- Shipped
- August 29, 2026 at 2:30 AM UTC
- Author
- Kamo
- Commit
- a5818af
Creating an organization 409'd on any existing row for the domain, which meant the first organization to enter "acme.com" locked out every other one — including whoever actually owns acme.com, who then had no way in at all. Nobody proves anything by filling in a form, so nobody should be able to deny a domain by filling one in. Ownership is settled once, later, and only one way: the DNS TXT record on /setup/dns. That is what makes a domain exclusive — DomainService revokes it everywhere else on verification — and routing follows only a verified row. Which is the other half of this commit. OrgResolutionService.byDomain is the second host-to-org resolver (the first is the shared library's findByDomain) and it read any row at all, so with duplicates now legal it would have handed a host to whoever typed it first. It requires ownership_verified too, and takes the lowest org id when historical data holds more than one, so the same host always resolves to the same organization instead of to whichever row came back first. The duplicate-domain handler on POST /domains is organization-scoped for the same reason: a duplicate can only be the caller's own now, and asking by name alone would find whoever holds the domain and tell this member that their own duplicate belongs to somebody else.