fix(codex-auth): scope duplicate checks by plan bucket

Author: lidge-jun

devlog/_plan/260624_codex-multi-auth-security-implementation/40_phase40-manual-import-disable.md

@@ -219,7 +219,7 @@ Required imports:
 Assertions:
 
 - `checkAccountIdCollision("shared-team-account", "member-b@example.test")` returns no collision when an existing pool account has the same ChatGPT account id but a different email;
-- Correction 2026-06-27: `checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test")` also returns no collision. ChatGPT account id plus email is not an authoritative duplicate key because one user can legitimately hold both personal and business subscriptions. Duplicate prevention remains scoped to local alias checks and exact OAuth refresh-grant fingerprint matches.
+- Correction 2026-06-27: `checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test", "business")` returns no collision when the existing account is personal. Personal and workspace subscriptions are separate duplicate buckets because one user can legitimately hold both. Within the same bucket, the existing ChatGPT account id plus normalized email collision guard still applies.
 
 ### MODIFY `src/codex-auth-api.ts` OAuth wording
 

src/codex-auth-api.ts

@@ -214,9 +214,9 @@ export async function handleCodexAuthAPI(
     if (accounts.some(a => a.id === body.id) || getCodexAccountCredential(body.id)) {
       return jsonResponse({ error: `Account id already exists: ${body.id}` }, 400);
     }
-    // 1.1: Duplicate check uses local alias plus exact credential material, not account identity.
+    // 1.1: Duplicate check is scoped by personal vs workspace plan bucket.
     const derivedAccountId = extractAccountId(undefined, body.accessToken) ?? body.chatgptAccountId;
-    const collision = checkAccountIdCollision(derivedAccountId, body.email, body.refreshToken);
+    const collision = checkAccountIdCollision(derivedAccountId, body.email, body.plan);
     if (collision.collision) {
       return jsonResponse({ error: collision.reason }, 400);
     }
@@ -414,7 +414,6 @@ export async function handleCodexAuthAPI(
             const { getCredential } = await import("./oauth/store");
             const cred = getCredential("chatgpt");
             if (cred) {
-              // 1.2: Duplicate check uses local alias plus exact credential material, not account identity.
               const oauthAccountId = cred.accountId;
               if (!oauthAccountId) {
                 codexAuthLoginState.set(flowId, {
@@ -425,14 +424,6 @@ export async function handleCodexAuthAPI(
                 completed = true;
                 break;
               }
-              const collision = checkAccountIdCollision(oauthAccountId, cred.email, cred.refresh);
-              if (collision.collision) {
-                codexAuthLoginState.set(flowId, {
-                  status: "error", error: collision.reason, doneAt: Date.now(),
-                });
-                completed = true;
-                break;
-              }
 
               let email = cred.email || accountId;
               let plan: string | undefined;
@@ -450,6 +441,15 @@ export async function handleCodexAuthAPI(
                   quota = parseUsageQuota(data);
                 }
               } catch { /* wham fetch is non-blocking */ }
+              // 1.2: Duplicate check is scoped by personal vs workspace plan bucket.
+              const collision = checkAccountIdCollision(oauthAccountId, email, plan);
+              if (collision.collision) {
+                codexAuthLoginState.set(flowId, {
+                  status: "error", error: collision.reason, doneAt: Date.now(),
+                });
+                completed = true;
+                break;
+              }
 
               saveCodexAccountCredential(accountId, {
                 accessToken: cred.access,

src/codex-auth-collision.ts

@@ -1,7 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import os from "node:os";
-import { loadCodexAccountStore, refreshGrantFingerprintForToken } from "./codex-account-store";
+import { getCodexAccountCredential } from "./codex-account-store";
+import { loadConfig } from "./config";
 import { extractAccountId } from "./oauth/chatgpt";
 
 export function readCodexTokens(): { access_token: string; account_id: string; id_token?: string } | null {
@@ -27,19 +28,31 @@ export function getMainChatgptAccountId(): string | null {
   return extractAccountId(tokens.id_token, tokens.access_token) ?? (tokens.account_id || null);
 }
 
