fix(accounts): preserve shared workspace account slots (Soju06#974)

* fix(accounts): preserve shared workspace account slots

* fix(accounts): align shared workspace slot CI expectations

* fix(accounts): preserve shared workspace slot identity semantics

* style(accounts): format shared workspace fallback

* fix(accounts): preserve legacy workspace upgrades

* fix(accounts): keep workspace slot fallback scoped

* fix(accounts): allow additional workspace slots

* fix(accounts): preserve workspace identity on oauth

* fix(accounts): route oauth through account slots

* fix(accounts): keep oauth slots identity-keyed

* fix(accounts): scope oauth slot preservation

* fix(accounts): match identity merge by email slot

* fix(accounts): upgrade label-only workspace slots

---------

Co-authored-by: Darafei Praliaskouski <me@komzpa.net>

Author: KakatkarAkshay

.all-contributorsrc

@@ -706,6 +706,16 @@
       "contributions": [
         "code"
       ]
+    },
+    {
+      "login": "KakatkarAkshay",
+      "name": "Akshay Kakatkar",
+      "avatar_url": "https://avatars.githubusercontent.com/u/49910222?v=4",
+      "profile": "https://github.com/KakatkarAkshay",
+      "contributions": [
+        "code",
+        "test"
+      ]
     }
   ],
   "contributorsPerLine": 7,

app/core/auth/__init__.py

@@ -171,8 +171,9 @@ def generate_unique_account_id(
     account_id: str | None,
     email: str | None,
     workspace_id: str | None = None,
+    workspace_label: str | None = None,
 ) -> str:
-    workspace_key = clean_account_identity_part(workspace_id)
+    workspace_key = clean_account_identity_part(workspace_id) or clean_account_identity_part(workspace_label)
     if account_id and workspace_key:
         workspace_hash = hashlib.sha256(workspace_key.encode()).hexdigest()[:8]
         return f"{account_id}_{workspace_hash}"

app/modules/accounts/mappers.py

@@ -59,7 +59,7 @@ def build_account_summaries(
 
 
 def _duplicate_detection_keys_appearing_more_than_once(accounts: list[Account]) -> set[tuple[str, str, str | None]]:
-    """Return duplicate (email, ChatGPT account id, workspace id) keys in this list.
+    """Return duplicate (email, ChatGPT account id, workspace slot key) keys in this list.
 
     Emails are compared case-sensitively to match the storage normalization
     already performed at OAuth-import time. Blank/None emails, the legacy
@@ -81,7 +81,7 @@ def _duplicate_detection_key(account: Account) -> tuple[str, str, str | None] |
     chatgpt_account_id = account.chatgpt_account_id
     if not _is_duplicate_detection_email(email) or not chatgpt_account_id:
         return None
-    return email, chatgpt_account_id, account.workspace_id
+    return email, chatgpt_account_id, account.workspace_id or account.workspace_label
 
 
 def _is_duplicate_detection_email(email: str | None) -> bool:
@@ -222,6 +222,7 @@ def _account_to_summary(
     )
     return AccountSummary(
         account_id=account.id,
+        chatgpt_account_id=account.chatgpt_account_id,
         email=account.email,
         alias=account.alias,
         display_name=account.alias or account.email,

app/modules/accounts/repository.py

@@ -202,13 +202,15 @@ async def upsert(
             canonical = await self._account_by_chatgpt_identity(
                 account.chatgpt_account_id,
                 workspace_id=account.workspace_id,
+                email=account.email,
             )
             if canonical is not None:
                 _apply_account_updates(canonical, account)
                 await self._reconcile_chatgpt_identity_duplicates(
                     canonical=canonical,
                     chatgpt_account_id=account.chatgpt_account_id,
                     workspace_id=account.workspace_id,
+                    email=account.email,
                 )
                 await self._session.commit()
                 await self._session.refresh(canonical)
@@ -241,15 +243,14 @@ async def upsert(
         return account
 
     async def upsert_reauthorized(self, account: Account) -> Account:
-        if account.chatgpt_account_id:
-            return await self.upsert(account, merge_by_email=False, merge_by_chatgpt_identity=True)
         return await self.upsert_account_slot(account, preserve_unknown_workspace_duplicates=False)
 
