domain migration

backend/app/services/domain_policy.py

@@ -0,0 +1,49 @@
+"""Company domain registration policy."""
+
+from __future__ import annotations
+
+from app.services.domain_provisioning import normalize_domain, validate_domain
+
+# Well-known domains that must never be used for company onboarding.
+BLOCKED_COMPANY_DOMAINS = frozenset(
+    {
+        "google.com",
+        "gmail.com",
+        "yahoo.com",
+        "outlook.com",
+        "hotmail.com",
+        "live.com",
+        "icloud.com",
+        "apple.com",
+        "microsoft.com",
+        "amazon.com",
+        "facebook.com",
+        "meta.com",
+        "linkedin.com",
+        "proton.me",
+        "protonmail.com",
+        "aol.com",
+        "zoho.com",
+        "fastmail.com",
+        "yandex.com",
+        "mail.ru",
+        "cloudflare.com",
+        "github.com",
+    }
+)
+
+
+def assert_company_domain_allowed(domain: str, platform_domain: str) -> str:
+    """Validate format and reject reserved or platform domains."""
+    normalized = validate_domain(domain)
+    if normalized == normalize_domain(platform_domain):
+        raise ValueError(
+            f"You cannot register {platform_domain} as a company domain. "
+            "Use a domain your organization controls."
+        )
+    if normalized in BLOCKED_COMPANY_DOMAINS:
+        raise ValueError(
+            "That domain cannot be used for company signup. "
+            "Enter a domain you control and can edit in DNS."
+        )
+    return normalized