From f3d0c30f48878d423590feb5ae08bf1c934f1764 Mon Sep 17 00:00:00 2001 From: dawn Date: Sun, 26 Jul 2026 19:16:19 +0300 Subject: [PATCH] spindle: reject repo record if repo was already registered under another owner Signed-off-by: dawn --- spindle/tapclient.go | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/spindle/tapclient.go b/spindle/tapclient.go index 920f2495..512dbc6d 100644 --- a/spindle/tapclient.go +++ b/spindle/tapclient.go @@ -131,6 +131,17 @@ func (t *Tap) processRepo(ctx context.Context, evt *tapc.RecordEventData) error return nil } + // check if this repo DID is already owned by someone else + existingRepo, err := t.spindle.db.GetRepoByDid(repoDid) + if err == nil { + if existingRepo.Owner != ownerDid { + l.Warn("rejecting repo record: repoDid already registered by another owner", "repoDid", repoDid, "existingOwner", existingRepo.Owner, "newOwner", ownerDid) + return nil + } + } else if !errors.Is(err, sql.ErrNoRows) { + return fmt.Errorf("lookup existing repo by DID: %w", err) + } + if err := t.spindle.e.AddRepo(ownerDid.String(), rbac.ThisServer, repoDid.String()); err != nil { l.Error("failed to add repo policy", "err", err) return fmt.Errorf("add repo policy: %w", err) -- 2.51.2