Summary
A project identifier has no uniqueness or format enforcement, so two projects in one workspace can share an identifier and issue keys like "ENG-1" become ambiguous.
Where
internal/service/project.go Create only checks len(identifier) <= 7. There's no uniqueness check and no normalization/trim, and projects.identifier is VARCHAR(12) with no unique index (the unique index lives on a separate project_identifiers table that this code never writes to). Update is likewise unchecked; empty identifiers are allowed.
Impact
Two projects can both use "ENG". Since issue keys are identifier-sequence and sequence is per-project, "ENG-1" is ambiguous, and GetByWorkspaceAndIdentifier (UPPER(...) ... First) returns whichever row it hits first, so deep links / GitHub ref resolution can land on the wrong project's issue.
Suggested fix
Enforce a format (uppercase alphanumeric, trimmed, non-empty, length bound) and uniqueness per workspace on create and update, ideally backed by a real unique constraint on projects(workspace_id, identifier).
Summary
A project identifier has no uniqueness or format enforcement, so two projects in one workspace can share an identifier and issue keys like "ENG-1" become ambiguous.
Where
internal/service/project.goCreateonly checkslen(identifier) <= 7. There's no uniqueness check and no normalization/trim, andprojects.identifierisVARCHAR(12)with no unique index (the unique index lives on a separateproject_identifierstable that this code never writes to).Updateis likewise unchecked; empty identifiers are allowed.Impact
Two projects can both use "ENG". Since issue keys are
identifier-sequenceand sequence is per-project, "ENG-1" is ambiguous, andGetByWorkspaceAndIdentifier(UPPER(...) ... First) returns whichever row it hits first, so deep links / GitHub ref resolution can land on the wrong project's issue.Suggested fix
Enforce a format (uppercase alphanumeric, trimmed, non-empty, length bound) and uniqueness per workspace on create and update, ideally backed by a real unique constraint on
projects(workspace_id, identifier).