Stop Fake & Disposable Emails at Game Account Signup

const MAILBEAM_KEY = process.env.MAILBEAM_KEY!;

interface VerifyResult {
  valid: boolean;
  disposable: boolean;
  score: number;
  suggestion: string | null;
}

async function verifyEmail(email: string): Promise<VerifyResult> {
  const res = await fetch("https://api.mailbeam.dev/v1/verify", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${MAILBEAM_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ email }),
  });
  return res.json();
}

// Runs in the account service, before any player record is written
export async function createAccount(email: string, password: string) {
  const check = await verifyEmail(email);

  if (!check.valid) {
    throw new SignupError("INVALID_EMAIL", {
      message: "Please enter a valid email so we can send your verification link.",
      suggestion: check.suggestion,
    });
  }

  // Throwaway inbox = ban evasion / bonus farming on-ramp -> block outright
  if (check.disposable) {
    throw new SignupError("DISPOSABLE_EMAIL", {
      message: "Temporary email addresses aren't allowed. Please use a permanent inbox.",
    });
  }

  const account = await db.accounts.create({
    email,
    passwordHash: await hash(password),
    emailScore: check.score,
    // Gate welcome rewards behind a stronger address instead of blocking play
    rewardsEligible: check.score >= 60,
  });

  await sendVerificationEmail(account);
  return account;
}