identity: enforce disallowed TLDs

atproto/identity/handle.go

@@ -164,6 +164,10 @@ func (d *BaseDirectory) ResolveHandle(ctx context.Context, handle syntax.Handle)
 	var dnsErr error
 	var did syntax.DID
 
+	if !handle.AllowedTLD() {
+		return "", ErrHandleReservedTLD
+	}
+
 	tryDNS := true
 	for _, suffix := range d.SkipDNSDomainSuffixes {
 		if strings.HasSuffix(handle.String(), suffix) {

atproto/identity/identity.go

@@ -40,6 +40,9 @@ var ErrHandleNotFound = errors.New("handle not found")
 // Indicates that handle and DID resolved, but handle points to a DID with a different handle. This is only returned when looking up a handle, not when looking up a DID.
 var ErrHandleNotValid = errors.New("handle resolves to DID with different handle")
 
+// Handle top-level domain (TLD) is one of the special "Reserved" suffixes, and not allowed for atproto use
+var ErrHandleReservedTLD = errors.New("handle top-level domain is disallowed")
+
 // Indicates that resolution process completed successfully, but the DID does not exist.
 var ErrDIDNotFound = errors.New("DID not found")