- Notifications
You must be signed in to change notification settings - Fork928
Closed
Description
OS Information
coder --version
: dev.coder.com -Coder v0.0.0-devel+680de70
Steps to Reproduce
- Login with Github
- Go to user preferences and update email to something garbage -
canichangethis@coder.com
- Sign out
- Sign in with Github again - get error:
{"message":"create user: execute transaction: create user: pq: duplicate key value violates unique constraint \"idx_users_username\""}
Expected
If we allow email changes it should not lock the user out and break the user account.
Actual
The user is locked out and cannot log back in.
Logs
Screenshot
Notes
It seems like we need a good bit more guardrails and validation around this flow, we should not be able to collide on username or email when dealing with oauth.