fix: tighten v2 setup and release safeguards (#6824)

packages/api/src/router/user.ts

@@ -454,7 +454,7 @@ export const userRouter = createTRPCRouter({
       }
 
       const user = await ctx.db.query.users.findFirst({
-        columns: { email: true, provider: true },
+        columns: { name: true, email: true, provider: true },
         where: eq(users.id, input.id),
       });
 
@@ -472,6 +472,13 @@ export const userRouter = createTRPCRouter({
         });
       }
 
+      if (isDemoMode && input.name !== user.name) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "Username changes are disabled in demo mode",
+        });
+      }
+
       await checkUsernameAlreadyTakenAndThrowAsync(ctx.db, "credentials", input.name, input.id);
 
       const emailDirty = input.email && user.email !== input.email;