Enforce case-insensitive uniqueness for usernames

[mathjazz]

See also:
https://bugzilla.mozilla.org/show_bug.cgi?id=2016869

[wassafshahzad]

@mathjazz please assign this to me and just to confirm we need to make user usernames are unique case insensitive, correct ? is there another caveat. Unfortunately i cannot see the Bugzilla issue and have to ask these questions

[mathjazz]

Indeed - usernames should be unique regardless of the case.

[wassafshahzad]

Hi, @mathjazz How would you like to handle pre existing usernames which might conflict after the migrations ? Should we rename them ? we can set them as blank and send effected users a notification to update the username ?

[mathjazz]

Thanks for thinking about this edge case — good catch. 🙂 I found 4 pairs in the production DB.

I think we should avoid setting usernames to blank automatically, because that could be confusing for affected users and might break references to their profiles.

My preference would be:

• keep one canonical username unchanged (e.g. the oldest account)
• rename the conflicting usernames deterministically (e.g. append unique_id)
• notify affected users so they can later choose a different username if they want

That way the migration can complete safely without leaving accounts in an invalid/blank state.

[wassafshahzad]

Hi @mathjazz , I am going with 2 migrations for case-insensitive username uniqueness on UserProfile.

First one cleans up conflicts, keeps oldest account, renames losers to {username}_{user_id}, and drops a notification to affected users via Notification.objects.bulk_create() directly (views just query the table so it shows up without notify.send()).

Second one adds UniqueConstraint(Lower("username")).

Split them so if the constraint migration fails, the cleanup doesn't re-run. I just want to confirm if you using Notification model would be ok since as per my research, the icon will light up on unread notifications

[mathjazz]

Hi @wassafshahzad, that sounds good! You can use notify.send() instead of Notification.objects.bulk_create(), there will be very few calls to the function and the code is more explicit.