DEV Community: Elijah Brown

Stop free AI credits from leaking in Supabase and Next.js apps

Elijah Brown — Tue, 20 Oct 2026 12:18:46 +0000

An app that gives every new account free AI credits tends to leak them in four places.

The same person opens a second Google account, or signs up again as jane.doe+2@gmail.com, and gets a fresh balance.
The /api/generate route calls the model for anyone who can send a POST, signed in or not.
Credits land at signup, so an address nobody ever opens still gets the full allowance.
Nothing stops one account from firing a few hundred requests in a minute.

None of these needs a clever attacker. A loop in the browser console is enough for the second one. This post closes all four with one route handler and one SQL migration. It works for a plain Next.js app on Supabase, and for a Lovable project, since Lovable apps run on Supabase too and the SQL goes into the same SQL editor.

The layout:

lib/email-key.mjs            normalise the address into a claim key
db/schema.sql                claim table, credits, daily counter, triggers
app/api/generate/handler.mjs the route logic, testable without Next
app/api/generate/route.js    wires it to Supabase
test/                        node --test suites

1. One key per inbox

Gmail ignores dots in the local part, drops everything after a +, and treats googlemail.com as gmail.com. So the claim key collapses those. Every other domain keeps its dots and tags, because plenty of mail servers treat them as separate mailboxes.

// lib/email-key.mjs
const GMAIL = new Set(["gmail.com", "googlemail.com"]);

export function emailKey(raw) {
  const email = String(raw ?? "").trim().toLowerCase();
  const at = email.lastIndexOf("@");
  if (at < 1 || at === email.length - 1) return null;
  let local = email.slice(0, at);
  let domain = email.slice(at + 1);
  if (GMAIL.has(domain)) {
    local = local.split("+")[0].replaceAll(".", "");
    domain = "gmail.com";
  }
  return local ? `${local}@${domain}` : null;
}

The stored email stays exactly as typed. Only the claim key is normalised.

2. The migration

Run this in the Supabase SQL editor. It does four things:

email_key() is the same normaliser in SQL, so the database enforces it and the client can't skip it.
trial_claims has the claim key as its primary key. That unique index is the whole trick: a second spelling of the same inbox can make an account, but its claim insert hits the index and does nothing.
Credits are granted by a trigger on auth.users, and only when email_confirmed_at is set. Email signups get there when the link is clicked. Google sign in arrives already confirmed, so a second trigger covers the insert path.
spend_credit() counts today's calls and takes one credit in a single statement pair inside one function call. It reads the user id from the session with auth.uid(), so a caller can't spend someone else's balance by passing their id.

-- db/schema.sql
create or replace function public.email_key(raw text)
returns text language sql immutable as $$
  with p as (
    select lower(trim(raw)) as e
  ), s as (
    select split_part(e, '@', 1) as local,
           substr(e, length(split_part(e, '@', 1)) + 2) as domain
    from p where e like '_%@_%'
  )
  select case
    when domain in ('gmail.com', 'googlemail.com')
      then nullif(replace(split_part(local, '+', 1), '.', ''), '') || '@gmail.com'
    else local || '@' || domain
  end
  from s
$$;

create table if not exists public.trial_claims (
  email_key  text primary key,
  user_id    uuid not null unique,
  claimed_at timestamptz not null default now()
);

create table if not exists public.credits (
  user_id uuid primary key,
  balance integer not null default 0 check (balance >= 0)
);

create table if not exists public.usage_daily (
  user_id uuid not null,
  day     date not null default current_date,
  calls   integer not null default 0,
  primary key (user_id, day)
);

-- Runs when Auth flips email_confirmed_at from null to a timestamp.
create or replace function public.grant_trial_on_confirm()
returns trigger language plpgsql security definer set search_path = public as $$
declare
  k text := public.email_key(new.email);
begin
  if k is null then
    return new;
  end if;

  insert into public.trial_claims (email_key, user_id)
  values (k, new.id)
  on conflict do nothing;

  if found then
    insert into public.credits (user_id, balance)
    values (new.id, 50)
    on conflict (user_id) do nothing;
  end if;

  return new;
end $$;

drop trigger if exists grant_trial_on_confirm on auth.users;
create trigger grant_trial_on_confirm
  after update of email_confirmed_at on auth.users
  for each row
  when (old.email_confirmed_at is null and new.email_confirmed_at is not null)
  execute function public.grant_trial_on_confirm();

-- Google sign in arrives already confirmed, so it never hits the update path.
drop trigger if exists grant_trial_on_confirmed_insert on auth.users;
create trigger grant_trial_on_confirmed_insert
  after insert on auth.users
  for each row
  when (new.email_confirmed_at is not null)
  execute function public.grant_trial_on_confirm();

