fix(account): enforce unique GitHub links

messages/en.json

@@ -1297,6 +1297,7 @@
   "github-username-confirm-description": "Is this the GitHub profile you want to use?",
   "github-username-dialog-description": "Enter your GitHub username and we will verify the profile before saving it.",
   "github-username-error-invalid_username": "Enter a valid GitHub username.",
+  "github-username-error-already_linked": "This GitHub account is already linked to another Capgo account.",
   "github-username-error-not_found": "We could not find that GitHub profile.",
   "github-username-error-rate_limited": "GitHub is temporarily rate limited. Please try again later.",
   "github-username-error-request_failed": "We could not load that GitHub profile. Please try again.",

scripts/ops/users_github_id_unique_index.sql

@@ -0,0 +1,10 @@
+-- Required pre-deploy step: build the GitHub identity index without blocking writes.
+-- Run the SINGLE statement below alone in SQL Editor (or psql). Do not mix it
+-- with other statements in one Editor run if the Editor wraps a transaction:
+-- CREATE INDEX CONCURRENTLY cannot run in a transaction.
+--
+-- Example (psql):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f scripts/ops/users_github_id_unique_index.sql
+
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS users_github_id_key
+  ON public.users (github_id);

src/pages/settings/account/index.vue

@@ -16,7 +16,7 @@ import iconFlag from '~icons/heroicons/flag?raw'
 import iconName from '~icons/heroicons/user?raw'
 import { getRecentEmailOtpVerification } from '~/services/emailOtp'
 import { getFormatLocaleOptions, resolveFormatLocale } from '~/services/formatLocale'
-import { getGitHubProfile, GitHubProfileError } from '~/services/githubProfile'
+import { getGitHubProfile, GitHubProfileError, isGitHubAccountAlreadyLinkedError } from '~/services/githubProfile'
 import { pickPhoto, takePhoto } from '~/services/photos'
 import { getCurrentPlanNameOrg, isPayingOrg, useSupabase } from '~/services/supabase'
 import { useDialogV2Store } from '~/stores/dialogv2'
@@ -131,7 +131,9 @@ async function confirmGitHubProfile() {
 
   if (error || !user) {
     githubProfile.value = null
-    githubProfileError.value = t('account-error')
+    githubProfileError.value = isGitHubAccountAlreadyLinkedError(error)
+      ? t('github-username-error-already_linked')
+      : t('account-error')
     return
   }
 

src/services/githubProfile.ts

@@ -15,6 +15,13 @@ export function normalizeGitHubUsername(username: string) {
   return username.trim()
 }
 
+export function isGitHubAccountAlreadyLinkedError(error: unknown): boolean {
+  return typeof error === 'object'
+    && error !== null
+    && 'code' in error
+    && error.code === '23505'
+}
+
 export async function getGitHubProfile(username: string): Promise<GitHubProfile> {
   const normalizedUsername = normalizeGitHubUsername(username)
   if (!/^(?:[a-z\d]|[a-z\d](?:[a-z\d]|-(?=[a-z\d])){0,37}[a-z\d])$/i.test(normalizedUsername))

supabase/migrations/20260802171300_enforce_unique_github_id.sql

@@ -0,0 +1,34 @@
+DO $$
+DECLARE
+  duplicate_github_id bigint;
+  duplicate_count bigint;
+BEGIN
+  SELECT github_id, COUNT(*)
+  INTO duplicate_github_id, duplicate_count
+  FROM public.users
+  WHERE github_id IS NOT NULL
+  GROUP BY github_id
+  HAVING COUNT(*) > 1
+  ORDER BY github_id
+  LIMIT 1;
+
+  IF duplicate_github_id IS NOT NULL THEN
+    RAISE EXCEPTION
+      'Cannot enforce unique GitHub account links: github_id % is linked to % users',
+      duplicate_github_id,
+      duplicate_count;
+  END IF;
+END
+$$;
+
+-- Production operators must prebuild this index concurrently with
+-- scripts/ops/users_github_id_unique_index.sql before applying the migration.
+-- The fallback keeps fresh local/test databases self-contained; on production
+-- CREATE INDEX IF NOT EXISTS is a no-op, and the constraint attachment below
+-- only holds the table lock briefly.
+CREATE UNIQUE INDEX IF NOT EXISTS users_github_id_key
+ON public.users (github_id);
+
+ALTER TABLE public.users
+ADD CONSTRAINT users_github_id_key
+UNIQUE USING INDEX users_github_id_key;

supabase/tests/65_test_github_user_id.sql

@@ -1,6 +1,31 @@
 BEGIN;
 
