From 7ca24786e8b42d18ccf58ed7b51bed158da75ab6 Mon Sep 17 00:00:00 2001
From: Niels Kaspers <kaspersniels@gmail.com>
Date: Wed, 8 Apr 2026 09:14:41 +0300
Subject: [PATCH] fix: make username login case-insensitive (#3981)

Normalize usernames to lowercase on lookup, creation, and update.
Also fix variable shadowing bug and same-user update check in
the user update endpoint.
---
 src/app/api/users/[userId]/route.ts | 6 +++---
 src/app/api/users/route.ts          | 2 +-
 src/queries/prisma/user.ts          | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/app/api/users/[userId]/route.ts b/src/app/api/users/[userId]/route.ts
index aade8aa8d..5814ebf14 100644
--- a/src/app/api/users/[userId]/route.ts
+++ b/src/app/api/users/[userId]/route.ts
@@ -59,14 +59,14 @@ export async function POST(request: Request, { params }: { params: Promise<{ use
   }
 
   if (username && auth.user.isAdmin) {
-    data.username = username;
+    data.username = username.toLowerCase();
   }
 
   // Check when username changes
   if (data.username && user.username !== data.username) {
-    const user = await getUserByUsername(username);
+    const existingUser = await getUserByUsername(data.username);
 
-    if (user) {
+    if (existingUser && existingUser.id !== userId) {
       return badRequest({ message: 'User already exists' });
     }
   }
diff --git a/src/app/api/users/route.ts b/src/app/api/users/route.ts
index dbb114cf7..271541707 100644
--- a/src/app/api/users/route.ts
+++ b/src/app/api/users/route.ts
@@ -35,7 +35,7 @@ export async function POST(request: Request) {
 
   const user = await createUser({
     id: id || uuid(),
-    username,
+    username: username.toLowerCase(),
     password: hashPassword(password),
     role: role ?? ROLES.user,
   });
diff --git a/src/queries/prisma/user.ts b/src/queries/prisma/user.ts
index 14376fc26..1403ef657 100644
--- a/src/queries/prisma/user.ts
+++ b/src/queries/prisma/user.ts
@@ -42,7 +42,7 @@ export async function getUser(userId: string, options: GetUserOptions = {}) {
 }
 
 export async function getUserByUsername(username: string, options: GetUserOptions = {}) {
-  return findUser({ where: { username } }, options);
+  return findUser({ where: { username: username.toLowerCase() } }, options);
 }
 
 export async function getUsers(criteria: UserFindManyArgs, filters: QueryFilters = {}) {