fix(creds): glitch allowing multiple credentials in an integration

[icecrasher321]

Summary

Glitch allowing multiple credentials in an integration

Type of Change

• Bug fix

Testing

Tested manually.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Dec 10, 2025 5:00am

[greptile-apps]

Greptile Overview

Greptile Summary

Fixed a critical race condition that allowed multiple credentials for the same user-provider-account combination to be stored in the database.

Key Changes:

• Added unique database constraint on (user_id, provider_id, account_id) to enforce one credential per integration at the database level
• Migration removes existing duplicate credentials, keeping the most recently updated one
• Implemented safeAccountInsert helper to gracefully handle constraint violations during race conditions
• Added database hook in better-auth to check for duplicates before creation and update existing accounts instead
• Updated Shopify and Trello OAuth routes to use the new safe insert pattern

Impact:
The fix prevents data integrity issues by ensuring users cannot have multiple credentials for the same provider account, which could cause unpredictable behavior when retrieving tokens.

Confidence Score: 4/5

• This PR is safe to merge with one minor improvement suggested
• The fix addresses a real data integrity issue with a multi-layered approach (database constraint + application logic). The migration safely removes duplicates, and the code changes are well-implemented. One style suggestion about logging level.
• No files require special attention - all changes are straightforward and well-implemented

Important Files Changed

File Analysis

Filename	Score	Overview
packages/db/migrations/0120_illegal_moon_knight.sql	5/5	Added database migration to remove duplicate credentials and enforce unique constraint on (user_id, provider_id, account_id)
packages/db/schema.ts	5/5	Added unique index account_user_provider_account_unique to prevent duplicate credentials per user-provider-account combination
apps/sim/app/api/auth/oauth/utils.ts	4/5	Added safeAccountInsert helper that catches unique constraint violations (error code 23505) to prevent insertion failures during race conditions
apps/sim/lib/auth/auth.ts	5/5	Added database hook to check for duplicate accounts before creation, updates existing account instead of creating duplicate
apps/sim/app/api/auth/oauth2/shopify/store/route.ts	5/5	Replaced direct insert with safeAccountInsert to handle duplicate credentials gracefully during Shopify OAuth flow
apps/sim/app/api/auth/trello/store/route.ts	5/5	Replaced direct insert with safeAccountInsert to handle duplicate credentials gracefully during Trello OAuth flow

Sequence Diagram

sequenceDiagram
    participant User
    participant OAuthRoute as OAuth Route<br/>(Shopify/Trello)
    participant safeAccountInsert
    participant Database
    participant AuthHook as Auth Database Hook

    User->>OAuthRoute: Complete OAuth flow
    OAuthRoute->>Database: Check for existing account
    alt Account exists
        OAuthRoute->>Database: Update existing account
        Database-->>OAuthRoute: Success
    else No existing account
        OAuthRoute->>safeAccountInsert: Insert new account
        safeAccountInsert->>Database: INSERT account
        alt No duplicate (normal case)
            Database-->>safeAccountInsert: Success
            safeAccountInsert-->>OAuthRoute: Success
        else Duplicate constraint violation (23505)
            Database-->>safeAccountInsert: Error 23505
            safeAccountInsert->>safeAccountInsert: Log warning
            safeAccountInsert-->>OAuthRoute: Success (silent)
        end
    end
    
    Note over AuthHook,Database: Separate flow via better-auth
    User->>AuthHook: OAuth via better-auth
    AuthHook->>Database: Check for duplicate
    alt Duplicate found
        AuthHook->>Database: Update existing account
        AuthHook-->>User: Return false (skip create)
    else No duplicate
        AuthHook->>Database: Create new account
        AuthHook-->>User: Success
    end

Loading

[greptile-apps]

_{8 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}