-- One call: under the daily cap and has a credit, or nothing changes.
-- The user id comes from the caller's JWT, never from the request body.
create or replace function public.spend_credit(daily_cap integer)
returns integer language plpgsql security definer set search_path = public as $$
declare
  uid uuid := auth.uid();
  used integer;
  left_over integer;
begin
  if uid is null then
    raise exception 'not_signed_in' using errcode = 'P0001';
  end if;

  insert into public.usage_daily as u (user_id, day, calls)
  values (uid, current_date, 1)
  on conflict (user_id, day) do update
    set calls = u.calls + 1
    where u.calls < daily_cap
  returning calls into used;

  if used is null then
    return -1;  -- daily cap reached
  end if;

  update public.credits
     set balance = balance - 1
   where user_id = uid and balance > 0
  returning balance into left_over;

  if left_over is null then
    raise exception 'no_credits' using errcode = 'P0001';
  end if;

  return left_over;
end $$;

revoke all on function public.spend_credit(integer) from public, anon;
grant execute on function public.spend_credit(integer) to authenticated;

alter table public.trial_claims enable row level security;
alter table public.credits enable row level security;
alter table public.usage_daily enable row level security;

create policy "read own credits" on public.credits
  for select to authenticated using (user_id = auth.uid());

A few details worth calling out.

on conflict do nothing followed by if found is what makes the grant safe under load. Twenty confirmations of the same inbox at once still produce exactly one credits row, and the test below runs that case.

The daily counter uses on conflict ... do update ... where u.calls < daily_cap. When the cap is reached the where fails, no row comes back, and the function returns -1 without touching the balance.

If the counter goes up but the balance is empty, the function raises. Postgres rolls the whole call back, so a failed request doesn't eat a slot from the daily cap.

The three tables have row level security on with no write policies, so the browser can read its own balance and nothing else. All writes go through the triggers and spend_credit.

3. The route handler

The logic lives in a small factory so it can be tested without booting Next. It checks the session first, refuses unconfirmed accounts, validates the prompt, spends a credit, and only then calls the model. The order matters: every early return happens before any quota is touched.

// app/api/generate/handler.mjs
export function makeHandler({ getUser, spendCredit, callModel, dailyCap = 30 }) {
  return async function POST(request) {
    const user = await getUser(request);
    if (!user) {
      return Response.json({ error: "sign_in_required" }, { status: 401 });
    }
    if (!user.email_confirmed_at) {
      return Response.json({ error: "confirm_email_first" }, { status: 403 });
    }

    let body;
    try {
      body = await request.json();
    } catch {
      return Response.json({ error: "bad_json" }, { status: 400 });
    }
    const prompt = typeof body?.prompt === "string" ? body.prompt.trim() : "";
    if (!prompt || prompt.length > 4000) {
      return Response.json({ error: "bad_prompt" }, { status: 400 });
    }

    let left;
    try {
      left = await spendCredit(user.id, dailyCap);
    } catch (err) {
      if (err?.message?.includes("no_credits")) {
        return Response.json({ error: "out_of_credits" }, { status: 402 });
      }
      throw err;
    }
    if (left < 0) {
      return Response.json({ error: "daily_limit" }, { status: 429 });
    }

    const output = await callModel(prompt);
    return Response.json({ output, credits_left: left });
  };
}

And the actual route file. createClient is the server client from the Supabase Next.js guide (@supabase/ssr with cookies). Use auth.getUser() here, not getSession(): getUser() asks the Supabase Auth server about the token, while getSession() just reads the cookie.

// app/api/generate/route.js
import { createClient } from "@/utils/supabase/server";
import { makeHandler } from "./handler.mjs";
import { callModel } from "@/lib/model";

export const POST = makeHandler({
  async getUser() {
    const supabase = await createClient();
    const { data, error } = await supabase.auth.getUser();
    return error ? null : data.user;
  },
  async spendCredit(userId, dailyCap) {
    const supabase = await createClient();
    // spend_credit reads the user id from the session JWT.
    const { data, error } = await supabase.rpc("spend_credit", {
      daily_cap: dailyCap,
    });
    if (error) throw new Error(error.message);
    return data;
  },
  callModel,
});

Because spend_credit runs with the caller's JWT, the RPC goes through the user's own session. No service role key is needed in this route, which is one less secret that could end up in a client bundle.

4. Tests

Two suites. The handler suite uses fakes and runs anywhere. The database suite runs against a local Postgres when DATABASE_URL is set and skips otherwise. Locally it needs a tiny stand in for what Supabase already ships: an auth.users table, auth.uid(), and the anon and authenticated roles.

-- Minimal stand-in for what Supabase already provides. Not part of the article's migration.
create schema if not exists auth;
create table if not exists auth.users (
  id uuid primary key default gen_random_uuid(),
  email text,
  email_confirmed_at timestamptz
);
create or replace function auth.uid() returns uuid language sql stable as $$
  select nullif(current_setting('request.jwt.claim.sub', true), '')::uuid
$$;
do $$ begin
  if not exists (select from pg_roles where rolname = 'anon') then create role anon; end if;
  if not exists (select from pg_roles where rolname = 'authenticated') then create role authenticated; end if;
end $$;

The anon and authenticated roles need a superuser to create, so on a plain local Postgres make them once by hand before the first run.

