fix: check that user IDs are not in use in user create (#23705)

tenant/error_user.go

@@ -46,6 +46,15 @@ func UserAlreadyExistsError(n string) *errors.Error {
 	}
 }
 
+// UserIDAlreadyExistsError is used when attempting to create a user with an ID
+// that already exists.
+func UserIDAlreadyExistsError(id string) *errors.Error {
+	return &errors.Error{
+		Code: errors.EConflict,
+		Msg:  fmt.Sprintf("user with ID %s already exists", id),
+	}
+}
+
 // UnexpectedUserBucketError is used when the error comes from an internal system.
 func UnexpectedUserBucketError(err error) *errors.Error {
 	return &errors.Error{

tenant/storage_user.go

@@ -34,7 +34,7 @@ func marshalUser(u *influxdb.User) ([]byte, error) {
 	return v, nil
 }
 
-func (s *Store) uniqueUserName(ctx context.Context, tx kv.Tx, uname string) error {
+func (s *Store) uniqueUserName(tx kv.Tx, uname string) error {
 
 	idx, err := tx.Bucket(userIndex)
 	if err != nil {
@@ -56,6 +56,26 @@ func (s *Store) uniqueUserName(ctx context.Context, tx kv.Tx, uname string) erro
 	return ErrUnprocessableUser(err)
 }
 
+func (s *Store) uniqueUserID(tx kv.Tx, id platform.ID) error {
+	encodedID, _ := id.Encode()
+
+	b, err := tx.Bucket(userBucket)
+	if err != nil {
+		return err
+	}
+
+	_, err = b.Get(encodedID)
+	if kv.IsNotFound(err) {
+		return nil
+	}
+
+	if err == nil {
+		return UserIDAlreadyExistsError(id.String())
+	}
+
+	return ErrUnprocessableUser(err)
+}
+
 func (s *Store) GetUser(ctx context.Context, tx kv.Tx, id platform.ID) (*influxdb.User, error) {
 	encodedID, err := id.Encode()
 	if err != nil {
@@ -170,7 +190,11 @@ func (s *Store) CreateUser(ctx context.Context, tx kv.Tx, u *influxdb.User) erro
 		return InvalidUserIDError(err)
 	}
 
-	if err := s.uniqueUserName(ctx, tx, u.Name); err != nil {
+	// Verify that both the provided username and user ID are not already in-use
+	if err := s.uniqueUserName(tx, u.Name); err != nil {
+		return err
+	}
+	if err := s.uniqueUserID(tx, u.ID); err != nil {
 		return err
 	}
 
@@ -212,7 +236,7 @@ func (s *Store) UpdateUser(ctx context.Context, tx kv.Tx, id platform.ID, upd in
 	}
 
 	if upd.Name != nil && *upd.Name != u.Name {
-		if err := s.uniqueUserName(ctx, tx, *upd.Name); err != nil {
+		if err := s.uniqueUserName(tx, *upd.Name); err != nil {
 			return nil, err
 		}
 

tenant/storage_user_test.go

@@ -57,6 +57,24 @@ func TestUser(t *testing.T) {
 				if !reflect.DeepEqual(users, expected) {
 					t.Fatalf("expected identical users: \n%+v\n%+v", users, expected)
 				}
+
+				// Test that identical name causes an error
+				err = store.CreateUser(context.Background(), tx, &influxdb.User{
+					ID:   platform.ID(11), // Unique ID
+					Name: "user1",         // Non-unique name
+				})
+				if err == nil {
+					t.Fatal("expected error on creating user with identical username")
+				}
+
+				// Test that identical ID causes an error
+				err = store.CreateUser(context.Background(), tx, &influxdb.User{
+					ID:   platform.ID(1), // Non-unique ID
+					Name: "user11",       // Unique name
+				})
+				if err == nil {
+					t.Fatal("expected error on creating user with identical ID")
+				}
 			},
 		},
 		{