fix(hub): a username is unique whatever its case

Registration refuses a name that differs from an existing one only by case;
accounts that already do keep their names, and a pending retry needs the exact
name (F-26).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 10 insertions, 4 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index fb53076..9326bfb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -185,12 +185,18 @@ async def register(
 ):
     eh = hash_email_blind(body.email)
 
-    existing = await db.execute(
-        select(User).where(User.username == body.username))
-    found = existing.scalar_one_or_none()
+    # Unique regardless of case: invitations and member management name people
+    # by username, and "Alice" beside "alice" is one person to whoever reads it.
+    # Accounts that already differ only by case (made before this) keep their
+    # names; the exact match is the one a retry means.
+    same = (await db.execute(
+        select(User).where(func.lower(User.username) == body.username.lower())
+    )).scalars().all()
+    found = next((u for u in same if u.username == body.username), same[0] if same else None)
 
     if found:
-        if found.status == "pending" and found.email_hash == eh:
+        if (found.username == body.username and found.status == "pending"
+                and found.email_hash == eh):
             # Same person retrying before validation — resend a code.
             # No captcha: the initial registration already passed it.
             #