// test/handler.test.mjs
import { test } from "node:test";
import assert from "node:assert/strict";
import { makeHandler } from "../app/api/generate/handler.mjs";

const req = (body) =>
  new Request("http://x/api/generate", { method: "POST", body: JSON.stringify(body) });

function setup({ user, balance = 2, cap = 3 }) {
  const calls = { model: 0, used: 0 };
  const POST = makeHandler({
    dailyCap: cap,
    getUser: async () => user,
    spendCredit: async (_id, dailyCap) => {
      if (calls.used >= dailyCap) return -1;
      if (balance === 0) throw new Error("no_credits");
      calls.used++;
      return --balance;
    },
    callModel: async (p) => { calls.model++; return `echo: ${p}`; },
  });
  return { POST, calls };
}

const confirmed = { id: "u1", email_confirmed_at: "2026-10-20T10:00:00Z" };

test("no session: 401 and the model is never called", async () => {
  const { POST, calls } = setup({ user: null });
  assert.equal((await POST(req({ prompt: "hi" }))).status, 401);
  assert.equal(calls.model, 0);
});

test("unconfirmed email: 403", async () => {
  const { POST, calls } = setup({ user: { id: "u1", email_confirmed_at: null } });
  assert.equal((await POST(req({ prompt: "hi" }))).status, 403);
  assert.equal(calls.model, 0);
});

test("spends credits, then 402 when they run out", async () => {
  const { POST, calls } = setup({ user: confirmed, balance: 2, cap: 10 });
  const a = await POST(req({ prompt: "hi" }));
  assert.equal(a.status, 200);
  assert.equal((await a.json()).credits_left, 1);
  assert.equal((await POST(req({ prompt: "hi" }))).status, 200);
  assert.equal((await POST(req({ prompt: "hi" }))).status, 402);
  assert.equal(calls.model, 2);
});

test("daily cap: 429 even with credits left", async () => {
  const { POST, calls } = setup({ user: confirmed, balance: 100, cap: 2 });
  await POST(req({ prompt: "a" }));
  await POST(req({ prompt: "b" }));
  assert.equal((await POST(req({ prompt: "c" }))).status, 429);
  assert.equal(calls.model, 2);
});

test("empty or oversized prompt: 400 before any credit is spent", async () => {
  const { POST, calls } = setup({ user: confirmed });
  assert.equal((await POST(req({ prompt: "  " }))).status, 400);
  assert.equal((await POST(req({ prompt: "x".repeat(4001) }))).status, 400);
  assert.equal(calls.used, 0);
});

// test/db.test.mjs
import { test, before, after } from "node:test";
import assert from "node:assert/strict";
import { readFileSync } from "node:fs";
import pg from "pg";
import { emailKey } from "../lib/email-key.mjs";

const url = process.env.DATABASE_URL;
const pool = url ? new pg.Pool({ connectionString: url }) : null;
const opts = { skip: !url && "set DATABASE_URL to run" };

before(async () => {
  if (!pool) return;
  await pool.query("drop schema if exists auth cascade; drop table if exists public.trial_claims, public.credits, public.usage_daily cascade");
  await pool.query(readFileSync(new URL("./supabase-stub.sql", import.meta.url), "utf8"));
  await pool.query(readFileSync(new URL("../db/schema.sql", import.meta.url), "utf8"));
});
after(() => pool?.end());

async function signUp(email) {
  const { rows } = await pool.query("insert into auth.users (email) values ($1) returning id", [email]);
  return rows[0].id;
}
const confirm = (id) => pool.query("update auth.users set email_confirmed_at = now() where id = $1", [id]);
const balance = async (id) =>
  (await pool.query("select balance from public.credits where user_id = $1", [id])).rows[0]?.balance ?? null;

async function spendAs(id, cap) {
  const c = await pool.connect();
  try {
    await c.query("select set_config('request.jwt.claim.sub', $1, false)", [id]);
    return (await c.query("select public.spend_credit($1) as left", [cap])).rows[0].left;
  } finally {
    await c.query("reset all");
    c.release();
  }
}

test("SQL email_key matches the JS one", opts, async () => {
  for (const e of ["Jane.Doe+2@GoogleMail.com", "Jane.Doe+a@Example.com", "nope", "+x@gmail.com"]) {
    const { rows } = await pool.query("select public.email_key($1) k", [e]);
    assert.equal(rows[0].k, emailKey(e), e);
  }
});

test("no credits until the email is confirmed", opts, async () => {
  const id = await signUp("first.person@gmail.com");
  assert.equal(await balance(id), null);
  await confirm(id);
  assert.equal(await balance(id), 50);
  await confirm(id); // second update must not grant again
  assert.equal(await balance(id), 50);
});

test("a second Gmail spelling gets an account but no credits", opts, async () => {
  const id = await signUp("FirstPerson+again@googlemail.com");
  await confirm(id);
  assert.equal(await balance(id), null);
});

