fix: prevent subdomain change to already-in-use subdomains

session/interaction/interaction.go

@@ -205,7 +205,20 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 				return m, tea.Batch(tea.ClearScreen, textinput.Blink)
 			case "enter":
 				inputValue := m.slugInput.Value()
-				m.interaction.updateClientSlug(m.interaction.slugManager.Get(), inputValue)
+
+				if isForbiddenSlug(inputValue) {
+					m.slugError = "This subdomain is reserved. Please choose a different one."
+					return m, nil
+				} else if !isValidSlug(inputValue) {
+					m.slugError = "Invalid subdomain. Follow the rules."
+					return m, nil
+				}
+
+				if !m.interaction.updateClientSlug(m.interaction.slugManager.Get(), inputValue) {
+					m.slugError = "Someone already uses this subdomain."
+					return m, nil
+				}
+
 				m.tunnelURL = buildURL(m.protocol, inputValue, m.domain)
 				m.editingSlug = false
 				m.slugError = ""
@@ -800,3 +813,30 @@ func buildURL(protocol, subdomain, domain string) string {
 func generateRandomSubdomain() string {
 	return utils.GenerateRandomString(20)
 }
+
+func isValidSlug(slug string) bool {
+	if len(slug) < minSlugLength || len(slug) > maxSlugLength {
+		return false
+	}
+
+	if slug[0] == '-' || slug[len(slug)-1] == '-' {
+		return false
+	}
+
+	for _, c := range slug {
+		if !isValidSlugChar(byte(c)) {
+			return false
+		}
+	}
+
+	return true
+}
+
+func isValidSlugChar(c byte) bool {
+	return (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '-'
+}
+
+func isForbiddenSlug(slug string) bool {
+	_, ok := forbiddenSlugs[slug]
+	return ok
+}