From 3bc38bf1a6c1f9d748560801daa928552602e7e2 Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Mon, 15 Jun 2026 16:14:39 -0400 Subject: [PATCH] fix(12): WR-01 delete orphaned user row on re-select 503 path in /credential After $returningId() insert, if the re-select returns null the handler returned 503 without deleting the just-inserted user row, leaving an unclaimed admin row with no credential. Delete before returning 503 to mirror the cleanup already present in the catch block. Co-Authored-By: Claude Sonnet 4.6 --- apps/api/src/routes/setup.ts | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apps/api/src/routes/setup.ts b/apps/api/src/routes/setup.ts index a7c8380..633fcb6 100644 --- a/apps/api/src/routes/setup.ts +++ b/apps/api/src/routes/setup.ts @@ -275,6 +275,9 @@ setupRouter.post('/credential', zValidator('json', credentialSchema, noEchoHook) .limit(1); if (!localUser) { + // Clean up the just-inserted user row to avoid an orphaned unclaimed admin + // (WR-01: the catch block below does not cover this early-return path). + await db.delete(users).where(eq(users.id, inserted.id)); return c.json({ error: 'Service unavailable' }, 503); }