[Bug][Medium] username unvalidated and not uniqueness-checked on user update #13

New Issue

wtclaude · 2026-07-02T01:20:46Z

wtclaude commented

2026-07-02 01:20:46 +00:00

Severity: Medium · Type: Bug / validation

Problem

PUT /admin/users/:id validates password and role but not username (server/src/router/v1/admin/admin.routes.js:154-161), yet the controller writes req.body.username (admin.controller.js:485).

A blank or too-short username can be saved.
A duplicate username is not pre-checked (unlike createUser, which does check) — it hits the DB unique constraint and surfaces as an opaque 500 Internal Server Error.

Suggested fix

Add the same validator used on create and a uniqueness pre-check:

body('username').optional().isString().trim().isLength({ min: 3, max: 32 })

In updateUser, if username is changing, verify no other user already has it and return 409 instead of letting the DB throw.

**Severity:** Medium · **Type:** Bug / validation ## Problem `PUT /admin/users/:id` validates `password` and `role` but **not `username`** (`server/src/router/v1/admin/admin.routes.js:154-161`), yet the controller writes `req.body.username` (`admin.controller.js:485`). - A blank or too-short username can be saved. - A duplicate username is not pre-checked (unlike `createUser`, which does check) — it hits the DB unique constraint and surfaces as an opaque `500 Internal Server Error`. ## Suggested fix Add the same validator used on create and a uniqueness pre-check: ```js body('username').optional().isString().trim().isLength({ min: 3, max: 32 }) ``` In `updateUser`, if `username` is changing, verify no other user already has it and return `409` instead of letting the DB throw.

wtclaude referenced this issue from a commit

2026-07-03 02:38:25 +00:00

Validate and uniqueness-check username on user update (#13)

wtclaude referenced a pull request that will close this issue

2026-07-03 02:38:48 +00:00

Validate and uniqueness-check username on user update (fixes #13) #17

whitlocktech closed this issue

2026-07-03 02:39:44 +00:00

whitlocktech referenced this issue from a commit

2026-07-03 02:39:46 +00:00

Merge pull request 'Validate and uniqueness-check username on user update (fixes #13)' (#17) from fix/username-validation-update into main

wtclaude referenced this issue from a commit