fix(codex-auth): detect duplicate refresh grants

Author: lidge-jun

devlog/_plan/260624_codex-multi-auth-security-implementation/40_phase40-manual-import-disable.md

@@ -219,7 +219,7 @@ Required imports:
 Assertions:
 
 - `checkAccountIdCollision("shared-team-account", "member-b@example.test")` returns no collision when an existing pool account has the same ChatGPT account id but a different email;
-- Correction 2026-06-27: `checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test")` also returns no collision. ChatGPT account id plus email is not an authoritative duplicate key because one user can legitimately hold both personal and business subscriptions. Duplicate prevention remains scoped to local alias/credential lifecycle checks.
+- Correction 2026-06-27: `checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test")` also returns no collision. ChatGPT account id plus email is not an authoritative duplicate key because one user can legitimately hold both personal and business subscriptions. Duplicate prevention remains scoped to local alias checks and exact OAuth refresh-grant fingerprint matches.
 
 ### MODIFY `src/codex-auth-api.ts` OAuth wording
 

src/codex-auth-api.ts

@@ -214,9 +214,9 @@ export async function handleCodexAuthAPI(
     if (accounts.some(a => a.id === body.id) || getCodexAccountCredential(body.id)) {
       return jsonResponse({ error: `Account id already exists: ${body.id}` }, 400);
     }
-    // 1.1: JWT-derived account ID is authoritative; collision check
+    // 1.1: Duplicate check uses local alias plus exact credential material, not account identity.
     const derivedAccountId = extractAccountId(undefined, body.accessToken) ?? body.chatgptAccountId;
-    const collision = checkAccountIdCollision(derivedAccountId, body.email);
+    const collision = checkAccountIdCollision(derivedAccountId, body.email, body.refreshToken);
     if (collision.collision) {
       return jsonResponse({ error: collision.reason }, 400);
     }
@@ -414,7 +414,7 @@ export async function handleCodexAuthAPI(
             const { getCredential } = await import("./oauth/store");
             const cred = getCredential("chatgpt");
             if (cred) {
-              // 1.2: account-ID-based collision check (JWT-derived, not email)
+              // 1.2: Duplicate check uses local alias plus exact credential material, not account identity.
               const oauthAccountId = cred.accountId;
               if (!oauthAccountId) {
                 codexAuthLoginState.set(flowId, {
@@ -425,7 +425,7 @@ export async function handleCodexAuthAPI(
                 completed = true;
                 break;
               }
-              const collision = checkAccountIdCollision(oauthAccountId, cred.email);
+              const collision = checkAccountIdCollision(oauthAccountId, cred.email, cred.refresh);
               if (collision.collision) {
                 codexAuthLoginState.set(flowId, {
                   status: "error", error: collision.reason, doneAt: Date.now(),

src/codex-auth-collision.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import os from "node:os";
+import { loadCodexAccountStore, refreshGrantFingerprintForToken } from "./codex-account-store";
 import { extractAccountId } from "./oauth/chatgpt";
 
 export function readCodexTokens(): { access_token: string; account_id: string; id_token?: string } | null {
@@ -28,9 +29,18 @@ export function getMainChatgptAccountId(): string | null {
 
 // ChatGPT account ids and emails are not authoritative duplicate keys:
 // one user can legitimately hold both personal and business subscriptions.
+// Only the local alias and exact OAuth grant material are duplicate keys.
 export function checkAccountIdCollision(
   _chatgptAccountId: string,
   _email?: string | null,
+  refreshToken?: string | null,
 ): { collision: true; reason: string } | { collision: false } {
+  if (!refreshToken) return { collision: false };
+  const candidateFingerprint = refreshGrantFingerprintForToken(refreshToken);
+  for (const [poolId, cred] of Object.entries(loadCodexAccountStore())) {
+    if (refreshGrantFingerprintForToken(cred.refreshToken) === candidateFingerprint) {
+      return { collision: true, reason: `Credential is already in the pool (${poolId}).` };
+    }
+  }
   return { collision: false };
 }

tests/codex-auth-collision.test.ts

@@ -57,8 +57,18 @@ describe("codex auth account collision", () => {
   test("allows the same email and account id because personal and business subscriptions can coexist", async () => {
     seedAccount("team-member-a", "member-a@example.test", "shared-team-account");
 
-    expect(checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test")).toEqual({
+    expect(checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test", "refresh-personal-business")).toEqual({
       collision: false,
     });
   });
+
+  test("rejects the exact same refresh grant under a different alias", async () => {
+    seedAccount("team-member-a", "member-a@example.test", "shared-team-account");
+
+    const result = checkAccountIdCollision("different-account-id", "other@example.test", "refresh-team-member-a");
+    expect(result.collision).toBe(true);
+    if (result.collision) {
+      expect(result.reason).toContain("Credential is already in the pool");
+    }
+  });
 });