     async def upsert_account_slot(
         self,
         account: Account,
         *,
         preserve_unknown_workspace_duplicates: bool | None = None,
+        preserve_identity_slots: bool = False,
     ) -> Account:
         if preserve_unknown_workspace_duplicates is None:
             preserve_unknown_workspace_duplicates = not await self._merge_by_email_enabled()
@@ -281,13 +282,12 @@ async def upsert_account_slot(
                 return existing_by_id
             account.id = await self._next_available_account_id(account.id)
         elif not preserve_unknown_workspace_duplicates:
-            existing_by_email = (
-                await self._single_unknown_workspace_account_by_email(account.email)
-                if account.workspace_id
-                else await self._single_account_by_email(account.email)
-                if not account.workspace_id
-                else None
-            )
+            if _workspace_slot_key(account):
+                existing_by_email = await self._single_unknown_workspace_account_by_email(account.email)
+            elif preserve_identity_slots and account.chatgpt_account_id:
+                existing_by_email = None
+            else:
+                existing_by_email = await self._single_account_by_email(account.email)
             if existing_by_email and not _can_reuse_email_fallback(existing_by_email, account):
                 existing_by_email = None
             if existing_by_email:
@@ -306,15 +306,16 @@ async def _account_by_chatgpt_identity(
         chatgpt_account_id: str,
         *,
         workspace_id: str | None,
+        email: str | None,
     ) -> Account | None:
         """Return the canonical local account row for a ChatGPT identity.
 
-        Order of preference, so that reauth reuses the row that already
-        carries the historical usage and audit trail:
+        Order of preference, so that reauth targets the matching real-email
+        slot when one exists, while still allowing an upstream email change
+        to reuse a single unambiguous identity row:
 
-        1. The oldest row by ``created_at`` (deterministic tie-break on
-           ``id``) — this is almost always the original row, before any
-           ``__copyN`` rows were created.
+        1. The oldest row with the incoming email.
+        2. The only identity row when no email match exists.
         """
 
         stmt = select(Account).where(Account.chatgpt_account_id == chatgpt_account_id)
@@ -325,19 +326,34 @@ async def _account_by_chatgpt_identity(
         else:
             stmt = stmt.where(Account.workspace_id.is_(None))
 
-        result = await self._session.execute(stmt.order_by(*order_by).limit(1))
-        return result.scalar_one_or_none()
+        result = await self._session.execute(stmt.order_by(*order_by))
+        candidates = list(result.scalars().all())
+        if not candidates:
+            return None
+        if not email:
+            return candidates[0]
+
+        for candidate in candidates:
+            if candidate.email == email:
+                return candidate
+
+        if len(candidates) == 1:
+            return candidates[0]
+        return None
 
     async def _reconcile_chatgpt_identity_duplicates(
         self,
         canonical: Account,
         chatgpt_account_id: str,
         workspace_id: str | None,
+        email: str | None,
     ) -> None:
         duplicate_stmt = select(Account.id).where(
             Account.chatgpt_account_id == chatgpt_account_id,
             Account.id != canonical.id,
         )
+        if email:
+            duplicate_stmt = duplicate_stmt.where(Account.email == email)
         if workspace_id is None:
             duplicate_stmt = duplicate_stmt.where(Account.workspace_id.is_(None))
         else:
@@ -642,6 +658,7 @@ async def _single_unknown_workspace_account_by_email(self, email: str) -> Accoun
             select(Account)
             .where(Account.email == email)
             .where(Account.workspace_id.is_(None))
+            .where(Account.workspace_label.is_(None))
             .order_by(Account.created_at.asc(), Account.id.asc())
             .limit(2)
         )
@@ -653,21 +670,37 @@ async def _single_unknown_workspace_account_by_email(self, email: str) -> Accoun
         return matches[0]
 
     async def _account_by_slot_identity(self, account: Account) -> Account | None:
-        if account.chatgpt_account_id and account.workspace_id:
+        workspace_slot = _workspace_slot_identity(account)
+        if account.chatgpt_account_id and account.email and workspace_slot:
+            column, value = workspace_slot
+            result = await self._session.execute(
+                select(Account)
+                .where(Account.chatgpt_account_id == account.chatgpt_account_id)
+                .where(Account.email == account.email)
+                .where(column == value)
+                .order_by(Account.created_at.asc(), Account.id.asc())
+                .limit(1)
+            )
+            if matched := result.scalar_one_or_none():
+                return matched
+        if account.chatgpt_account_id and account.email and account.workspace_id and account.workspace_label:
             result = await self._session.execute(
                 select(Account)
                 .where(Account.chatgpt_account_id == account.chatgpt_account_id)
-                .where(Account.workspace_id == account.workspace_id)
+                .where(Account.email == account.email)
+                .where(Account.workspace_id.is_(None))
+                .where(Account.workspace_label == account.workspace_label)
                 .order_by(Account.created_at.asc(), Account.id.asc())
                 .limit(1)
             )
             if matched := result.scalar_one_or_none():
                 return matched
-        if account.workspace_id and account.email:
+        if workspace_slot and account.email:
+            column, value = workspace_slot
             result = await self._session.execute(
                 select(Account)
                 .where(Account.email == account.email)
-                .where(Account.workspace_id == account.workspace_id)
+                .where(column == value)
                 .order_by(Account.created_at.asc(), Account.id.asc())
                 .limit(1)
             )
@@ -733,10 +766,14 @@ def _slot_lock_key(account: Account, *, preserve_unknown_workspace_duplicates: b
 
