertHandleEntries } from '@/lib/federation/handles';
+import { registrationDisplayName } from '@/lib/auth/display-name';
 
 const ACTIVE_SESSION_COOKIE_NAME = 'synapsis_session';
 const SESSION_COOKIE_NAME = 'synapsis_sessions';
@@ -321,7 +322,7 @@ export async function registerUser(
         handle: handle.toLowerCase(),
         email: email.toLowerCase(),
         passwordHash,
-        displayName: displayName || handle,
+        displayName: registrationDisplayName(handle, email, displayName),
         publicKey,
         privateKeyEncrypted: serializeEncryptedKey(encryptedPrivateKey),
     }).returning();