Skip to content

feat: prevent usernames colliding with known routes - #199

Open
robsimmons wants to merge 1 commit into
mainfrom
rename-usernames-at-creation
Open

robsimmons wants to merge 1 commit into
mainfrom
rename-usernames-at-creation

Conversation

@robsimmons

@robsimmons robsimmons commented Oct 28, 2026 •

Copy link
Copy Markdown
Collaborator

This PR does two things:

  • Adds isAvailableUsername, which allows us to reject already-existing or disallowed usernames. (This doesn't handle race conditions so we're still relying somewhat on the database-level constraint to avoid collision with existing usernames.)
  • Adds a retry mechanism findSuitableAlphaNumName that tries to find an acceptable name given a function that rejects unacceptable names. When there's a collision, removes any existing numeric postfix and tries to add postfixes starting with 1.

Closes #132.

@robsimmons
robsimmons changed the base branch from main to betterauth-1-7 October 28, 2026 20:47
Comment thread .gitignore Resolved
@robsimmons
robsimmons added this pull request to stack #201 October 28, 2026 20:50
@robsimmons robsimmons changed the title feat: rename conflicting usernames feat: prevent usernames colliding with known routes Oct 28, 2026
@robsimmons
robsimmons force-pushed the rename-usernames-at-creation branch from 1d6c3f9 to 0eafc3a Compare October 28, 2026 23:21
Base automatically changed from betterauth-1-7 to main October 28, 2026 23:22
@robsimmons
robsimmons force-pushed the rename-usernames-at-creation branch 3 times, most recently from 3952bf3 to b45f4e4 Compare October 29, 2026 21:07
@robsimmons
robsimmons removed this pull request from stack #201 October 30, 2026 12:18
@robsimmons
robsimmons force-pushed the rename-usernames-at-creation branch 2 times, most recently from 5633d29 to 18a6193 Compare October 30, 2026 12:23
@robsimmons
robsimmons changed the base branch from main to vitest-intro October 30, 2026 12:24
@robsimmons
robsimmons force-pushed the rename-usernames-at-creation branch from 18a6193 to 25ed6f4 Compare October 30, 2026 12:24
@robsimmons
robsimmons requested a review from Vtec234 October 30, 2026 12:25
@robsimmons
robsimmons force-pushed the rename-usernames-at-creation branch from 25ed6f4 to 7f75b20 Compare October 30, 2026 12:31
@robsimmons
robsimmons added this pull request to stack #206 October 30, 2026 12:31
@jcreedcmu
jcreedcmu self-requested a review October 30, 2026 20:34

@Vtec234 Vtec234 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this approach is quite weird. Normally when I attempt to register somewhere with an unavailable, or otherwise malformed, username, something in the UI tells me "this username is taken/forbidden/whatever, please provide another" and often also "here are some suggestions". Here, we approve the registration but just silently modify the username at the backend database layer?

@jcreedcmu

jcreedcmu commented Oct 30, 2026 •

Copy link
Copy Markdown
Collaborator

I had this reaction at first, too, and I'm still a little on the fence, to be honest.

My reason for changing my mind is that normally when I register somewhere, I'm always choosing the username, so it's pretty low friction to be told "that one doesn't work, pick another". Since we are currently automatically taking github id as workbench id, that makes things feel a bit different, but if you want to make the argument that providing an explicit interface for the user to make a choice in the (I expect quite marginal and rare!) case where there's a collsision, maybe we should go that way after all...

@robsimmons
robsimmons force-pushed the rename-usernames-at-creation branch from 7f75b20 to 359caf7 Compare October 31, 2026 15:57
Base automatically changed from vitest-intro to main October 31, 2026 15:58
@robsimmons
robsimmons force-pushed the rename-usernames-at-creation branch from 359caf7 to e68d9b3 Compare October 31, 2026 15:58
@robsimmons

Copy link
Copy Markdown
Collaborator Author

In all cases where the user is picking a name I definitely want to use the isAvailableUsername function directly to eliminate registered/disallowed usernames. The findSuitableAlphaNumName logic, while admittedly hairy, is intended to eliminate first-login friction: log in with github, you should have a username that is either your github username or something plausibly derived from the same without any additional interaction.

@robsimmons
robsimmons force-pushed the rename-usernames-at-creation branch from e68d9b3 to 4382d71 Compare November 1, 2026 20:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Deal with name collisions

3 participants