 def _slot_lock_keys(account: Account, *, preserve_unknown_workspace_duplicates: bool = True) -> tuple[str, ...]:
     keys: list[str] = []
-    if account.chatgpt_account_id and account.workspace_id:
-        keys.append(f"slot:{account.chatgpt_account_id}:{account.workspace_id}")
-    if account.email and account.workspace_id:
-        keys.append(f"slot-email:{account.email}:{account.workspace_id}")
+    workspace_key = _workspace_slot_key(account)
+    if account.chatgpt_account_id:
+        if workspace_key:
+            keys.append(f"slot:{account.chatgpt_account_id}:{workspace_key}")
+        elif account.email:
+            keys.append(f"slot:{account.chatgpt_account_id}:{account.email}")
+    if account.email and workspace_key:
+        keys.append(f"slot-email:{account.email}:{workspace_key}")
         if not preserve_unknown_workspace_duplicates:
             keys.append(f"slot-email-unknown:{account.email}")
     if keys:
@@ -748,13 +785,29 @@ def _slot_lock_keys(account: Account, *, preserve_unknown_workspace_duplicates:
 
 def _same_unknown_workspace_identity(existing: Account, incoming: Account) -> bool:
     return (
-        not existing.workspace_id
-        and not incoming.workspace_id
+        _workspace_slot_key(existing) is None
+        and _workspace_slot_key(incoming) is None
         and existing.chatgpt_account_id == incoming.chatgpt_account_id
         and existing.email == incoming.email
     )
 
 
+def _workspace_slot_identity(account: Account) -> tuple[Any, str] | None:
+    if account.workspace_id:
+        return Account.workspace_id, account.workspace_id
+    if account.workspace_label:
+        return Account.workspace_label, account.workspace_label
+    return None
+
+
+def _workspace_slot_key(account: Account) -> str | None:
+    if account.workspace_id:
+        return account.workspace_id
+    if account.workspace_label:
+        return account.workspace_label
+    return None
+
+
 def _is_workspace_less_reauth_for_known_slot(
     existing: Account,
     incoming: Account,
@@ -772,6 +825,10 @@ def _is_workspace_less_reauth_for_known_slot(
 
 
 def _can_reuse_email_fallback(existing: Account, incoming: Account) -> bool:
+    existing_workspace_key = _workspace_slot_key(existing)
+    incoming_workspace_key = _workspace_slot_key(incoming)
+    if existing_workspace_key and incoming_workspace_key and existing_workspace_key != incoming_workspace_key:
+        return False
     return (
         not incoming.chatgpt_account_id
         or not existing.chatgpt_account_id

app/modules/accounts/schemas.py

@@ -72,6 +72,7 @@ class AccountAdditionalQuota(DashboardModel):
 
 class AccountSummary(DashboardModel):
     account_id: str
+    chatgpt_account_id: str | None = None
     email: str
     alias: str | None = None
     display_name: str

app/modules/accounts/service.py

@@ -281,7 +281,7 @@ async def import_account(self, raw: bytes) -> AccountImportResponse:
 
         email = claims.email or DEFAULT_EMAIL
         raw_account_id = claims.account_id
-        account_id = generate_unique_account_id(raw_account_id, email, claims.workspace_id)
+        account_id = generate_unique_account_id(raw_account_id, email, claims.workspace_id, claims.workspace_label)
         plan_type = coerce_account_plan_type(claims.plan_type, DEFAULT_PLAN)
         last_refresh = to_utc_naive(auth.last_refresh_at) if auth.last_refresh_at else utcnow()
 

