fix(api): enforce unique namespace names in postgres

The mongo to postgres migration dropped mongo's unique index on
namespaces.name, so duplicate names could coexist. Device lookup
resolves a namespace by name and scans a single row, so duplicates made
SSH resolve to the wrong tenant and return "device not found".

Add migration 004 that renames pre-existing duplicates non-destructively
(oldest row per case-insensitive group keeps its name) and creates a
unique index on lower(name), and map store.ErrDuplicate to
ErrNamespaceDuplicated in both the create and rename service paths.

Fixes: #6438

Author: otavio

api/services/namespace.go

@@ -94,7 +94,14 @@ func (s *service) CreateNamespace(ctx context.Context, req *requests.NamespaceCr
 		ns.MaxDevices = -1
 	}
 
+	// The NamespaceConflicts pre-check above is the fast path; store.ErrDuplicate
+	// here means a concurrent insert raced past it. Map it to ErrNamespaceDuplicated
+	// so callers get a consistent duplicate signal regardless of timing.
 	if _, err := s.store.NamespaceCreate(ctx, ns); err != nil {
+		if errors.Is(err, store.ErrDuplicate) {
+			return nil, NewErrNamespaceDuplicated(err)
+		}
+
 		return nil, NewErrNamespaceCreateStore(err)
 	}
 
@@ -196,7 +203,14 @@ func (s *service) EditNamespace(ctx context.Context, req *requests.NamespaceEdit
 		namespace.Settings.ConnectionAnnouncement = *req.Settings.ConnectionAnnouncement
 	}
 
+	// NamespaceUpdate returns store.ErrDuplicate when the new name collides with an
+	// existing namespace. Map it to ErrNamespaceDuplicated so callers get a
+	// consistent duplicate signal regardless of timing.
 	if err := s.store.NamespaceUpdate(ctx, namespace); err != nil {
+		if errors.Is(err, store.ErrDuplicate) {
+			return nil, NewErrNamespaceDuplicated(err)
+		}
+
 		return nil, err
 	}
 

api/services/namespace_test.go

@@ -653,6 +653,83 @@ func TestCreateNamespace(t *testing.T) {
 				err: NewErrNamespaceCreateStore(errors.New("error")),
 			},
 		},
+		{
+			// store.ErrDuplicate from NamespaceCreate means a concurrent insert raced past the
+			// NamespaceConflicts pre-check (case-sensitive name=? queries rely on lowercased
+			// writes). The service must map it to ErrNamespaceDuplicated, not ErrNamespaceCreateStore.
+			description: "fails when NamespaceCreate returns store.ErrDuplicate",
+			req: &requests.NamespaceCreate{
+				UserID:   "000000000000000000000000",
+				Name:     "namespace",
+				TenantID: "00000000-0000-4000-0000-000000000000",
+			},
+			requiredMocks: func() {
+				storeMock.
+					On("UserGetInfo", ctx, "000000000000000000000000").
+					Return(
+						&models.UserInfo{
+							OwnedNamespaces:      []models.Namespace{{}},
+							AssociatedNamespaces: []models.Namespace{},
+						},
+						nil,
+					).
+					Once()
+				storeMock.
+					On("UserResolve", ctx, store.UserIDResolver, "000000000000000000000000").
+					Return(&models.User{
+						ID:            "000000000000000000000000",
+						MaxNamespaces: 3,
+					}, nil).
+					Once()
+				storeMock.
+					On("NamespaceConflicts", ctx, &models.NamespaceConflicts{Name: "namespace"}).
+					Return(nil, false, nil).
+					Once()
+				// envs.IsCommunity() calls SHELLHUB_CLOUD then SHELLHUB_ENTERPRISE.
+				envMock.
+					On("Get", "SHELLHUB_CLOUD").
+					Return("false").
+					Once()
+				envMock.
+					On("Get", "SHELLHUB_ENTERPRISE").
+					Return("false").
+					Once()
+				// envs.IsCloud() calls SHELLHUB_CLOUD once more.
+				envMock.
+					On("Get", "SHELLHUB_CLOUD").
+					Return("false").
+					Once()
+				storeMock.
+					On(
+						"NamespaceCreate",
+						ctx,
+						&models.Namespace{
+							TenantID: "00000000-0000-4000-0000-000000000000",
+							Name:     "namespace",
+							Owner:    "000000000000000000000000",
+							Type:     models.TypeTeam,
+							Members: []models.Member{
+								{
+									ID:      "000000000000000000000000",
+									Role:    authorizer.RoleOwner,
+									AddedAt: now,
+								},
+							},
+							Settings: &models.NamespaceSettings{
+								SessionRecord:          true,
+								ConnectionAnnouncement: models.DefaultAnnouncementMessage,
+							},
+							MaxDevices: -1,
+						},
+					).
+					Return("", store.ErrDuplicate).
+					Once()
+			},
+			expected: Expected{
+				ns:  nil,
+				err: NewErrNamespaceDuplicated(store.ErrDuplicate),
+			},
+		},
 		{
 			description: "succeeds to create a namespace",
 			req: &requests.NamespaceCreate{
@@ -1106,6 +1183,33 @@ func TestEditNamespace(t *testing.T) {
 				errors.New("error"),
 			},
 		},
+		{
+			description:   "fails with ErrNamespaceDuplicated when store returns ErrDuplicate",
+			tenantID:      "xxxxx",
+			namespaceName: "newname",
+			requiredMocks: func() {
+				namespace := &models.Namespace{
+					TenantID: "xxxxx",
+					Name:     "oldname",
+					Settings: &models.NamespaceSettings{SessionRecord: false},
+				}
+				storeMock.
+					On("NamespaceResolve", ctx, store.NamespaceTenantIDResolver, "xxxxx").
+					Return(namespace, nil).
+					Once()
+
+				expectedNamespace := *namespace
+				expectedNamespace.Name = "newname"
+				storeMock.
+					On("NamespaceUpdate", ctx, &expectedNamespace).
+					Return(store.ErrDuplicate).
+					Once()
+			},
+			expected: Expected{
+				nil,
+				NewErrNamespaceDuplicated(store.ErrDuplicate),
+			},
+		},
 		{
 			description:   "succeeds changing the name to lowercase",
 			namespaceName: "newName",

