fix(scim): improve unique constraint error detection for externalId

Author: Bewinxed

internal/api/scim.go

@@ -16,6 +16,17 @@ import (
 	"github.com/supabase/auth/internal/utilities"
 )
 
+func isPostgresUniqueViolation(err error) bool {
+	errToCheck := err
+	if httpErr, ok := err.(*apierrors.HTTPError); ok && httpErr.InternalError != nil {
+		errToCheck = httpErr.InternalError
+	}
+	if pgErr := utilities.NewPostgresError(errToCheck); pgErr != nil && pgErr.IsUniqueConstraintViolated() {
+		return true
+	}
+	return false
+}
+
 func (a *API) requireSCIMAuthentication(w http.ResponseWriter, r *http.Request) (context.Context, error) {
 	ctx := r.Context()
 	db := a.db.WithContext(ctx)
@@ -418,7 +429,7 @@ func (a *API) scimReplaceUser(w http.ResponseWriter, r *http.Request) error {
 					user.Identities[i].IdentityData["external_id"] = params.ExternalID
 					user.Identities[i].IdentityData["sub"] = params.ExternalID
 					if err := tx.UpdateOnly(&user.Identities[i], "provider_id", "identity_data"); err != nil {
-						if models.IsUniqueConstraintViolatedError(err) {
+						if isPostgresUniqueViolation(err) {
 							return apierrors.NewSCIMConflictError("externalId already exists", "uniqueness")
 						}
 						return apierrors.NewInternalServerError("Error updating identity").WithInternalError(err)
@@ -568,7 +579,7 @@ func (a *API) applySCIMUserPatch(tx *storage.Connection, user *models.User, op S
 						user.Identities[i].IdentityData["external_id"] = externalID
 						user.Identities[i].IdentityData["sub"] = externalID
 						if err := tx.UpdateOnly(&user.Identities[i], "provider_id", "identity_data"); err != nil {
-							if models.IsUniqueConstraintViolatedError(err) {
+							if isPostgresUniqueViolation(err) {
 								return apierrors.NewSCIMConflictError("externalId already exists", "uniqueness")
 							}
 							return apierrors.NewInternalServerError("Error updating identity").WithInternalError(err)
@@ -669,7 +680,7 @@ func (a *API) applySCIMUserPatch(tx *storage.Connection, user *models.User, op S
 					user.Identities[i].IdentityData["external_id"] = externalID
 					user.Identities[i].IdentityData["sub"] = externalID
 					if err := tx.UpdateOnly(&user.Identities[i], "provider_id", "identity_data"); err != nil {
-						if models.IsUniqueConstraintViolatedError(err) {
+						if isPostgresUniqueViolation(err) {
 							return apierrors.NewSCIMConflictError("externalId already exists", "uniqueness")
 						}
 						return apierrors.NewInternalServerError("Error updating identity").WithInternalError(err)
@@ -802,7 +813,7 @@ func (a *API) applySCIMUserPatch(tx *storage.Connection, user *models.User, op S
 							user.Identities[i].IdentityData["external_id"] = externalID
 							user.Identities[i].IdentityData["sub"] = externalID
 							if err := tx.UpdateOnly(&user.Identities[i], "provider_id", "identity_data"); err != nil {
-								if models.IsUniqueConstraintViolatedError(err) {
+								if isPostgresUniqueViolation(err) {
 									return apierrors.NewSCIMConflictError("externalId already exists", "uniqueness")
 								}
 								return apierrors.NewInternalServerError("Error updating identity").WithInternalError(err)

internal/api/scim_test.go

@@ -2869,7 +2869,7 @@ func (ts *SCIMTestSuite) TestSCIMPatchExternalIdConflict() {
 }
 
 func (ts *SCIMTestSuite) TestSCIMPatchNoPathWrongTypeReturns400() {
-	user := ts.createSCIMUser(testUser24)
+	user := ts.createSCIMUser(testUser24.UserName, testUser24.Email)
 
 	cases := []struct {
 		name string