ZacharyZcR e610aba0e5 fix: enforce unique usernames (#1628) ...

* fix: enforce unique usernames

Registration checked for a taken name, hashed the password, then
inserted, with nothing in the schema enforcing uniqueness. Concurrent
sign-ups could create two accounts with one name, after which login,
password reset, proxy login and admin lookups by username picked
between them arbitrarily.

Add a unique index on users.username for every dialect. Existing
duplicates are renamed (later rows get a -<id> suffix, the oldest keeps
the name) rather than deleted. Registration and admin user creation now
return the same 409 when the insert loses the race.

* fix: avoid username collisions during migration

2026-10-14 08:17:47 +08:00

..

mysql

fix: enforce unique usernames (#1628)

2026-10-14 08:17:47 +08:00

postgres

fix: enforce unique usernames (#1628)

2026-10-14 08:17:47 +08:00

sqlite

fix: enforce unique usernames (#1628)

2026-10-14 08:17:47 +08:00