api/store/pg/migrations/004_namespaces_name_unique.tx.down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS namespaces_name_unique;

api/store/pg/migrations/004_namespaces_name_unique.tx.up.sql

@@ -0,0 +1,39 @@
+-- Step a: deduplicate existing rows non-destructively by renaming duplicates.
+-- For each case-insensitive name group the oldest row (by created_at, ties broken
+-- by id ASC) keeps its original name; every other row in that group is renamed to
+-- "<base>-<first-8-chars-of-id>" where <base> is the lower-cased original name
+-- truncated so the full result never exceeds 63 characters.
+-- Trailing hyphens are stripped from the base before the suffix is appended, so
+-- the resulting name always starts and ends with an alphanumeric character.
+-- Re-running this statement is safe (idempotent): rows that were already renamed
+-- by a previous run will not match the duplicate-detection predicate again.
+WITH winners AS (
+    -- One winner per lower(name) group: oldest created_at, smallest id on ties.
+    SELECT DISTINCT ON (lower(name)) id
+    FROM namespaces
+    ORDER BY lower(name), created_at ASC, id ASC
+),
+duplicates AS (
+    -- Every row that is NOT the winner of its group.
+    SELECT n.id,
+           lower(n.name) AS lower_name
+    FROM   namespaces n
+    WHERE  n.id NOT IN (SELECT id FROM winners)
+)
+UPDATE namespaces n
+SET name = (
+    -- Build "<base>-<suffix>" where suffix = first 8 hex chars of the UUID.
+    -- Base = lower(name) truncated to at most 54 chars, then right-stripped of
+    -- hyphens so the final name never starts/ends with '-'.
+    rtrim(
+        left(lower(n.name), 54),
+        '-'
+    ) || '-' || left(replace(n.id::text, '-', ''), 8)
+)
+FROM duplicates d
+WHERE n.id = d.id;
+
+--bun:split
+
+-- Step b: create a case-insensitive unique index on lower(name).
+CREATE UNIQUE INDEX namespaces_name_unique ON namespaces USING btree (lower(name));