mirror of
https://github.com/yusufipk/OpenFrame.git
synced 2026-09-11 09:36:08 +00:00
yusufipk
39e81042bb
The trial now starts inside the product, at email verification, and Stripe grants none at all: checkout creates a subscription that bills immediately. Verifying an address is what buys the seven days, which is also the cheapest abuse control there is. An unexpired trial is treated as an entitlement the account already holds, so a Stripe sync can add access but never retracts a trial that has not run out. That matters most for the abandoned checkout: the resulting incomplete subscription carries no trial_end, and writing it through would have erased the days the account still had and locked it out. Unpaid accounts are bounded by what they can cost us rather than by what they can do: one workspace, one project, 3 GiB of direct uploads. YouTube imports, share links, guests, comments and approvals stay unlimited, because those are the parts worth trying and they cost nothing. isPaidTier() is the new seam; hasBillingAccess() answers a different question now that access no longer implies a card. Signup CTAs, the pricing card, the comparison pages, the terms and the refund policy all said the trial converts to a paid plan by itself. It no longer does, so they say what happens instead. Settings and a banner name both dates that matter: when the trial ends, and the fifteen days after that during which nothing is deleted. /admin/growth compares the two funnels on signup to paid within a fixed 30 day window, not trial to paid. Dropping the card requirement multiplies trials, so the old ratio can fall while more people actually pay, and reading it that way would retire the change for the wrong reason.
99 lines
2.8 KiB
TypeScript
99 lines
2.8 KiB
TypeScript
const MAX_EMAIL_LENGTH = 254;
|
|
const MAX_EMAIL_LOCAL_LENGTH = 64;
|
|
const MAX_EMAIL_DOMAIN_LABEL_LENGTH = 63;
|
|
|
|
export function normalizeEmail(email: string): string {
|
|
return email.trim().toLowerCase();
|
|
}
|
|
|
|
export function isValidEmailAddress(email: string): boolean {
|
|
if (email.length < 3 || email.length > MAX_EMAIL_LENGTH) return false;
|
|
|
|
const atIndex = email.indexOf('@');
|
|
if (atIndex <= 0 || atIndex !== email.lastIndexOf('@')) return false;
|
|
|
|
const local = email.slice(0, atIndex);
|
|
const domain = email.slice(atIndex + 1);
|
|
if (local.length > MAX_EMAIL_LOCAL_LENGTH || !domain.includes('.')) return false;
|
|
|
|
for (const char of email) {
|
|
const code = char.charCodeAt(0);
|
|
if (code <= 32 || code === 127) return false;
|
|
}
|
|
|
|
const labels = domain.split('.');
|
|
if (labels.length < 2) return false;
|
|
|
|
return labels.every((label) => label.length > 0 && label.length <= MAX_EMAIL_DOMAIN_LABEL_LENGTH);
|
|
}
|
|
|
|
/**
|
|
* Throwaway mailbox providers, refused at signup.
|
|
*
|
|
* The free trial is granted to any address somebody can read a link at, so a
|
|
* mailbox that costs nothing and expires in ten minutes is the cheapest way to
|
|
* take the trial repeatedly. This list is deliberately short and specific: it
|
|
* holds services whose entire purpose is a disposable inbox, and none of the
|
|
* forwarding or aliasing services (SimpleLogin, AnonAddy, Apple's Hide My Email,
|
|
* Fastmail masked addresses) that real paying customers use every day. A list
|
|
* that catches a genuine buyer costs far more than one that misses a scraper.
|
|
*/
|
|
const DISPOSABLE_EMAIL_DOMAINS = new Set([
|
|
'10minutemail.com',
|
|
'discard.email',
|
|
'dispostable.com',
|
|
'emailondeck.com',
|
|
'fakeinbox.com',
|
|
'getnada.com',
|
|
'grr.la',
|
|
'guerrillamail.com',
|
|
'guerrillamail.net',
|
|
'guerrillamail.org',
|
|
'harakirimail.com',
|
|
'inboxkitten.com',
|
|
'mailcatch.com',
|
|
'maildrop.cc',
|
|
'mailinator.com',
|
|
'mailnesia.com',
|
|
'mintemail.com',
|
|
'moakt.com',
|
|
'mohmal.com',
|
|
'nada.email',
|
|
'sharklasers.com',
|
|
'spam4.me',
|
|
'spamgourmet.com',
|
|
'temp-mail.org',
|
|
'tempinbox.com',
|
|
'tempmail.com',
|
|
'tempr.email',
|
|
'throwawaymail.com',
|
|
'tmpmail.org',
|
|
'trashmail.com',
|
|
'yopmail.com',
|
|
'yopmail.fr',
|
|
'yopmail.net',
|
|
]);
|
|
|
|
/**
|
|
* True when the address belongs to a known disposable mailbox provider.
|
|
*
|
|
* Parent domains are checked too, because several of these hand out per-visit
|
|
* subdomains (`anything.mailinator.com`) that would otherwise walk straight past
|
|
* an exact-match lookup.
|
|
*/
|
|
export function isDisposableEmailDomain(email: string): boolean {
|
|
const atIndex = email.lastIndexOf('@');
|
|
if (atIndex < 0) return false;
|
|
|
|
const domain = normalizeEmail(email.slice(atIndex + 1));
|
|
const labels = domain.split('.');
|
|
|
|
for (let index = 0; index < labels.length - 1; index += 1) {
|
|
if (DISPOSABLE_EMAIL_DOMAINS.has(labels.slice(index).join('.'))) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|