fix(auth): make JIT provisioning idempotent under concurrent first-login

On a user's first login the authed shell fires several API calls at once; each ran the JIT-provision path and raced to INSERT the same new user row, tripping the partial unique index on auth_subject. The losing requests 500'd and the post-login SSR errored out. Use INSERT ... ON CONFLICT (auth_subject) DO UPDATE ... RETURNING so concurrent callers converge on the row the winner created. Regenerated the .sqlx offline query cache. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-06-15 03:25:31 -07:00
parent 6823147334
commit 6071e1fd61
3 changed files with 46 additions and 24 deletions
@@ -0,0 +1,33 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO users (id, workspace_id, email, role, display_name, auth_subject)\n             VALUES ($1, $2, $3, $4, $5, $6)\n             ON CONFLICT (auth_subject) WHERE auth_subject IS NOT NULL\n             DO UPDATE SET role = EXCLUDED.role\n             RETURNING id, workspace_id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "workspace_id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid",
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "3b52f6b5c493c72e79a88d223acafa4f02c582a9293ad2f72782e60136e6c287"
+}