fix: enforce unique usernames (#1628)

Browse Source

* fix: enforce unique usernames

Registration checked for a taken name, hashed the password, then
inserted, with nothing in the schema enforcing uniqueness. Concurrent
sign-ups could create two accounts with one name, after which login,
password reset, proxy login and admin lookups by username picked
between them arbitrarily.

Add a unique index on users.username for every dialect. Existing
duplicates are renamed (later rows get a -<id> suffix, the oldest keeps
the name) rather than deleted. Registration and admin user creation now
return the same 409 when the insert loses the race.

* fix: avoid username collisions during migration

...

This commit is contained in:

ZacharyZcR authored and GitHub committed 2026-10-14 08:17:47 +08:00

1 parent 3941dd4ecc

commit e610aba0e5

19 files changed

+14354 -26

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

drizzle/sqlite/meta/0067_snapshot.json

+4466

File diff suppressed because it is too large. Load diff