Repository navigation
fix(db): keep both web-cookie accounts when a typed connection name is reused (#15070) - #15844
Merged
diegosouzapw merged 2 commits intoOct 8, 2026
Merged
Conversation
…s reused (#15070) The apikey name-based upsert replaced account A's session with account B's whenever two web-cookie provider accounts shared a connection name. Skip the name upsert for WEB_COOKIE_PROVIDERS; the credential-value dedup still collapses the same session re-added.
3 tasks
Contributor
CI Coverage Report
Coverage artifact was not available for this run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #15070
Owner decision (2026-10-06): keep both accounts, no 409 — aligned with the cookie path fixed in #15290 (#15159 B-01).
Root cause
The dashboard single-add modal posts
authType: apikeyfor web-cookie providers.createProviderConnection's apikey branch did a name-based upsert first, so a second account typed under an already-used name replaced the first account's stored session.Fix
Skip the apikey name-upsert for providers in
WEB_COOKIE_PROVIDERS(newisWebCookieProviderIdinsrc/lib/db/webSessionDedup.ts). The credential-value dedup (#3023) still collapses the same session re-added; ordinary apikey providers keep the name upsert (#2587/#3023).Regression test
tests/unit/db-provider-apikey-name-overwrite-15070.test.ts(3 cases: web-cookie same name + different session keeps both; same session re-added dedups; ordinary provider keeps upsert).same name + different session keeps both accountsfails (only B_SESSION remained).Existing suites re-run green: db-provider-cookie-dedup-3368, db-provider-cookie-name-collision-15159, db-providers-crud, provider-connection-apikey-dedup, provider-connection-local-baseurl-dedup, web-session-dedup-3368.
Gates
typecheck:core, eslint (changed files), check-file-size (providers.ts held at its 1240 ceiling), prettier. complexity/cognitive violation counts for providers.ts unchanged vs base (measured per-file with the ratchet ESLint config; the full-repo scripts did not finish on the loaded devbox).