- Ya
- 24 Agosti 2026, 23:04 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 8621cf4
byAlias took LIMIT 1 over orgs.alias, which has no uniqueness constraint: the create path checks it per security provider and PUT /org/{id} does not check it at all. The live estate really does repeat -- four organizations share "acme-corp" and two share "kia-kaha" -- so ?org=acme-corp resolved to whichever row the database happened to return first, and could resolve to a different organization on a different day. An alias now names an organization only when it names exactly one. That is the rule the platform already applies to a mailbox address resolving to two accounts: an identifier that names two things names neither. The org id is unambiguous and always works, so nothing becomes unreachable. A global unique index on orgs.alias is the real fix and is still worth doing, but it cannot be created against this data until those five orgs are re-aliased -- and picking arbitrarily in the meantime is worse than saying no. 940 tests pass.