samu/record-shop
1
0
Fork 0
Code Issues Activity

fix: map duplicate-username race to 409 and test session/cascade behavior

Browse Source
This commit is contained in:
Samuel
2026-08-29 15:46:34 +02:00
parent 8bdbe292d5
commit 6dfaaf465d
2 changed files with 53 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
server/src/routes/authRoutes.ts
View File

@@ -80,7 +80,15 @@ export async function registerAuthRoutes(app: FastifyInstance): Promise<void> {
const { username, password } = (request.body ?? {}) as { username?: string; password?: string }
const invalid = validateCredentials(username, password)
if (invalid) return reply.code(400).send({ error: 'invalid_input', detail: invalid })
const user = createUser(request.server.db, username as string, await hashPassword(password as string), true)
let user
try {
user = createUser(request.server.db, username as string, await hashPassword(password as string), true)
} catch (err: any) {
if (String(err.message).includes('UNIQUE constraint failed')) {
return reply.code(403).send({ error: 'setup_already_done' })
}
throw err
}
request.server.db.prepare('INSERT INTO settings (user_id) VALUES (?)').run(user.id)
const token = createSession(request.server.db, user.id)
return reply.setCookie(COOKIE_NAME, token, cookieOpts()).code(200).send({ user: toPublicUser(user) })
@@ -122,7 +130,15 @@ export async function registerAuthRoutes(app: FastifyInstance): Promise<void> {
if (getUserByUsername(request.server.db, username as string)) {
return reply.code(409).send({ error: 'username_taken' })
}
const user = createUser(request.server.db, username as string, await hashPassword(password as string), false)
let user
try {
user = createUser(request.server.db, username as string, await hashPassword(password as string), false)
} catch (err: any) {
if (String(err.message).includes('UNIQUE constraint failed')) {
return reply.code(409).send({ error: 'username_taken' })
}
throw err
}
request.server.db.prepare('INSERT INTO settings (user_id) VALUES (?)').run(user.id)
return reply.code(200).send(toPublicUser(user))
})