-SELECT plan(3);
+SELECT plan(8);
+
+SELECT tests.create_supabase_user(
+  'github_id_unique_first',
+  'github_id_unique_first@test.local'
+);
+SELECT tests.create_supabase_user(
+  'github_id_unique_second',
+  'github_id_unique_second@test.local'
+);
+
+INSERT INTO public.users (id, email, created_at, updated_at)
+VALUES
+  (
+    tests.get_supabase_uid('github_id_unique_first'),
+    'github_id_unique_first@test.local',
+    NOW(),
+    NOW()
+  ),
+  (
+    tests.get_supabase_uid('github_id_unique_second'),
+    'github_id_unique_second@test.local',
+    NOW(),
+    NOW()
+  )
+ON CONFLICT (id) DO NOTHING;
 
 SELECT ok(
   EXISTS (
@@ -37,6 +62,70 @@ SELECT is(
   'users.github_id is nullable'
 );
 
+SELECT is(
+  (
+    SELECT contype::text
+    FROM pg_constraint
+    WHERE conrelid = 'public.users'::regclass
+      AND conname = 'users_github_id_key'
+  ),
+  'u',
+  'users.github_id has the named unique constraint'
+);
+
+UPDATE public.users
+SET github_id = 123456789
+WHERE id = tests.get_supabase_uid('github_id_unique_first');
+
+SELECT throws_ok(
+  $$
+    UPDATE public.users
+    SET github_id = 123456789
+    WHERE id = tests.get_supabase_uid('github_id_unique_second');
+  $$,
+  '23505',
+  'duplicate key value violates unique constraint "users_github_id_key"',
+  'different users cannot save the same non-null GitHub ID'
+);
+
+SELECT lives_ok(
+  $$
+    UPDATE public.users
+    SET github_id = NULL
+    WHERE id IN (
+      tests.get_supabase_uid('github_id_unique_first'),
+      tests.get_supabase_uid('github_id_unique_second')
+    );
+  $$,
+  'multiple users may have a null GitHub ID'
+);
+
+UPDATE public.users
+SET github_id = 123456789
+WHERE id = tests.get_supabase_uid('github_id_unique_first');
+
+SELECT lives_ok(
+  $$
+    UPDATE public.users
+    SET github_id = 123456789
+    WHERE id = tests.get_supabase_uid('github_id_unique_first');
+  $$,
+  'a user may re-save their own GitHub ID'
+);
+
+SELECT lives_ok(
+  $$
+    UPDATE public.users
+    SET github_id = NULL
+    WHERE id = tests.get_supabase_uid('github_id_unique_first');
+
+    UPDATE public.users
+    SET github_id = 123456789
+    WHERE id = tests.get_supabase_uid('github_id_unique_second');
+  $$,
+  'clearing a GitHub link lets another user claim that ID'
+);
+
 SELECT * FROM finish(); -- noqa: AM04
 
 ROLLBACK;

tests/github-profile.unit.test.ts

@@ -1,6 +1,6 @@
 import type { GitHubProfileError } from '../src/services/githubProfile'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { getGitHubProfile, normalizeGitHubUsername } from '../src/services/githubProfile'
+import { getGitHubProfile, isGitHubAccountAlreadyLinkedError, normalizeGitHubUsername } from '../src/services/githubProfile'
 
 const originalFetch = globalThis.fetch
 
@@ -9,6 +9,19 @@ afterEach(() => {
 })
 
 describe('github profile lookup', () => {
+  it('recognizes a PostgREST unique violation as an already-linked GitHub account', () => {
+    expect(isGitHubAccountAlreadyLinkedError({ code: '23505' })).toBe(true)
+  })
+
+  it('does not treat malformed or unrelated errors as an already-linked GitHub account', () => {
+    expect(isGitHubAccountAlreadyLinkedError(null)).toBe(false)
+    expect(isGitHubAccountAlreadyLinkedError(undefined)).toBe(false)
+    expect(isGitHubAccountAlreadyLinkedError('23505')).toBe(false)
+    expect(isGitHubAccountAlreadyLinkedError({})).toBe(false)
+    expect(isGitHubAccountAlreadyLinkedError({ code: 23505 })).toBe(false)
+    expect(isGitHubAccountAlreadyLinkedError({ code: '42501' })).toBe(false)
+  })
+
   it('normalizes the entered username and requests the public GitHub API', async () => {
     const fetchMock = vi.fn().mockResolvedValue(new Response(JSON.stringify({
       id: 42,