fix(hub): a username is unique whatever its case

Registration refuses a name that differs from an existing one only by case;
accounts that already do keep their names, and a pending retry needs the exact
name (F-26).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 34 insertions, 4 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index fb53076..9326bfb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -185,12 +185,18 @@ async def register(
 ):
     eh = hash_email_blind(body.email)
 
-    existing = await db.execute(
-        select(User).where(User.username == body.username))
-    found = existing.scalar_one_or_none()
+    # Unique regardless of case: invitations and member management name people
+    # by username, and "Alice" beside "alice" is one person to whoever reads it.
+    # Accounts that already differ only by case (made before this) keep their
+    # names; the exact match is the one a retry means.
+    same = (await db.execute(
+        select(User).where(func.lower(User.username) == body.username.lower())
+    )).scalars().all()
+    found = next((u for u in same if u.username == body.username), same[0] if same else None)
 
     if found:
-        if found.status == "pending" and found.email_hash == eh:
+        if (found.username == body.username and found.status == "pending"
+                and found.email_hash == eh):
             # Same person retrying before validation — resend a code.
             # No captcha: the initial registration already passed it.
             #
diff --git a/packages/meshbay-hub/tests/test_username_case.py b/packages/meshbay-hub/tests/test_username_case.py
new file mode 100644
index 0000000..42f4815
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_username_case.py
@@ -0,0 +1,24 @@
+"""
+A username is unique whatever its case.
+
+Invitations and member management name people by username, so "Alice" beside
+"alice" is one person to whoever reads the list — and a second account under
+the other spelling is the way to be mistaken for them.
+"""
+
+import pytest
+from test_bundle_pepper import KEY
+
+
+async def _register(client, username, email):
+    return await client.post("/v1/users/register", json={
+        "username": username, "auth_key": KEY, "email": email})
+
+
+@pytest.mark.asyncio
+async def test_a_name_differing_only_by_case_is_taken(client):
+    assert (await _register(client, "alice_case", "a1@example.invalid")).status_code == 201
+    for other in ("Alice_case", "ALICE_CASE", "alice_CASE"):
+        r = await _register(client, other, "a2@example.invalid")
+        assert r.status_code == 409, (other, r.text)
+