test("Google sign in (confirmed on insert) gets credits once per inbox", opts, async () => {
  const ins = "insert into auth.users (email, email_confirmed_at) values ($1, now()) returning id";
  const a = (await pool.query(ins, ["oauth.person@gmail.com"])).rows[0].id;
  const b = (await pool.query(ins, ["oauthperson+2@gmail.com"])).rows[0].id;
  assert.equal(await balance(a), 50);
  assert.equal(await balance(b), null);
});

test("daily cap and balance are enforced in one call", opts, async () => {
  const id = await signUp("capped@example.com");
  await confirm(id);
  assert.equal(await spendAs(id, 2), 49);
  assert.equal(await spendAs(id, 2), 48);
  assert.equal(await spendAs(id, 2), -1);
  assert.equal(await balance(id), 48);
});

test("out of credits raises and does not count the call", opts, async () => {
  const id = await signUp("empty@example.com");
  await confirm(id);
  await pool.query("update public.credits set balance = 0 where user_id = $1", [id]);
  await assert.rejects(spendAs(id, 5), /no_credits/);
  const { rows } = await pool.query("select calls from public.usage_daily where user_id = $1", [id]);
  assert.equal(rows.length, 0);
});

test("no session: spend_credit refuses", opts, async () => {
  await assert.rejects(pool.query("select public.spend_credit(5)"), /not_signed_in/);
});

test("20 parallel confirmations of one inbox grant credits once", opts, async () => {
  const ids = [];
  for (let i = 0; i < 20; i++) ids.push(await signUp(`race.case+${i}@gmail.com`));
  await Promise.all(ids.map((id) => confirm(id)));
  const { rows } = await pool.query(
    "select count(*)::int n from public.credits where user_id = any($1::uuid[])", [ids]);
  assert.equal(rows[0].n, 1);
});

test("50 parallel spends against 10 credits never go below zero", opts, async () => {
  const id = await signUp("burst@example.com");
  await confirm(id);
  await pool.query("update public.credits set balance = 10 where user_id = $1", [id]);
  const results = await Promise.allSettled(Array.from({ length: 50 }, () => spendAs(id, 1000)));
  assert.equal(results.filter((r) => r.status === "fulfilled").length, 10);
  assert.equal(await balance(id), 0);
});

// test/email-key.test.mjs
import { test } from "node:test";
import assert from "node:assert/strict";
import { emailKey } from "../lib/email-key.mjs";

test("gmail dots, plus tags and googlemail collapse to one key", () => {
  for (const e of ["jane.doe@gmail.com", "JaneDoe+2@Gmail.com", "j.a.n.e.doe+x@googlemail.com"]) {
    assert.equal(emailKey(e), "janedoe@gmail.com");
  }
});

test("other domains keep dots and plus tags", () => {
  assert.equal(emailKey("Jane.Doe+a@Example.com"), "jane.doe+a@example.com");
});

test("junk returns null", () => {
  for (const e of ["", "nope", "@gmail.com", "a@", "+x@gmail.com", null]) {
    assert.equal(emailKey(e), null);
  }
});

With "type": "module" in package.json and pg installed, on Node 20.19 and PostgreSQL 17.11:

$ DATABASE_URL=postgres://trial:trial@localhost/trial node --test --test-reporter=spec
✔ SQL email_key matches the JS one
✔ no credits until the email is confirmed
✔ a second Gmail spelling gets an account but no credits
✔ Google sign in (confirmed on insert) gets credits once per inbox
✔ daily cap and balance are enforced in one call
✔ out of credits raises and does not count the call
✔ no session: spend_credit refuses
✔ 20 parallel confirmations of one inbox grant credits once
✔ 50 parallel spends against 10 credits never go below zero
✔ gmail dots, plus tags and googlemail collapse to one key
✔ other domains keep dots and plus tags
✔ junk returns null
✔ no session: 401 and the model is never called
✔ unconfirmed email: 403
✔ spends credits, then 402 when they run out
✔ daily cap: 429 even with credits left
✔ empty or oversized prompt: 400 before any credit is spent
ℹ tests 17
ℹ pass 17
ℹ fail 0
ℹ skipped 0

Without DATABASE_URL the eight handler and normaliser tests pass and the nine database tests are skipped.

What this doesn't cover

A unique key per inbox stops the same Gmail address from coming back in a new spelling. It does nothing about someone who owns ten separate Google accounts, or a script that rotates through fresh domains. For that you need signals from outside the email string: the IP the signup came from, whether the domain was registered last week, whether a phone number belongs to a reserved test range. The daily cap also limits damage per account, not per person, so pairing it with a per IP limit on the signup form is a sensible next step.

I built Orisift for the parts this doesn't cover; there's a free tier. orisift.com

Block disposable signups in Next.js without blocking privacy aliases

Elijah Brown — Fri, 16 Oct 2026 10:16:57 +0000

Last month I added a burner email filter to a signup form and within a day someone wrote in asking why their Apple Hide My Email address got rejected. They weren't abusing anything. They just didn't want to hand me their inbox.

