- Shipped
- August 24, 2026 at 11:04 PM UTC
- Author
- Kamo
- Commit
- 8621cf4
byAlias took LIMIT 1 over orgs.alias, which has no uniqueness constraint: the create path checks it per security provider and PUT /org/{id} does not check it at all. The live estate really does repeat -- four organizations share "acme-corp" and two share "kia-kaha" -- so ?org=acme-corp resolved to whichever row the database happened to return first, and could resolve to a different organization on a different day. An alias now names an organization only when it names exactly one. That is the rule the platform already applies to a mailbox address resolving to two accounts: an identifier that names two things names neither. The org id is unambiguous and always works, so nothing becomes unreachable. A global unique index on orgs.alias is the real fix and is still worth doing, but it cannot be created against this data until those five orgs are re-aliased -- and picking arbitrarily in the meantime is worse than saying no. 940 tests pass.