-// ChatGPT account ids and emails are not authoritative duplicate keys:
-// one user can legitimately hold both personal and business subscriptions.
-// Only the local alias and exact OAuth grant material are duplicate keys.
+function normalizedEmail(email: string | undefined | null): string | null {
+  const trimmed = email?.trim().toLowerCase();
+  return trimmed || null;
+}
+
+function isWorkspacePlan(plan: string | undefined | null): boolean {
+  return !!plan && /team|business|enterprise|workspace|edu/i.test(plan);
+}
+
+// Personal and workspace subscriptions are separate duplicate buckets.
+// Within each bucket, keep the original ChatGPT account id + email collision guard.
 export function checkAccountIdCollision(
-  _chatgptAccountId: string,
-  _email?: string | null,
-  refreshToken?: string | null,
+  chatgptAccountId: string,
+  email?: string | null,
+  plan?: string | null,
 ): { collision: true; reason: string } | { collision: false } {
-  if (!refreshToken) return { collision: false };
-  const candidateFingerprint = refreshGrantFingerprintForToken(refreshToken);
-  for (const [poolId, cred] of Object.entries(loadCodexAccountStore())) {
-    if (refreshGrantFingerprintForToken(cred.refreshToken) === candidateFingerprint) {
-      return { collision: true, reason: `Credential is already in the pool (${poolId}).` };
+  const candidateEmail = normalizedEmail(email);
+  const candidateWorkspace = isWorkspacePlan(plan);
+  for (const account of loadConfig().codexAccounts ?? []) {
+    if (account.isMain) continue;
+    if (isWorkspacePlan(account.plan) !== candidateWorkspace) continue;
+    const cred = getCodexAccountCredential(account.id);
+    const poolEmail = normalizedEmail(account.email);
+    if (cred && cred.chatgptAccountId === chatgptAccountId && (!candidateEmail || !poolEmail || poolEmail === candidateEmail)) {
+      return { collision: true, reason: `Account is already in the pool (${account.id}).` };
     }
   }
   return { collision: false };

tests/codex-auth-collision.test.ts

@@ -28,12 +28,12 @@ afterEach(() => {
   if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
 });
 
-function seedAccount(id: string, email: string, chatgptAccountId: string): OcxConfig {
+function seedAccount(id: string, email: string, chatgptAccountId: string, plan?: string): OcxConfig {
   const config: OcxConfig = {
     port: 10100,
     providers: {},
     defaultProvider: "openai",
-    codexAccounts: [{ id, email, isMain: false }],
+    codexAccounts: [{ id, email, plan, isMain: false }],
   };
   saveConfig(config);
   saveCodexAccountCredential(id, {
@@ -57,18 +57,28 @@ describe("codex auth account collision", () => {
   test("allows the same email and account id because personal and business subscriptions can coexist", async () => {
     seedAccount("team-member-a", "member-a@example.test", "shared-team-account");
 
-    expect(checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test", "refresh-personal-business")).toEqual({
+    expect(checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test", "business")).toEqual({
       collision: false,
     });
   });
 
-  test("rejects the exact same refresh grant under a different alias", async () => {
+  test("rejects the same personal account within the personal bucket", async () => {
     seedAccount("team-member-a", "member-a@example.test", "shared-team-account");
 
-    const result = checkAccountIdCollision("different-account-id", "other@example.test", "refresh-team-member-a");
+    const result = checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test");
     expect(result.collision).toBe(true);
     if (result.collision) {
-      expect(result.reason).toContain("Credential is already in the pool");
+      expect(result.reason).toContain("Account is already in the pool");
+    }
+  });
+
+  test("rejects the same workspace account within the workspace bucket", async () => {
+    seedAccount("workspace-a", "member-a@example.test", "shared-team-account", "team");
+
+    const result = checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test", "business");
+    expect(result.collision).toBe(true);
+    if (result.collision) {
+      expect(result.reason).toContain("Account is already in the pool");
     }
   });
 });