That's the trap with disposable email lists. A relay like privaterelay.appleid.com or duck.com looks a lot like a throwaway service if you only ask "is this address hiding something?" The better question is "will this person still be able to read mail from me next week?" A relay forwards to an inbox the person keeps. A Mailinator address is public and gone tomorrow.

So the rule I ended up with has three parts:

Allow known privacy relays first, before any block list runs.
Block known disposable domains, including their subdomains.
Collapse Gmail dots and +tags into one key so one inbox can't open ten trials.

Everything below runs on plain Node 18 or later and drops into the App Router as is.

The classifier

// lib/signup-email.mjs
const DISPOSABLE = new Set([
  "mailinator.com", "guerrillamail.com", "10minutemail.com", "tempmail.dev",
  "yopmail.com", "trashmail.com", "sharklasers.com", "getnada.com",
]);

// Domains whose users pick aliases on purpose. Never block these.
const ALIAS_DOMAINS = new Set([
  "privaterelay.appleid.com", "duck.com", "simplelogin.com", "simplelogin.co",
  "anonaddy.me", "addy.io", "passmail.net", "mozmail.com",
]);

// Providers where dots and +tags don't change the inbox.
const DOT_INSENSITIVE = new Set(["gmail.com", "googlemail.com"]);

export function normalizeEmail(raw) {
  const email = String(raw).trim().toLowerCase();
  const at = email.lastIndexOf("@");
  if (at < 1 || at === email.length - 1) return null;
  let local = email.slice(0, at);
  let domain = email.slice(at + 1);
  if (domain === "googlemail.com") domain = "gmail.com";
  if (DOT_INSENSITIVE.has(domain)) local = local.replace(/\./g, "");
  // Keep the +tag for display, drop it for the uniqueness key.
  const base = local.split("+")[0];
  return { email, key: `${base}@${domain}`, domain };
}

function parentDomains(domain) {
  const parts = domain.split(".");
  const out = [];
  for (let i = 0; i < parts.length - 1; i++) out.push(parts.slice(i).join("."));
  return out;
}

export function classifyEmail(raw) {
  const n = normalizeEmail(raw);
  if (!n) return { ok: false, reason: "invalid" };
  const chain = parentDomains(n.domain);
  if (chain.some((d) => ALIAS_DOMAINS.has(d))) return { ok: true, kind: "alias", key: n.key };
  if (chain.some((d) => DISPOSABLE.has(d))) return { ok: false, reason: "disposable" };
  return { ok: true, kind: "standard", key: n.key };
}

A few choices worth explaining.

Aliases are checked first. If a relay domain ever lands on a community block list (it happens), your allow list still wins.

Parent domains are matched. Burner services love random subdomains like mx.yopmail.com. Walking up the domain chain catches those without a regex.

Dots only collapse for Gmail. At Gmail, jane.doe and janedoe are the same inbox. At Outlook and most company domains they are two different people, so the code leaves them alone.

The +tag is dropped only from the key. You still store and email the address the person typed. People use tags to filter mail and they notice when you strip them.

The disposable set here is deliberately short. In production, load a maintained list such as the disposable-email-domains repo on GitHub at build time and refresh it weekly.

The route handler

// app/api/signup/route.js
import { classifyEmail } from "@/lib/signup-email.mjs";

const seen = new Map(); // swap for a unique index on users.email_key

export async function POST(request) {
  const { email } = await request.json().catch(() => ({}));
  const result = classifyEmail(email ?? "");
  if (!result.ok) {
    const message = result.reason === "disposable"
      ? "Please use an inbox you plan to keep. Relay addresses like Hide My Email are fine."
      : "That email doesn't look right.";
    return Response.json({ error: message }, { status: 400 });
  }
  if (seen.has(result.key)) {
    return Response.json({ error: "An account already uses this inbox." }, { status: 409 });
  }
  seen.set(result.key, email);
  return Response.json({ created: true, kind: result.kind }, { status: 201 });
}

Two notes on the error copy. The disposable message tells people what is allowed, which cuts support mail. The duplicate message says "inbox" rather than "email", since the person typed a different string and might be confused otherwise.

The Map is a stand in. In a real app, add an email_key column with a unique index and let the database reject the second insert. With Supabase or plain Postgres:

alter table profiles add column email_key text;
create unique index profiles_email_key_idx on profiles (email_key);

Tests

Node ships a test runner, so no install is needed.