app/modules/oauth/service.py

@@ -573,7 +573,7 @@ async def _persist_tokens(self, tokens: OAuthTokens) -> None:
         workspace_id = clean_account_identity_part(auth_claims.workspace_id or claims.workspace_id)
         workspace_label = clean_account_identity_part(auth_claims.workspace_label or claims.workspace_label)
         seat_type = normalize_seat_type(auth_claims.seat_type or claims.seat_type)
-        account_id = generate_unique_account_id(raw_account_id, email, workspace_id)
+        account_id = generate_unique_account_id(raw_account_id, email, workspace_id, workspace_label)
         plan_type = coerce_account_plan_type(
             auth_claims.chatgpt_plan_type or claims.chatgpt_plan_type,
             DEFAULT_PLAN,
@@ -596,19 +596,17 @@ async def _persist_tokens(self, tokens: OAuthTokens) -> None:
         )
         if self._repo_factory:
             async with self._repo_factory() as repo:
-                if raw_account_id and workspace_id is None:
-                    await repo.upsert(account, merge_by_email=False, merge_by_chatgpt_identity=True)
-                else:
-                    await repo.upsert_account_slot(account, preserve_unknown_workspace_duplicates=False)
-        else:
-            if raw_account_id and workspace_id is None:
-                await self._accounts_repo.upsert(
+                await repo.upsert_account_slot(
                     account,
-                    merge_by_email=False,
-                    merge_by_chatgpt_identity=True,
+                    preserve_unknown_workspace_duplicates=False,
+                    preserve_identity_slots=True,
                 )
-            else:
-                await self._accounts_repo.upsert_account_slot(account, preserve_unknown_workspace_duplicates=False)
+        else:
+            await self._accounts_repo.upsert_account_slot(
+                account,
+                preserve_unknown_workspace_duplicates=False,
+                preserve_identity_slots=True,
+            )
 
         await self._invalidate_account_routing_caches()
 

frontend/src/features/accounts/components/account-detail.tsx

@@ -85,7 +85,7 @@ export function AccountDetail({
       ? account.email
       : null;
   const idSuffix = showAccountId ? ` (${compactId})` : "";
-  const workspaceLabel = account.workspaceLabel || account.workspaceId || "Personal / unknown workspace";
+  const workspaceLabel = account.chatgptAccountId || account.workspaceLabel || account.workspaceId || "Personal / unknown workspace";
   const seatLabel = account.seatType ? ` | ${formatSlug(account.seatType)}` : "";
 
   return (

frontend/src/features/accounts/components/account-list-item.test.tsx

@@ -196,6 +196,7 @@ describe("AccountListItem", () => {
       displayName: "Work seat",
       email: "work@example.com",
       planType: "team",
+      chatgptAccountId: null,
       workspaceLabel: "Design Workspace",
       seatType: "member",
     });
@@ -207,4 +208,19 @@ describe("AccountListItem", () => {
       screen.getByText((_, element) => element?.textContent === "work@example.com | Team | Design Workspace | Member"),
     ).toBeInTheDocument();
   });
+
+  it("uses ChatGPT account id before workspace metadata or unknown fallback", () => {
+    const account = createAccountSummary({
+      planType: "team",
+      workspaceId: "legacy-workspace-id",
+      workspaceLabel: "Legacy Workspace",
+      chatgptAccountId: "chatgpt-workspace-123",
+    });
+
+    render(<AccountListItem account={account} selected={false} onSelect={vi.fn()} />);
+
+    expect(screen.getByText("Team | chatgpt-workspace-123")).toBeInTheDocument();
+    expect(screen.queryByText(/Legacy Workspace/)).not.toBeInTheDocument();
+    expect(screen.queryByText(/Personal \/ unknown workspace/)).not.toBeInTheDocument();
+  });
 });

frontend/src/features/accounts/components/account-list-item.tsx

@@ -41,7 +41,7 @@ export function AccountListItem({
   const emailSubtitle = account.displayName && account.displayName !== account.email
     ? account.email
     : null;
-  const workspaceLabel = account.workspaceLabel || account.workspaceId || "Personal / unknown workspace";
+  const workspaceLabel = account.chatgptAccountId || account.workspaceLabel || account.workspaceId || "Personal / unknown workspace";
   const seatLabel = account.seatType ? ` | ${formatSlug(account.seatType)}` : "";
   const slotSubtitle = `${formatSlug(account.planType)} | ${workspaceLabel}${seatLabel}`;
   const idSuffix = showAccountId ? ` | ID ${formatCompactAccountId(account.accountId)}` : "";