[Extension of Bug #27] Duplicate username handling may invalidate the existing username/profile

While testing the username update functionality, I noticed a potentially serious issue with username ownership. The system automatically appends a sequence number when a username already exists. However, during testing, I observed that the original username can subsequently become unavailable and its profile URL returns a 404. This raises a concern about what happens if an existing user already owns a username and another user attempts to claim the same username. Steps to Reproduce [What actually happened with my username]: - Have an existing user with the username dharm-qa. - From the settings, attempt to set the username to dharm-qa again. - The system changes the username to dharm-qa-2. - Try accessing the original username URL: /members/dharm-qa - The URL returns a 404. Actual Result: The original username/profile URL becomes unavailable and returns 404. In my case, this happened accidentally because I attempted to update my own username to a value that was already associated with my account. Concern / Potential Impact: The more important scenario to investigate is: - What happens if User A already owns dharm-qa, and User B attempts to claim dharm-qa? - The system appears to handle the duplicate by appending a sequence number, but the behavior observed during testing raises a concern that the original username may become unavailable or disconnected from the existing user's profile. If this behavior can occur for a genuinely existing username, it could potentially result in: - The original user's profile URL returning 404. - The original username becoming unavailable. - Existing links to the user's profile becoming invalid. - Potential issues with account/profile identification. - In the worst case, the existing user potentially being unable to access their account if username is involved in the authentication/identity lookup. The account-login impact needs to be specifically verified. Expected Result: A username that is already owned by an existing user should remain permanently associated with that user's account unless the user explicitly changes/releases it. When another user attempts to claim the same username, the system should: - Clearly indicate that the username is already taken. - Prevent the existing username from being reassigned or invalidated. - Keep the original user's profile and account association intact. - Ensure the original user can continue accessing their account normally. Suggested Investigation: Please verify the following scenario: User A: dharm-qa User B: attempts to claim dharm-qa After User B's attempt, verify that: - User A's username remains dharm-qa. - User A's profile URL remains accessible. - User A can still log in successfully. - User B receives an appropriate "username already taken" response. dharm-qa cannot be silently reassigned or invalidated. Severity: High / Needs Investigation The currently observed 404 is concerning, but the severity should be confirmed based on the outcome of the User A/User B scenario. If an existing user's account or login can actually be affected, this should be treated as a high-severity account integrity issue.

Last updated Aug 25, 2026