// signup.test.mjs
import { test } from "node:test";
import assert from "node:assert/strict";
import { classifyEmail } from "./signup-email.mjs";
import { POST } from "./route.mjs";

const post = (email) => POST(new Request("http://x/api/signup", {
  method: "POST", body: JSON.stringify({ email }) }));

test("blocks disposable domains and their subdomains", () => {
  assert.equal(classifyEmail("a@mailinator.com").reason, "disposable");
  assert.equal(classifyEmail("a@mx.yopmail.com").reason, "disposable");
});
test("lets privacy aliases through", () => {
  assert.equal(classifyEmail("x7f2@privaterelay.appleid.com").kind, "alias");
  assert.equal(classifyEmail("shop.abc@duck.com").kind, "alias");
  assert.equal(classifyEmail("me@mozmail.com").kind, "alias");
});
test("gmail dots and plus tags collapse to one key", () => {
  assert.equal(classifyEmail("Jane.Doe+trial3@gmail.com").key, "janedoe@gmail.com");
  assert.equal(classifyEmail("janedoe@googlemail.com").key, "janedoe@gmail.com");
});
test("dots stay meaningful outside gmail", () => {
  assert.equal(classifyEmail("jane.doe@outlook.com").key, "jane.doe@outlook.com");
});
test("rejects junk", () => {
  assert.equal(classifyEmail("nope").reason, "invalid");
  assert.equal(classifyEmail("@x.com").reason, "invalid");
});
test("route: 201, then 409 for the same inbox, 400 for burners", async () => {
  assert.equal((await post("jane.doe@gmail.com")).status, 201);
  assert.equal((await post("janedoe+again@gmail.com")).status, 409);
  assert.equal((await post("a@guerrillamail.com")).status, 400);
  assert.equal((await post("hide@privaterelay.appleid.com")).status, 201);
  assert.equal((await post(undefined)).status, 400);
});

$ node --test
✔ blocks disposable domains and their subdomains
✔ lets privacy aliases through
✔ gmail dots and plus tags collapse to one key
✔ dots stay meaningful outside gmail
✔ rejects junk
✔ route: 201, then 409 for the same inbox, 400 for burners
ℹ tests 6
ℹ pass 6

What this won't catch

A static list can't see a brand new burner domain registered this morning, and it says nothing about the IP or phone number behind the signup. If someone is scripting signups from one datacenter range with fresh domains, you'll need a signal beyond the email string. Rate limiting by IP prefix on the route is a cheap next step.

For most side projects though, this is enough to stop the casual trial farming and keep the privacy minded people who were going to pay you anyway.

I built Orisift for the parts this doesn't cover; there's a free tier. orisift.com

One free trial per person in Laravel: normalise Gmail dots and plus tags, then enforce it in the database

Elijah Brown — Fri, 16 Oct 2026 09:40:08 +0000

A free trial that hands out credits on signup has a simple loophole. Gmail ignores dots in the local part and drops anything after a plus sign, and it treats googlemail.com as the same mailbox as gmail.com. So jane.doe@gmail.com, janedoe+2@gmail.com and j.a.n.e.doe@googlemail.com all land in one inbox, and each one looks like a fresh account to a plain unique:users,email rule.

This post builds the fix in a fresh Laravel 13 app in four parts: a normaliser, a validation Rule for a friendly form error, a migration with a unique index on trial_claims, and a claim action that writes the claim and grants the credits in one DB::transaction. Then a Pest suite, including a test where four processes race for the same trial at once. Every snippet below comes from the app I ran the tests against.

1. Normalise the address

Keep the stored email exactly as the person typed it. Only the trial key gets normalised.

<?php

namespace App\Support;

class EmailIdentity
{
    private const GMAIL_DOMAINS = ['gmail.com', 'googlemail.com'];

    public static function normalise(string $email): string
    {
        $email = strtolower(trim($email));

        $at = strrpos($email, '@');

        if ($at === false) {
            return $email;
        }

        $local = substr($email, 0, $at);
        $domain = substr($email, $at + 1);

        if (! in_array($domain, self::GMAIL_DOMAINS, true)) {
            return $local.'@'.$domain;
        }

        $local = explode('+', $local, 2)[0];
        $local = str_replace('.', '', $local);

        return $local.'@gmail.com';
    }
}

Two choices worth calling out. Dots and plus tags are only stripped for gmail.com and googlemail.com, because on other providers jane.doe and janedoe can be two different people. And googlemail.com is folded into gmail.com, so the two spellings share one key.

You could extend the plus rule to providers that document it, such as Outlook or Fastmail. I left that out on purpose: a team mailbox like billing+acme@company.com can belong to someone else entirely.

2. A Rule class for the signup form

<?php

namespace App\Rules;

use App\Models\TrialClaim;
use App\Support\EmailIdentity;
use Closure;
use Illuminate\Contracts\Validation\ValidationRule;

class FirstTrialForEmail implements ValidationRule
{
    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
        if (! is_string($value)) {
            return;
        }

        $taken = TrialClaim::where('normalised_email', EmailIdentity::normalise($value))->exists();

        if ($taken) {
            $fail('This email has already been used for a free trial.');
        }
    }
}

Use it next to your usual rules:

$request->validate([
    'email' => ['required', 'email', 'unique:users,email', new FirstTrialForEmail],
]);

This gives a clear message at the form. It is not the guarantee. Two requests can both run this check before either one writes, and both will pass. The database has to settle that case.

