From b4df7e36052416eafc5a4777e608e2c2d1ebaa25 Mon Sep 17 00:00:00 2001
From: Mia <49593536+mia-pi-git@users.noreply.github.com>
Date: Sat, 28 Sep 2024 14:47:45 -0500
Subject: [PATCH] Add extra authentication to encoded usernames

---
 src/actions.ts | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/actions.ts b/src/actions.ts
index 23ea0af..40bcadd 100644
--- a/src/actions.ts
+++ b/src/actions.ts
@@ -33,6 +33,7 @@ const SMOGON_KEY = (() => {
 	const [key, salt] = keyData.split('\n');
 	return makeEncryptKey(key, salt);
 })();
+const SMOGON_VALIDATION_PREFIX = 'valid\n';
 
 async function getOAuthClient(clientId?: string, origin?: string) {
 	if (!clientId) throw new ActionError("No client_id provided.");
@@ -926,7 +927,9 @@ export const actions: {[k: string]: QueryHandler} = {
 		if (!params.username) {
 			throw new ActionError("Invalid PS username provided.");
 		}
-		return {encrypted_username: encrypt(SMOGON_KEY, params.username)};
+		return {
+			encrypted_username: encrypt(SMOGON_KEY, SMOGON_VALIDATION_PREFIX + params.username),
+		};
 	},
 
 	// sent by smogon to validate given encrypted name
@@ -937,9 +940,11 @@ export const actions: {[k: string]: QueryHandler} = {
 		if (!params.encrypted_name || !toID(params.encrypted_name)) {
 			throw new ActionError("No encrypted name provided.");
 		}
-		return {
-			decrypted_name: decrypt(SMOGON_KEY, decodeURIComponent(params.encrypted_name)),
-		};
+		const out = decrypt(SMOGON_KEY, decodeURIComponent(params.encrypted_name));
+		if (!out || !out.startsWith(SMOGON_VALIDATION_PREFIX)) {
+			return {decrypted_name: null};
+		}
+		return {decrypted_name: out.slice(SMOGON_VALIDATION_PREFIX.length)};
 	},
 };