3. The migration

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::table('users', function (Blueprint $table) {
            $table->unsignedInteger('credits')->default(0);
        });

        Schema::create('trial_claims', function (Blueprint $table) {
            $table->id();
            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
            $table->string('normalised_email');
            $table->timestamps();

            $table->unique('normalised_email');
        });
    }

    public function down(): void
    {
        Schema::dropIfExists('trial_claims');

        Schema::table('users', function (Blueprint $table) {
            $table->dropColumn('credits');
        });
    }
};

The unique index on normalised_email is the line that actually enforces one trial per person. trial_claims is its own table rather than a column on users, so it can outlive the account. As written, deleting a user cascades and frees their email for another trial. If you want the claim to survive account deletion, make user_id nullable and use nullOnDelete() instead of the cascade.

4. Claim and grant in one transaction

<?php

namespace App\Actions;

use App\Exceptions\TrialAlreadyClaimed;
use App\Models\TrialClaim;
use App\Models\User;
use App\Support\EmailIdentity;
use Illuminate\Database\UniqueConstraintViolationException;
use Illuminate\Support\Facades\DB;

class ClaimTrial
{
    public const TRIAL_CREDITS = 500;

    public function __invoke(User $user): void
    {
        try {
            DB::transaction(function () use ($user) {
                TrialClaim::create([
                    'user_id' => $user->id,
                    'normalised_email' => EmailIdentity::normalise($user->email),
                ]);

                User::whereKey($user->id)->increment('credits', self::TRIAL_CREDITS);
            });
        } catch (UniqueConstraintViolationException) {
            throw new TrialAlreadyClaimed('This email has already been used for a free trial.');
        }
    }
}

The claim row and the credit grant either both happen or neither does. If the insert hits the unique index, Laravel throws UniqueConstraintViolationException, the transaction rolls back, and the credits are never added. No lockForUpdate, no check then insert; the index does the work.

Call it after the user is created, and turn the exception into a normal response:

try {
    app(ClaimTrial::class)($user);
} catch (TrialAlreadyClaimed $e) {
    // The account still exists, it just starts without trial credits.
    session()->flash('status', $e->getMessage());
}

5. Pest tests

The normaliser first, with a dataset of the variants that should all collapse to one key:

<?php

use App\Support\EmailIdentity;

it('folds Gmail dots, plus tags and googlemail.com into one address', function (string $input) {
    expect(EmailIdentity::normalise($input))->toBe('janedoe@gmail.com');
})->with([
    'janedoe@gmail.com',
    'jane.doe@gmail.com',
    'j.a.n.e.d.o.e@gmail.com',
    'janedoe+trial2@gmail.com',
    'Jane.Doe+again@GMAIL.com',
    'jane.doe@googlemail.com',
    '  jane.doe+x@googlemail.com ',
]);

it('leaves dots alone on other domains', function () {
    expect(EmailIdentity::normalise('Jane.Doe@Example.com'))->toBe('jane.doe@example.com');
});

Then the claim flow. The third test is the important one: both requests pass the Rule, and the second one is still refused by the index.

<?php

use App\Actions\ClaimTrial;
use App\Exceptions\TrialAlreadyClaimed;
use App\Models\TrialClaim;
use App\Models\User;
use App\Rules\FirstTrialForEmail;
use Illuminate\Support\Facades\Validator;

uses(Illuminate\Foundation\Testing\RefreshDatabase::class);

it('grants the trial credits once', function () {
    $user = User::factory()->create(['email' => 'jane.doe@gmail.com']);

    (new ClaimTrial)($user);

    expect($user->fresh()->credits)->toBe(ClaimTrial::TRIAL_CREDITS)
        ->and(TrialClaim::count())->toBe(1);
});

it('rejects a Gmail variant in the form rule', function () {
    (new ClaimTrial)(User::factory()->create(['email' => 'jane.doe@gmail.com']));

    $validator = Validator::make(
        ['email' => 'JaneDoe+second@googlemail.com'],
        ['email' => ['required', 'email', new FirstTrialForEmail]],
    );

    expect($validator->fails())->toBeTrue()
        ->and($validator->errors()->first('email'))
        ->toBe('This email has already been used for a free trial.');
});

it('lets the database decide when two requests both pass the rule', function () {
    $first = User::factory()->create(['email' => 'jane.doe@gmail.com']);
    $second = User::factory()->create(['email' => 'janedoe+2@googlemail.com']);

    $rules = ['email' => [new FirstTrialForEmail]];
    expect(Validator::make(['email' => $first->email], $rules)->passes())->toBeTrue()
        ->and(Validator::make(['email' => $second->email], $rules)->passes())->toBeTrue();

    (new ClaimTrial)($first);

    expect(fn () => (new ClaimTrial)($second))->toThrow(TrialAlreadyClaimed::class)
        ->and($second->fresh()->credits)->toBe(0)
        ->and(TrialClaim::count())->toBe(1);
});

6. The concurrency case

The test above runs the two claims one after another. To show the index holding under real parallel writes, this test forks four processes against a SQLite file, each claiming the trial for a different spelling of the same Gmail address. Exactly one should win.

<?php

use App\Actions\ClaimTrial;
use App\Exceptions\TrialAlreadyClaimed;
use App\Models\TrialClaim;
use App\Models\User;
use Illuminate\Support\Facades\Artisan;
use Illuminate\Support\Facades\DB;

beforeEach(function () {
    $this->dbFile = tempnam(sys_get_temp_dir(), 'trial').'.sqlite';
    touch($this->dbFile);

    config([
        'database.connections.sqlite.database' => $this->dbFile,
        'database.connections.sqlite.busy_timeout' => 5000,
    ]);
    DB::purge('sqlite');
    Artisan::call('migrate', ['--force' => true]);
});

afterEach(function () {
    DB::purge('sqlite');
    @unlink($this->dbFile);
});

it('gives the trial to exactly one of several processes racing at once', function () {
    $emails = ['jane.doe@gmail.com', 'janedoe@googlemail.com', 'j.anedoe+a@gmail.com', 'JANEDOE+b@gmail.com'];
    $ids = collect($emails)->map(fn ($e) => User::factory()->create(['email' => $e])->id);

    DB::purge('sqlite');
    $outDir = sys_get_temp_dir().'/trial-race-'.getmypid();
    @mkdir($outDir);
    $pids = [];

    foreach ($ids as $id) {
        $pid = pcntl_fork();

        if ($pid === 0) {
            DB::purge('sqlite');
            try {
                (new ClaimTrial)(User::findOrFail($id));
                $result = 'claimed';
            } catch (TrialAlreadyClaimed) {
                $result = 'refused';
            } catch (Throwable $e) {
                $result = 'error: '.$e->getMessage();
            }
            file_put_contents("$outDir/$id", $result);
            posix_kill(getmypid(), SIGKILL);
        }

        $pids[] = $pid;
    }

    foreach ($pids as $pid) {
        pcntl_waitpid($pid, $status);
    }

    $results = array_map(fn ($f) => file_get_contents($f), glob("$outDir/*"));
    array_map('unlink', glob("$outDir/*"));
    rmdir($outDir);

    $counts = array_count_values($results);

    expect($counts['claimed'] ?? 0)->toBe(1)
        ->and($counts['refused'] ?? 0)->toBe(count($emails) - 1)
        ->and(TrialClaim::count())->toBe(1)
        ->and((int) User::sum('credits'))->toBe(ClaimTrial::TRIAL_CREDITS);
});

A few notes on making this work. The default test setup uses an in memory SQLite database, which a forked child cannot share, so this file points the connection at a temp file and migrates it. DB::purge before forking stops the children from inheriting the parent's PDO handle. busy_timeout makes a child wait for the write lock instead of failing at once. Each child writes its result to a file and kills itself, so it never runs the test runner's shutdown code. It needs the pcntl and posix extensions, which the PHP CLI usually has.

On MySQL or Postgres the same action behaves the same way: the loser gets a unique violation inside its transaction and rolls back.

Results

PASS  Tests\Unit\EmailIdentityTest
  ✓ it folds Gmail dots, plus tags and googlemail.com into one address with ('janedoe@gmail.com')
  ✓ it folds Gmail dots, plus tags and googlemail.com into one address with ('jane.doe@gmail.com')
  ✓ it folds Gmail dots, plus tags and googlemail.com into one address with ('j.a.n.e.d.o.e@gmail.com')
  ✓ it folds Gmail dots, plus tags and googlemail.com into one address with ('janedoe+trial2@gmail.com')
  ✓ it folds Gmail dots, plus tags and googlemail.com into one address with ('Jane.Doe+again@GMAIL.com')
  ✓ it folds Gmail dots, plus tags and googlemail.com into one address with ('jane.doe@googlemail.com')
  ✓ it folds Gmail dots, plus tags and googlemail.com into one address with (' jane.doe+x@googlemail.com ')
  ✓ it leaves dots alone on other domains

   PASS  Tests\Feature\TrialClaimConcurrencyTest
  ✓ it gives the trial to exactly one of several processes racing at on… 0.23s  

   PASS  Tests\Feature\TrialClaimTest
  ✓ it grants the trial credits once                                     0.04s  
  ✓ it rejects a Gmail variant in the form rule                          0.01s  
  ✓ it lets the database decide when two requests both pass the rule     0.01s  

  Tests:    12 passed (21 assertions)
  Duration: 0.36s

I also ran the race test 20 times in a row and it passed every time.

What this does not cover

It only closes the Gmail address trick. Someone with two genuinely different mailboxes still gets two trials, and that needs other signals, such as the phone number, the IP or the email domain.

I built Orisift, which handles the other signup checks; there's a free tier. orisift.com